URL:

http://resources.onestart.ai/onestart_installer_130.0.6723.132.exe

Full analysis: https://app.any.run/tasks/05c735c3-8773-4358-9fe7-ddaf887081a1
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: February 12, 2025, 17:07:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
stealer
Indicators:
MD5:

15B6D2043C0528A168B7CB042ACC9BAF

SHA1:

B245F2B23687A6B3E3711498EB7B64DB57F17F37

SHA256:

63B1357AE8FFDACB47C1FCDE3B5C8C5AA813653907A8C15CCDAF6BE4D4CF4FB6

SSDEEP:

3:N1KMW8i9ltAgkOXeXIWvAC:CMWh7ygkOXuIW1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ADWARE has been detected (SURICATA)

      • onestart_installer_130.0.6723.132.exe (PID: 8052)

    • Connects to the CnC server

      • onestart_installer_130.0.6723.132.exe (PID: 8052)

    • Actions looks like stealing of personal data

      • notification_helper.exe (PID: 7148)

    • Changes the autorun value in the registry

      • onestart.exe (PID: 7588)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • explorer.exe (PID: 4488)

    • Executable content was dropped or overwritten

      • onestart_installer_130.0.6723.132.exe (PID: 8052)
      • setup.exe (PID: 556)

    • Application launched itself

      • setup.exe (PID: 556)
      • setup.exe (PID: 1296)
      • onestart.exe (PID: 7588)

    • Starts CMD.EXE for commands execution

      • onestart.exe (PID: 7588)

    • The executable file from the user directory is run by the CMD process

      • onestart.exe (PID: 1344)

    • Access to an unwanted program domain was detected

      • onestart_installer_130.0.6723.132.exe (PID: 8052)

    • The process checks if it is being run in the virtual environment

      • onestart.exe (PID: 7588)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 1224)

    • Reads the computer name

      • identity_helper.exe (PID: 7860)
      • onestart_installer_130.0.6723.132.exe (PID: 8052)
      • setup.exe (PID: 556)
      • setup.exe (PID: 1296)
      • notification_helper.exe (PID: 7148)
      • onestart.exe (PID: 7588)
      • onestart.exe (PID: 3260)
      • onestart.exe (PID: 3984)
      • onestart.exe (PID: 1344)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 1224)

    • Checks supported languages

      • identity_helper.exe (PID: 7860)
      • setup.exe (PID: 7208)
      • onestart_installer_130.0.6723.132.exe (PID: 8052)
      • setup.exe (PID: 556)
      • notification_helper.exe (PID: 7148)
      • setup.exe (PID: 1296)
      • setup.exe (PID: 4976)
      • onestart.exe (PID: 7588)
      • onestart.exe (PID: 7212)
      • onestart.exe (PID: 3260)
      • onestart.exe (PID: 5576)
      • onestart.exe (PID: 1344)
      • onestart.exe (PID: 2396)
      • onestart.exe (PID: 6348)
      • onestart.exe (PID: 6616)
      • onestart.exe (PID: 6268)
      • onestart.exe (PID: 7376)
      • onestart.exe (PID: 5036)
      • onestart.exe (PID: 5200)
      • onestart.exe (PID: 5464)

    • Reads Environment values

      • identity_helper.exe (PID: 7860)

    • Checks proxy server information

      • explorer.exe (PID: 4488)
      • onestart.exe (PID: 7588)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 4488)
      • onestart_installer_130.0.6723.132.exe (PID: 8052)
      • setup.exe (PID: 556)
      • notification_helper.exe (PID: 7148)
      • setup.exe (PID: 1296)
      • onestart.exe (PID: 7588)
      • onestart.exe (PID: 3984)

    • The sample compiled with english language support

      • onestart_installer_130.0.6723.132.exe (PID: 8052)
      • setup.exe (PID: 556)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4488)

    • Reads the software policy settings

      • explorer.exe (PID: 4488)

    • Process checks computer location settings

      • onestart.exe (PID: 7588)
      • onestart.exe (PID: 6616)

    • Create files in a temporary directory

      • onestart.exe (PID: 7588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
52
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs explorer.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs #ADWARE onestart_installer_130.0.6723.132.exe setup.exe setup.exe no specs notification_helper.exe chrome.exe no specs setup.exe no specs setup.exe no specs onestart.exe onestart.exe no specs onestart.exe no specs onestart.exe onestart.exe no specs cmd.exe no specs onestart.exe onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs onestart.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
444"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7552 --field-trial-handle=2252,i,15836594579234116962,17971941571272619480,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
556"C:\Users\admin\Downloads\CR_25A5C.tmp\setup.exe" --install-archive="C:\Users\admin\Downloads\CR_25A5C.tmp\ONESTART.PACKED.7Z" C:\Users\admin\Downloads\CR_25A5C.tmp\setup.exe
onestart_installer_130.0.6723.132.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
MEDIUM
Description:
OneStart Installer
Exit code:
0
Version:
130.0.6723.132
Modules
Images
c:\users\admin\downloads\cr_25a5c.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
736"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=6188,i,15838291456769307449,14630151299797664118,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Exit code:
0
Version:
130.0.6723.132
1224"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://resources.onestart.ai/onestart_installer_130.0.6723.132.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\windows\system32\capauthz.dll
c:\windows\system32\windows.staterepositorycore.dll
c:\windows\system32\netprofm.dll
c:\windows\system32\wlanapi.dll
c:\windows\system32\windows.applicationmodel.dll
c:\windows\system32\appxdeploymentclient.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\sxs.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\srvcli.dll
1296"C:\Users\admin\Downloads\CR_25A5C.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0C:\Users\admin\Downloads\CR_25A5C.tmp\setup.exe—setup.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
MEDIUM
Description:
OneStart Installer
Exit code:
73
Version:
130.0.6723.132
Modules
Images
c:\users\admin\downloads\cr_25a5c.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1344"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --updateC:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe
cmd.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
MEDIUM
Description:
OneStart
Exit code:
0
Version:
130.0.6723.132
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\130.0.6723.132\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
2396"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4140,i,15838291456769307449,14630151299797664118,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Version:
130.0.6723.132
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\130.0.6723.132\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
2496"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6512,i,15838291456769307449,14630151299797664118,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:2C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Version:
130.0.6723.132
3260"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1972,i,15838291456769307449,14630151299797664118,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Version:
130.0.6723.132
Modules
Images
c:\users\admin\appdata\local\onestart.ai\onestart\application\onestart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\onestart.ai\onestart\application\130.0.6723.132\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
3364"C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5860,i,15838291456769307449,14630151299797664118,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8C:\Users\admin\AppData\Local\OneStart.ai\OneStart\Application\onestart.exe—onestart.exe
User:
admin
Company:
OneStart.ai
Integrity Level:
LOW
Description:
OneStart
Exit code:
0
Version:
130.0.6723.132
Total events
28 917
Read events
28 742
Write events
174
Delete events
1

Modification events

(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F00620000000000000000000000010000001000000000000000
(PID) Process:(1224) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\Commands\on-logon-autolaunch
Operation:writeName:Enabled
Value:
0
(PID) Process:(1224) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MicrosoftEdgeAutoLaunch_29EBC4579851B72EE312C449CF839B1A
Value:
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
(PID) Process:(1224) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328528
Operation:writeName:WindowTabManagerFileMappingId
Value:
{4F74346B-2F6F-40EF-BCAF-C7B580723266}
(PID) Process:(1224) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\Profiles
Operation:writeName:EnhancedLinkOpeningDefault
Value:
Default
(PID) Process:(5320) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000858C19B4707DDB01
(PID) Process:(4488) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(4488) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
040000000E0000000300000000000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar
Operation:writeName:Locked
Value:
1
(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon
Operation:writeName:MinimizedStateTabletModeOff
Value:
0
Executable files
18
Suspicious files
369
Text files
91
Unknown types
3

Dropped files

PID
Process
Filename
Type
1224msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF135612.TMP —
MD5:—
SHA256:—
1224msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF135612.TMP —
MD5:—
SHA256:—
1224msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
1224msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF135612.TMP —
MD5:—
SHA256:—
1224msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
1224msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF135612.TMP —
MD5:—
SHA256:—
1224msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
1224msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
1224msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF135632.TMP —
MD5:—
SHA256:—
1224msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
68
DNS requests
79
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
ID
binary
973 b
whitelisted
4488
explorer.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDHIJtrz9Ya%2BlpHbb8A%3D%3D
unknown
binary
1.66 Kb
whitelisted
5064
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
DE
binary
313 b
whitelisted
624
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
NL
binary
419 b
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
—
—
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
ID
binary
973 b
whitelisted
6440
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
DE
binary
471 b
whitelisted
3984
onestart.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagnajdejgnnjijobebaeigek_4.10.2830.0_win64_dldxogwi36sxwpr57ta4lg57z4.crx3
US
binary
13.8 Mb
whitelisted
4488
explorer.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
binary
1.67 Kb
whitelisted
1344
onestart.exe
POST
200
108.138.26.17:80
http://log.onestart.ai/
US
binary
19 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.209.214.100:80
www.microsoft.com
PT. Telekomunikasi Selular
ID
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
2.19.122.4:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
—
—
143.204.98.82:80
resources.onestart.ai
AMAZON-02
US
suspicious
—
—
13.107.253.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 23.209.214.100
  • 95.101.149.131
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 2.19.122.4
  • 2.19.122.65
  • 2.19.122.66
  • 2.19.122.15
  • 2.19.122.14
  • 2.19.122.11
  • 2.19.122.8
  • 2.19.122.9
  • 2.19.122.67
  • 2.23.227.208
  • 2.23.227.215
  • 2.19.122.39
  • 2.19.122.28
  • 2.19.122.34
  • 2.19.122.36
  • 2.19.122.32
  • 2.19.122.29
  • 2.19.122.38
  • 2.19.122.40
  • 2.19.122.37
  • 95.100.248.212
  • 95.100.248.219
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
resources.onestart.ai
  • 143.204.98.82
  • 143.204.98.32
  • 143.204.98.59
  • 143.204.98.8
unknown
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 2.22.242.11
  • 2.22.242.105
whitelisted
update.googleapis.com
  • 142.250.184.195
whitelisted

Threats

PID
Process
Class
Message
8052
onestart_installer_130.0.6723.132.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Onestart AI Program Version Checkin (POST)
8052
onestart_installer_130.0.6723.132.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Onestart AI Program Version Checkin (POST)
3984
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
3984
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
3984
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
3984
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
3984
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
3984
onestart.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://resources.onestart.ai/onestart_installer_130.0.6723.132.exe