c739be0419a32f30a7fc81c15c32ef5c4b2d1b26cb096155efe1ef194bfdc503

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Size 4.1MB
Sample261014-e6lemsfw7s
SHA256 c739be0419a32f30a7fc81c15c32ef5c4b2d1b26cb096155efe1ef194bfdc503
MD5 61cde48da4968fa461b6eaa13e939de3
SHA1 8464baa52af55101488024c67ef1ebaa51f958c7
SHA512 ca6452bd59678b53239f6e228e9415902cda11219e06468999de7fef6df002ffbdc9abb61c5a735da368cf056c4e6c05e55c0c8c8a9e2f02dc0d6afb888ec271
SSDEEP 98304:BrIfJGonKVb3Gp+/ew74o0jVIUOr6kr+TQJ8XhnsaID:BUfCEpo7VOIRHvJ8saID
TLSH
T12116334663D64476E2244B74D8BD83407D23BD1C19E3E7AB6CB4E66E0AFB2C5CA31613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3308	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3056	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
5360	CleanupConsole.exe
2656	OneSystemCare.exe

Loads dropped DLL 4 IoCs

pid	Process
3308	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3308	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3056	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3056	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\OneSystemCare\ydwqk.dll	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-U1NNC.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-594VC.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-AQFNF.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-MGHHO.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-VM3CN.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File created	C:\Program Files (x86)\OneSystemCare\is-7AKPG.tmp	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\unins000.dat	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
File opened for modification	C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini	OneSystemCare.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\One System CarePeriod.job	OneSystemCare.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1068_1348558897\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1068_331979017\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1068_331979017\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneSystemCare.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	CleanupConsole.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	CleanupConsole.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneSystemCare.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CleanupConsole.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneSystemCare.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2188	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5112-1-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/5112-41-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/1236-49-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/5112-62-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/1236-67-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup
behavioral2/memory/1236-142-0x0000000000400000-0x000000000042F000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OneSystemCare.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneSystemCare.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{F942257A-E439-4BC6-87FD-581EA6B2233D}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4260	schtasks.exe
1664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3056	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3056	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3056	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
3056	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2656	OneSystemCare.exe
Token: SeCreatePagefilePrivilege	2656	OneSystemCare.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3056	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
2656	OneSystemCare.exe
5360	CleanupConsole.exe
5360	CleanupConsole.exe
1068	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2656	OneSystemCare.exe
5360	CleanupConsole.exe
5360	CleanupConsole.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5360	CleanupConsole.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3308	5112	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	91
PID 3308 wrote to memory of 1236	3308	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	92
PID 1236 wrote to memory of 3056	1236	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe	93
PID 3056 wrote to memory of 4260	3056	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	94
PID 3056 wrote to memory of 1664	3056	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp	98
PID 5360 wrote to memory of 1068	5360	CleanupConsole.exe	104
PID 1068 wrote to memory of 4328	1068	msedge.exe	105
PID 1068 wrote to memory of 2952	1068	msedge.exe	107
PID 1068 wrote to memory of 2188	1068	msedge.exe	108
PID 1068 wrote to memory of 2952	1068	msedge.exe	107
PID 1068 wrote to memory of 2952	1068	msedge.exe	107
PID 1068 wrote to memory of 2504	1068	msedge.exe	109
PID 1068 wrote to memory of 2504	1068	msedge.exe	109
PID 1068 wrote to memory of 4764	1068	msedge.exe	110
PID 1068 wrote to memory of 4764	1068	msedge.exe	110
PID 1068 wrote to memory of 4764	1068	msedge.exe	110
PID 1068 wrote to memory of 756	1068	msedge.exe	111
PID 1068 wrote to memory of 756	1068	msedge.exe	111
PID 1068 wrote to memory of 756	1068	msedge.exe	111
PID 1068 wrote to memory of 6088	1068	msedge.exe	112
PID 1068 wrote to memory of 5216	1068	msedge.exe	113
PID 1068 wrote to memory of 6088	1068	msedge.exe	112
PID 1068 wrote to memory of 6088	1068	msedge.exe	112
PID 1068 wrote to memory of 5216	1068	msedge.exe	113
PID 1068 wrote to memory of 5216	1068	msedge.exe	113
PID 1068 wrote to memory of 5988	1068	msedge.exe	115
PID 1068 wrote to memory of 5988	1068	msedge.exe	115
PID 1068 wrote to memory of 4164	1068	msedge.exe	116
PID 1068 wrote to memory of 3548	1068	msedge.exe	117
PID 1068 wrote to memory of 4164	1068	msedge.exe	116
PID 1068 wrote to memory of 3548	1068	msedge.exe	117
PID 1068 wrote to memory of 3260	1068	msedge.exe	119
PID 1068 wrote to memory of 3904	1068	msedge.exe	120
PID 1068 wrote to memory of 3904	1068	msedge.exe	120
PID 1068 wrote to memory of 5292	1068	msedge.exe	123
PID 1068 wrote to memory of 5292	1068	msedge.exe	123
PID 5360 wrote to memory of 4572	5360	CleanupConsole.exe	125
PID 1068 wrote to memory of 2492	1068	msedge.exe	126
PID 1068 wrote to memory of 2492	1068	msedge.exe	126
PID 1068 wrote to memory of 2492	1068	msedge.exe	126
PID 5360 wrote to memory of 5680	5360	CleanupConsole.exe	127
PID 1068 wrote to memory of 4456	1068	msedge.exe	128
PID 1068 wrote to memory of 4456	1068	msedge.exe	128
PID 1068 wrote to memory of 4456	1068	msedge.exe	128
PID 1068 wrote to memory of 3396	1068	msedge.exe	129
PID 1068 wrote to memory of 3396	1068	msedge.exe	129
PID 1068 wrote to memory of 3396	1068	msedge.exe	129
PID 5360 wrote to memory of 2560	5360	CleanupConsole.exe	130
PID 1068 wrote to memory of 5984	1068	msedge.exe	131
PID 1068 wrote to memory of 5984	1068	msedge.exe	131
PID 1068 wrote to memory of 5984	1068	msedge.exe	131
PID 1068 wrote to memory of 5400	1068	msedge.exe	132
PID 1068 wrote to memory of 756	1068	msedge.exe	133
PID 1068 wrote to memory of 3152	1068	msedge.exe	134
PID 5360 wrote to memory of 1332	5360	CleanupConsole.exe	135
PID 1068 wrote to memory of 932	1068	msedge.exe	136
PID 1068 wrote to memory of 932	1068	msedge.exe	136
PID 1068 wrote to memory of 932	1068	msedge.exe	136
PID 5360 wrote to memory of 5396	5360	CleanupConsole.exe	137
PID 1068 wrote to memory of 5968	1068	msedge.exe	138
PID 1068 wrote to memory of 5968	1068	msedge.exe	138
PID 1068 wrote to memory of 5968	1068	msedge.exe	138
PID 1068 wrote to memory of 3700	1068	msedge.exe	139
PID 1068 wrote to memory of 3700	1068	msedge.exe	139

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\is-D975N.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-D975N.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$501AA,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
    C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe /LANG=en /SL5="$501AA,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\is-P0LUH.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-P0LUH.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp" /SL5="$14005A,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe" /LANG=en /SL5="$501AA,3869714,151040,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "\"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe\" -Notify" /sc onlogon /TN "One System Care Monitor" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4260
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TR "'C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe' --scan" /sc ONCE /st 05:38 /sd 10/14/2026 /TN "One System Care Delayed" /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1664

C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe
"C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7fff2d87c188,0x7fff2d87c194,0x7fff2d87c1a0
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,8621006209454696393,18139876799466452621,262144 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,14180877044664836395,15321286774808007400,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,6361909164870303842,17151158553189874921,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,14656107251423705108,17978155889794832489,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,17903278858525747850,17914538917360929662,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,11874032620494377258,4677172023653549111,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,13410785917160715363,12011192877991916549,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:9
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,15055288002043354807,2466839038539384487,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,17051529709518108324,12491635719204798728,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,4436247497369080887,17326895747092908772,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,13139885560654669243,518679225345248750,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,13139885560654669243,518679225345248750,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,10301086406282188942,7108947974970474973,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,8890882980476728259,7768311148185967320,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6452,i,17489299609414943021,3348362018578259665,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5160,i,5071130996306205370,2041364470455392758,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5192,i,9147015479244989421,12042216253420682321,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3684,i,3542718824391311439,6740867500321162260,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,15243224041745680956,7212044577256590942,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:14
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,7255109479088143218,922748469960172683,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,5077764564425009292,15995894051983988968,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7076,i,15197916551302688436,5004917121184641882,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7124,i,10936493318936166522,172576133900943751,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7152,i,1630257493383151373,15829670524904366961,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4868,i,13017003573197986677,15508372425890959730,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7348,i,9971475981494157051,7010220576632241825,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:1
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7456,i,4487883552444838949,3286632548573785690,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:1
    3⤵
    PID:580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7808,i,7282506541788537383,12113749894051844171,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:14
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7712,i,197964428307935507,6151792041784286036,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6104,i,2484059488278661413,15191053361586091730,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8232,i,2618321564216839981,11518812760048953104,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:1
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8388,i,15995253194242292225,12953950541311866105,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=8356 /prefetch:14
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8524,i,16454488854615757472,7442946803813563676,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8396,i,7863057870478496163,8423645900114266935,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:1
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6196,i,4037494577854193687,7623803715465314074,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,9649562482173313611,8464650314491779972,524288 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=8800 /prefetch:14
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6776,i,2290250470267507574,2906639409514168636,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:1
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9008,i,15550154759693444391,6597999646177588931,2097152 --field-trial-handle=2548,i,4592373287236794075,14770394536651437833,262144 --variations-seed-version --mojo-platform-channel-handle=8464 /prefetch:1
    3⤵
    PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gen2.securedshopgate.com/?t=01&b=33&tid=331002895-US-244_DFEE3D9E-2F02-4896-9006-35C2528414D5&chid=1=1757&utm_source=331002895&utm_medium=OneSystemCare4.5&utm_campaign=popupok
  2⤵
  PID:2128

C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe
"C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CleanupConsole.exe

Path C:\Program Files (x86)\OneSystemCare\CleanupConsole.exe
Size 1.1MB
SHA256 4f68c3459b3189090fa9eb22dc0d3cacf4affce1c49b3221e905d8d78018d5e7
MD5 ef2fe64e0c2fef65942e634d595f46aa
SHA1 4b92863c3bdfdda4ffd1062aacee6323c24f02af
SHA512 abef82835e525dc93a54147d76dfea1b23e71b3b990fd4e84750cb93153175f7135e5cd7354094bb89aff2d41adc3600ad2bf19356b2175968d87124c2e28edc
SSDEEP 24576:XNvzpabVthaewMpj88DKVGRVd+Qvu+fmvxNbDNb/:mbhaQpj88LfmvxNbJ/
TLSH
T18635CF117982C432D1A205714CAEE7AE26BDBF208F2148CF73C42B1E9F75AD1A735697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSystemCare.exe

Path C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe
Size 3.3MB
SHA256 cb2c8e5e24e39d48ff49cf252aaf47ce78275a304e7b68f7390c43317e1de535
MD5 9e29b970621313e72935c853ed41f9f9
SHA1 4a4ed062d718789c48471e82f227ada07ee3d442
SHA512 d0f6a7f3d4897355a2cbeaa9bc36dd386f31cdd9b9835ec78ceda011aa1dc5a34789fe75feedc0dce6956611c3285a8c162dc6f444c970c47bb272be0bc3d8e8
SSDEEP 49152:LmIorm1VKYiSDlUXFfzfCVVgUmsruAZDwk4yOGoXryTLigSfM:tom1VK5SDlUXtCtZrujoOj7yTL
TLSH
T169F5AE311715B32ED02324B3662E26EA5015EF700BE48CBB67943A6BD6F87D2D63534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneSystemCare.ini

Path C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini
Size 833B
SHA256 79a63597f323ecec4e410f3fcf3cc4dfbab1bbb2a35ef4dd72379b9b3e370042
MD5 77a2738d5708a0b350cf9d23cd6b4f6f
SHA1 496c288626882492a555530f5a851074ec7fa41c
SHA512 67b880f298133700770e8023d17dca2336b507429f5c55055734a62a96672d64c455242b1ba55c8aa1bdd631903cd4d2e5715f64a6315f2f53926cab59811ae8
TLSH
T1AC01C2F94900487E85F5A03BD8F1636826E6DEC5CE103B7057C13589CFA511E97FA179
MD5 SHA1 SHA512 TLSH

Submit Download

OneSystemCare.ini

Path C:\Program Files (x86)\OneSystemCare\OneSystemCare.ini
Size 843B
SHA256 405d208ba86aaa60fd8c60bffaa1c13088fc48210954579ae7927818a0bfc65e
MD5 f87beb63c47b8bd39562b5fe818cfb03
SHA1 a61d58b747a76757dedba7a3e3df9cd3a1ae9497
SHA512 e2569975205baf715ed420e6acaf302540c55d8ae6268e15b7c53fac3820dac7f16467fcedbf34a22c351096cbd22ffaac583cb515ea26ac974204eeae5aa61c
TLSH
T14901EFF9490008BE86F1A03BD8B1236826E78EC58E102B7057C12989CFA511E96BA179
MD5 SHA1 SHA512 TLSH

Submit Download

OneSystemCare.exe

Path C:\ProgramData\dcbdb831-95af-4d21-874a-b8159552646c\OneSystemCare.exe
Size 929KB
SHA256 3eeffa9fa23e73186aded7269be31c251e7460cb866516f4acbea1415fab0184
MD5 b1b1114900528ad34decb187bc9092cd
SHA1 c6d774e827256e9c80aae0073926e852dee97899
SHA512 44fd8a8fb9f29a07e216823a6f1b48822f59e1ddf2a4592ad93c876f4e9a69a411a372035c7e0cf77e48f43384b1ec556b87b66afac9dd1eeb904aa76bd1637c
SSDEEP 12288:fUb9Xn7Mu3qI70c9viIROLTv33XNKSceZg0Y+vYNHKSy8YivuRWoUZMzJb/Ty7:fUJX7MA0c9vxkH3tKOfxlUnRaxTS
TLSH
T1E415CF37398A2932E787FD7E0BF3561E4AE118424722D69B6225CC37D15EFE091B1263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2506f7b0-9e27-4ab4-a353-270c0e8138d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2506f7b0-9e27-4ab4-a353-270c0e8138d7.tmp
Size 38KB
SHA256 c343bbe2c8b0bde558467fe28a71017b0030d360e9c263bc3367a88e7175b57a
MD5 454ed854365e0e933b1b2afc620c28b1
SHA1 1773c8cc33a79ec262c324c089ce68fd57bca3ec
SHA512 165d2f6f22f5a95206ee6fb0be5250bec981e516b57af3522402a04bacdf8bb2e07df31e8e9eeab704aba5a440634e9fa0f62bd939ff7f7ff88bb30c7258ba09
SSDEEP 768:6/UxvxjgC+I3FhOKzmE57Y0GZxJsXBdK8EySHUPpMs:/Zj3+I37d70/JsXf7vSfs
TLSH
T15C03C030F8659D6399FBD390364A73D7EEF415B3C9C10D648AE99B0C06873AD134791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69ab42e2-e2f2-4e26-93e5-7439bad05b3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69ab42e2-e2f2-4e26-93e5-7439bad05b3c.tmp
Size 34KB
SHA256 0365f2f257e6eed5d73882f9050c96e47b176bab6328d4882939d27fcd6f019b
MD5 f9fd8e435475ec4d7dcdfce03cdd9ee2
SHA1 3e1220f9bba9063cbffb464e4f35ab5cfedeff82
SHA512 e3a0810e0851b726a39ef365a9da0f5d8fecd6c18cf2f8bb4796b2869f743d7b5a05c43c497ff6cdcb0adacbd3a983751ddfd8abaae6eea0235666828dc5b91e
SSDEEP 384:n8ZcIK38NUUR/9ZdmA54mBm/nfydXX/IubgrgYg57HD8CJGZXhJqlX/XBdm/e5xi:qK3i/0mwKzoE57Y0GZxJsXBdK8ZyykJd
TLSH
T1E6F2C030F861DE739DFAD291B5463693AEF456B3E9C40E48C6E9DB0C014369E170782E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94541239-3630-42f9-b7b8-828f3b46228c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94541239-3630-42f9-b7b8-828f3b46228c.tmp
Size 34KB
SHA256 0f97d7348b467e29e5b66d2013d05fde454f118bc905df38dd71c8ef4c36d831
MD5 01da9a8eeb2dd5c1238d631886ec6629
SHA1 e38bff25226f9ea6d0ef8fc05a2646ac6a7c9c9b
SHA512 1a1a3fb0c36b0984f1143ab111ef9ed0ac03793595eb81feceb61cf047a473e22d81a48a93a168312af8ecf61c542a3c51502a4daed12fda864e3457ca8d7768
SSDEEP 768:XK3n/0wHcKzME57Y0GZxJsXBdK8ZyykJd:XK3/0O770/JsXf7AyQd
TLSH
T14CF2BF30F861DE739DFAD291B5463693AEF416B3E9C40E48CAE9DB0C014369E174782E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9700858d-1faf-4d66-8f9b-fbb3db40ac9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9700858d-1faf-4d66-8f9b-fbb3db40ac9c.tmp
Size 37KB
SHA256 237539af336c61716d0cd0c742ede62fe0a0faa497b1fed2b92874b79a9f3dab
MD5 45943afb43ade65ee0456ed1d5be34c8
SHA1 bbddeea1acb94567dc1ecb3c9c63a9eecf8d0c7f
SHA512 4f297587027c6e4ce934abe54651ce179943c5353db6b9f843e91a11373ce5f3c3743a8d9ba2140d04e3cf35d4a41f12cf55cf918284e752c6009c3b4652d7ce
SSDEEP 768:A/UxvxjgC+I397KoE57Y0GZxJsXBdK8lRSHUPpMs:tZj3+I3u70/JsXf7/Sfs
TLSH
T13203B034F8519D739DFBE390360A7797EEF446B3C5C549A48AED9B0D028B26D030395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

105496c5-7185-4bdd-b329-d139cd8781c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\105496c5-7185-4bdd-b329-d139cd8781c5.tmp
Size 11KB
SHA256 08d76d2824a2810469edd1acc63e6c89655296db73f2cbaa15ca76a081f09d95
MD5 a61197f3bf8b6527e7c9ba0377f3ee7c
SHA1 566d5a2f5ac13150b5a11fcfc93b4a8dc5302261
SHA512 46d15f96a0005bd462580fbd8981c9690181b94fa38992077338867dc02d611207aca6ffb5071a8df88258f1753becf995dab09ffa527884b3afa1655434ffe9
SSDEEP 192:sxRtRGCh/fPsa1CzZnkszoA8pi/nb6+WNIYU21fCR4GzIgDnVu7J:sxRtzh/fPsaA9nkdi/gIjhuN
TLSH
T1ED32A615AE28A93B8CCBD21DFB55BF53D6F91032A0D11E48A6FC8A1C15EB6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15ca9335-e694-48e0-96b3-26c47fa2981d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\15ca9335-e694-48e0-96b3-26c47fa2981d.tmp
Size 11KB
SHA256 fd861a894e8f66b1500e9844679f1f32351ec2028c0ff5ba7fdcc2fa73b307f9
MD5 d0f9d06e8554bafee9f84529a277a967
SHA1 715df892c967e8f874f99d43f29ddeebdf55648d
SHA512 9cf1b6991a9ca4fa79d09b0eaeddb89f41588aa27881b2e845176373383a3d67cec7dd394844e7016576581932897bd562b6bc006952c677049aaba2fdcc09e5
SSDEEP 192:sxRqRGCh/fPseCzZnkszoA8pi/nj6+WNIYU21fCR4GzIgVVu7J:sxRqzh/fPsd9nkdi/YIjbuN
TLSH
T18332A715AE28A93B8CDBD219FB55BF53D6F91032A0D11E48E6FC8A1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c8b77fc-9f33-4a9f-ba28-16c2df740197.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c8b77fc-9f33-4a9f-ba28-16c2df740197.tmp
Size 12KB
SHA256 73817eef9040d2dde4b3fcf5979fb510d2e14acb412a9c658ba1aef0ff334533
MD5 0e729d3358d35c902edcbaba2235cd52
SHA1 07db395de2ca32c56fb1206d76c62a82a9c18370
SHA512 9c7f745378c4bb148f3f3e1c6a17a4787f1bcd197e93bee13c5185ba93fcdca8802f3acb91bd1afbd6ef77ed2ad4f663d1338f843a6685dba5aef776118297b8
SSDEEP 192:sxRtRGCh/fPsaFlCzZndszoA8pw/nj6+WNv43ZYU2XuSR4GzIgDlVu7J:sxRtzh/fPsaC9nddw/YoZQ3uN
TLSH
T1B542C815AD28AA3B8CCBD219FB55BF53D2F91032A0D11E48A6FC8A1C15E76DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 deade7bf2c2bfe08f4b29c25668453326a838c629d1747fea8a3e517ce532e28
MD5 26788f22bfeaf5f8c934544ed5aa0446
SHA1 a56316cb7b997f7a25f20d84a22886ba2cf248ff
SHA512 d0c77ec418300023c0a5b05be316ad1b4710b4839e6b9d9ed79b9494bd2482156466c08995e9d5bb9774177e2854697f1e89ba39a13d822a1d367b5a9580d981
TLSH
T1FF61834C6B64D153F7B8497492D0CFCBB6324583748B2E510D94D5FE68A2B391F4D49C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 36e23f0de4e9f78f0b1d7e58569210d87bc807aba236183e08eeb0fae9c9e9c5
MD5 37c41d634b089be3a5417982c2087570
SHA1 4b80060fae8d533f656eab1a69624af503b83a1a
SHA512 4897f944e5c37bf46b5d1269c5cc278a9488c6a84c3154a31a7604cee392d9d05d52ce311737a8f3a26ba93687fa60ba4c4020baafc90e5084396da84ce618ea
TLSH
T10761930C6B60D153F7B8497092E0CFCBB6324583748B2E110D84C5FE68A27390F8C49C
MD5 SHA1 SHA512 TLSH

Submit Download

9a5fbbac-d5f4-4da6-91b9-4a62b063e9fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9a5fbbac-d5f4-4da6-91b9-4a62b063e9fa.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2f8c9cc9-8ec3-4226-bcdf-e3433f419fd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2f8c9cc9-8ec3-4226-bcdf-e3433f419fd2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

63c3267e-0953-45eb-b3e1-47ade5e7a6dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\63c3267e-0953-45eb-b3e1-47ade5e7a6dd.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

68e158af-6dd8-445a-b5ec-4d0074dde258.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\68e158af-6dd8-445a-b5ec-4d0074dde258.tmp
Size 3KB
SHA256 b295a42992ed67020df5e81b775a5c66090fa3553926cea13b1c8cbd711ba48a
MD5 5e4bb64fe4905b128a63b9e669dee2cd
SHA1 7f204a174478597b2c82b494f133f1106c7e6226
SHA512 1983396d20283ea8345bf84d52224fb33f8fd510e7b25abdd471a3541702d52b4376eb2b417f523515912b283508f881d012dab4015d95f1dfbeca8ffb80ec80
TLSH
T10A61C1F7C7E8866DC90196F0AA146E1BCF5C0918432C3D5AC4E4AF1B93E2471E245A9E
MD5 SHA1 SHA512 TLSH

Submit Download

c110b685-5f7b-4e32-990d-78397c05bc65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c110b685-5f7b-4e32-990d-78397c05bc65.tmp
Size 29KB
SHA256 ec68ce01bf81123459a00776d0054fc9ec5e0b4ea44cac0efcbb77e683248f58
MD5 65044712fe803c809d2b568c0e3bd1ad
SHA1 f7ca2e81b5c9e7d3ba124cf521f1e249bb393136
SHA512 9e30353da0742634a3f4339040442682d41dbaaf6ece8a829d7617fb0a81c305a621a75e83daabea3e62d2cd68e6868c55563524e29d5dc225d7e842eb68d5dd
SSDEEP 768:6Jaj9+7pLuLb/KWgm0fsO7n8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdSgomBUrortk:6Jaj9+Eb/KWgm0fbbu1jaKSghB/S
TLSH
T153D2DA7B740CCB7F4F900ADD9C19BE9B6DA802CB9698CD8047FA941D02C67EB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f53dc02c-a383-4319-a8af-d20b6abaad06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f53dc02c-a383-4319-a8af-d20b6abaad06.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9d89cb8-4ca1-4b1f-9fd6-8bd5424d0d30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9d89cb8-4ca1-4b1f-9fd6-8bd5424d0d30.tmp
Size 12KB
SHA256 bbd903af416d984159269c3a59811ffdf8d6c362a19592ee37c87aa880b2c137
MD5 bfb1585d8d754359885e316c8cca10cb
SHA1 26b692e575211074f8b6804ee62acb6b2cea65b7
SHA512 009d55b73db7d0fdd5cf42b65f40b0d31ef52f6d7a0601d63631834d74aba15138c8f4060c0dd1ae482f04f48a4529dfdd03890d069b520cd75d5992d87b9f15
SSDEEP 192:sxRtRGCh/fPsaFlCzZncszoA8pi/nz6+WNv16/YU2WuSR4GzIgDlVu7J:sxRtzh/fPsaC9ncdi/II/h3uN
TLSH
T1DF42C915AD28A93B8CDBD21DFB55BF53E2F91132A0D11E48A6FC8A1C15E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66053458-4181-4a61-8ea2-d7ea5069fae3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\66053458-4181-4a61-8ea2-d7ea5069fae3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

aad3c4ad-dc76-4b2e-965d-af3ae515af3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aad3c4ad-dc76-4b2e-965d-af3ae515af3f.tmp
Size 37KB
SHA256 5c717c1deb9ba4acecf4c94047a7503c10d8210ecfbfbcc3f7eddd4753334e8b
MD5 17bec78b0c266034a4e8d29786b87035
SHA1 b2423d264e6fb04aa4944b2cd5b25b973ad0e712
SHA512 7d9b253ca7c34c8a665ad405120357ab2ed4025c1a01190c57a2e38c863e8fc5aa3601f99a8c502eac86fe7905fdee3cff7a8c9e5e0cd9ad8086f500eb3bbc40
SSDEEP 768:lFQU37wgW/0vHIJE57Y0GZxJsXBdK8ZyykJd:EU3M0Ao70/JsXf7AyQd
TLSH
T1BD037C31E8A0DB77ADFA87D1B6467687AEE412B3C9C84D98DAD99E4C00831DE1707C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10f5e907-15ff-410c-ace8-50082942c426.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\10f5e907-15ff-410c-ace8-50082942c426.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

792276ca-b0dc-4f5d-be4d-5ce04457d991.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\792276ca-b0dc-4f5d-be4d-5ce04457d991.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

3174c43a-19ed-4e53-b8f9-c452b8d19487.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3174c43a-19ed-4e53-b8f9-c452b8d19487.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1739f975-a7c6-424d-ba26-860194a60cab.tmp

Path C:\Users\Admin\AppData\Local\Temp\1739f975-a7c6-424d-ba26-860194a60cab.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d1e2ac83-c709-4d8d-bdbd-cf6ad56036d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\d1e2ac83-c709-4d8d-bdbd-cf6ad56036d7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-D975N.tmp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.tmp
Size 1.2MB
SHA256 a7980ea6e8a1c3ea2affb2b5bc12d1d553e6f08bd24995e1f61dd80c56eb9506
MD5 5576331531ea628d83b90682bce03f18
SHA1 a98be9b662b84319f35fdb81f1596086091d582d
SHA512 3d7c1f4599ecab98ee24756f199e367d83e6c2a1d7dfd6438331b387ae81ca4ec26025230e66e4800e2813493dc000ac9738292165c5018a9f5b855ada560852
SSDEEP 24576:ntdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt51Tx9vM:tqTytRFk6ek17+
TLSH
T1DC452922A3D24437D5731F759C6BC2946C367E202EA4E54A7EF89E0C0E79B81BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-SVT7R.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
TLSH
T11051CE835239A462C41A37B426E7E509B35B467643CE4FE33590230EF8876F80C35D90
MD5 SHA1 SHA512 TLSH

Submit Download

ydwqk.dll

Path C:\Users\Admin\AppData\Local\Temp\is-SVT7R.tmp\ydwqk.dll
Size 1.6MB
SHA256 2c4658c487114e36e2b9e75bf1c97dc034ce080dc6bc5f3a45e83aeb573dd631
MD5 fc4b0ea55c7632a0cd000bef5e658243
SHA1 71c8eaa31613a14faaa4634f0d402cb3b8285456
SHA512 54744d9031736e57e03c2567c59586d8c0bbbf0743022ed1c8719a12c7347f4206341314b31a7656f42d1a201ddb4ef75d39be2681aed2e48c627e742068e149
SSDEEP 24576:jrqDgaHzs9aPn2OMIcp6d0Wm0dbgbT5osoP3:81YwP2LzoCSFso
TLSH
T12075D023B4828432C172133019BB7F7516FF9A2907B149CB9398AA74AF345D36B36767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1068_89725816\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CallBanner.png

Path C:\Users\Admin\AppData\Roaming\One System Care\CallBanner.png
Size 44KB
SHA256 71f6a0172f54cda549320a1aa4172faef8c1c9adc80d968a45eaf42f3b634ba3
MD5 aba412798c7543dbf691d0f10d079a54
SHA1 e92257950b1db473e3dc63477da563d40f1bd4da
SHA512 89fac039a205465411e6a3603331c5ae5d044e7bb729dd04294f17694644f9d6c0c71ab194586125748c956e086df584cf64932b3a322af69c8cf7b7e0782c55
SSDEEP 768:Lce52r5Qe2I4UqTCr5F2nvH/eIWL2MwMIHBvrADJM3aWt502fcRWJ3CcZ3XWqxmw:552r5QeHVXF2HeIwF+vrADJM3aCVfcRi
TLSH
T15423A27B96212C3B0AA341F870B5BB4DF6E6C101EB43C25489FA5BD7A3C5E629D7241C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.json

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\English.json
Size 40KB
SHA256 1cba9726d30faaf69c4a79b0323d422513fb9b107e288d57d23e1562b62ce41b
MD5 73628eeb89155df245626ed656035b5a
SHA1 12f23d4312c2f1ac661bd6d7f7ed55683b516d35
SHA512 773df6696ff5c7975b2731c4139ed89cd67ca5a93ba1b2a0d9cb435e6111891c7a3cb84ae7fb9c1e9ae51bfff207c070d82034290cdd822ed22a6dc56c754278
SSDEEP 768:pInAwZtNOfOyl3iPlqP04eUH3d7GNafVXLZZheRv5B:pInANnkQJtkafV7oh5B
TLSH
T1F103E08BB697C2DD0E80F247812E760A01FF2EC408A9615A78E985B12FC5479B5BE40E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Parameters.json

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\Parameters.json
Size 910B
SHA256 e1cadab805a5b25c6a6b3d332278412034290c9a8991e089c25c08243ef73915
MD5 edf16921760f499b89226e8a7f9e42dc
SHA1 34adaff0aa75e4f23c44da8956b8955e7803b7a9
SHA512 4fa3c14fadd3110ce28f10961e3df39701878382df1efef5e2b4c637c57b762fb36882a29c134988939e9e4fb8507c1e3ca2bbe9e8797d2735355bbd3d3a245f
TLSH
T1E511EBDFA7BD30005D1C0A133F9355040905ED11C7CB0F44B1A02CF00776652F597129
MD5 SHA1 SHA512 TLSH

Submit Download

is-H679P.tmp

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\is-H679P.tmp
Size 39KB
SHA256 3d79643b0364e95a5d2c23414f22d9621f7d4d9abbd0b674f5328d5dd9be5d69
MD5 301aae525b1b00130e5ff774f20f4efd
SHA1 b89b6c9c88f740fdc5c6bcd4c17cbbc78fe8338a
SHA512 158af32bc0844c088f9131ca3185e2a51ffab594108181347240e1d85d60a53f8928cc036b16f16ddda725c4b7aec5a909bfca892908d9b94b2d9e1ef995db40
SSDEEP 768:pInAwZtNOhAOyl3iPlq85M/JsihcTgVSHb5Zp23m/gccubvf6OQ1:pInAfAnkQkU3Vy9e3Ogcccq
TLSH
T13503F11B3C53B8C54A875D6B820F6E5A80329DE50434906A273D50B97FCAD3A88BF71E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpLang.json

Path C:\Users\Admin\AppData\Roaming\One System Care\Languages\tmpLang.json
Size 26KB
SHA256 3d997792150da91ac71f443d3f384eead455ab017d7622f0b18e3a6d344fe75a
MD5 76ca06abcd5b5c252bd10fe465993e83
SHA1 249126aac09f7262ac1adf460742ee8cae101dea
SHA512 be5ea6b7fe2d7e20d6c070971d71748177efa531fc4c6de8fc36e8d61b2fddc203eeeeda646efa5991072c8f97d17774bf0997c1ed6922e6533c9b573bf58ab0
SSDEEP 384:nod5cvfuDZEjHpn6rAlFWbFOEGZD9qCMFs/I68wETQOZ8pi6wLHRM3P5PfAk6:od5cvfY6tn6rAKSwsw68w0Z8sG3P5Ph6
TLSH
T191C2F02B9B240C9F45F8B19CA5026B762CAF306CD3660B0D5A8DB05EEF1E9951F3116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20261014i-0533.log

Path C:\Users\Admin\AppData\Roaming\OneSystemCare\log\20261014i-0533.log
Size 5B
SHA256 f01a374e9c81e3db89b3a42940c4d6a5447684986a1296e42bf13f196eed6295
MD5 3bab25a3e651a9e4a00473d2257b99f9
SHA1 1419458f2696be8daeade77ddad380cd0c871fdb
SHA512 ae8dc1129b7a81ba70c9512a94a3e9ccd8c159f1817e309198c2babaf5bcb3f7e97f43b54ea4937cbea468bb5a62328fc0c01982aa1b883d8fd6d2e2c58090ff
MD5 SHA1 SHA512

Submit Download

Launch One System Care.lnk

Path C:\Users\Admin\Desktop\Launch One System Care.lnk
Size 1KB
SHA256 5a076911c112840ad5a2e1af94a17f5ee83017a116e3044f1cb9679597e890cf
MD5 188d334065277f38f295bee3ed07e1b7
SHA1 8ec675b45aaaadab776ca56b5e8bddc98390d8b0
SHA512 56cd5e226e1da3423588617b5df0e66634dc7833a23c8b4d44aa693209ab550d492b4d35ee3e91c809498671296aaf137de012784af6bc91aa2110b9aac14192
TLSH
T17E11EF211ECD5B2BD373833356714AA1DA63F4257B894E0A408B11C40C72B036DAAF1E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1068_1348558897\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1068_331979017\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1236-142-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1236-49-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1236-67-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2656-153-0x0000000017EC0000-0x000000001821B000-memory.dmp

Download

memory/2656-157-0x0000000017EC0000-0x000000001821B000-memory.dmp

Download

memory/2656-156-0x0000000017EC0000-0x000000001821B000-memory.dmp

Download

memory/2656-145-0x0000000017EC0000-0x000000001821B000-memory.dmp

Download

memory/2656-146-0x0000000017EC0000-0x000000001821B000-memory.dmp

Download

memory/2656-155-0x0000000017EC0000-0x000000001821B000-memory.dmp

Download

memory/2656-148-0x0000000017EC0000-0x000000001821B000-memory.dmp

Download

memory/2656-154-0x0000000017EC0000-0x000000001821B000-memory.dmp

Download

memory/2656-152-0x0000000017EC0000-0x000000001821B000-memory.dmp

Download

memory/3056-64-0x0000000073950000-0x0000000073AF3000-memory.dmp

Download

memory/3056-68-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/3056-63-0x0000000073950000-0x0000000073AF3000-memory.dmp

Download

memory/3056-141-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/3056-65-0x0000000073950000-0x0000000073AF3000-memory.dmp

Download

memory/3308-42-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/3308-25-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-6-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/3308-18-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-47-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/3308-48-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-17-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-45-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-44-0x0000000073EB2000-0x0000000073EB4000-memory.dmp

Download

memory/3308-43-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/3308-16-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-15-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-38-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-37-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-36-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-28-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-29-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-30-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-32-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-34-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-35-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-33-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-31-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-19-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-20-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-21-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-23-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-24-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-14-0x0000000073EB2000-0x0000000073EB4000-memory.dmp

Download

memory/3308-26-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-27-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/3308-22-0x0000000073EB0000-0x0000000074053000-memory.dmp

Download

memory/5112-41-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5112-1-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5112-62-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5360-151-0x000000001CAC0000-0x000000001CBDE000-memory.dmp

Download

memory/5360-147-0x000000001CAC0000-0x000000001CBDE000-memory.dmp

Download

memory/5360-149-0x000000001CAC0000-0x000000001CBDE000-memory.dmp

Download