PUP.Onestart.ai
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 379 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 6,550 |
| First Seen: | February 18, 2025 |
| Last Seen: | February 8, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
SpyHunter Detects & Remove PUP.Onestart.ai
Registry Details
PUP.Onestart.ai may create the following registry entry or registry entries:
File name without path
OneStart.lnk
Regexp file mask
%windir%\system32\tasks\onestartupdater
%windir%\system32\tasks\onestartuser
Software\Classes\OneStart.aiUpdate.Update3WebUser
Software\Clients\StartMenuInternet\OneStart.ELFCRJCXLYA2DS7QOCP5YHK7HM
SOFTWARE\Clients\StartMenuInternet\OneStart.UCUBKJGDULZB5GHKEXRPBT752M
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OneStartUser
Software\Microsoft\Windows\CurrentVersion\App Paths\onestart.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated\OneStart.ELFCRJCXLYA2DS7QOCP5YHK7HM
Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched\OneStart.ELFCRJCXLYA2DS7QOCP5YHK7HM
SOFTWARE\OneStart.ai
Software\RegisteredApplications\OneStart.ELFCRJCXLYA2DS7QOCP5YHK7HM
SOFTWARE\WOW6432Node\Microsoft\Tracing\OneStart_RASAPI32
SOFTWARE\WOW6432Node\Microsoft\Tracing\OneStart_RASMANCS
onestart
OneStart.ai OneStart
Directories
PUP.Onestart.ai may create the following directory or directories:
| %LOCALAPPDATA%\OneStart.ai |
| %userprofile%\onestart.ai |
| %windir%\system32\tasks\OneStartUser |
Analysis Report
General information
| Family Name: | PUP.Onestart.ai |
|---|---|
| Signature status: | Root Not Trusted |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
390e9809611e640ff8f15fc5d4fb711d
SHA1:
7fe6d020be387a55282ff148e93e0b52bc880112
SHA256:
1C90519A6D75BE37EF3ED591BFEA92EFFA0CC0F724993F440977486368EACAF0
File Size:
447.60 KB, 447600 bytes
|
|
MD5:
cc48c78e8f636dab0a80366761b05ef0
SHA1:
9c81e501d879915c7e396e322cf548ac5bf4fd5f
SHA256:
39BA33C1AAA13552EE4D381F32BE79E50D0792E2CDBD7ADC716A8CE124ACE3E4
File Size:
8.03 MB, 8034416 bytes
|
|
MD5:
7c9f2d152612aa4b3302c89aa1aac114
SHA1:
c0faf2ff211c5a927811aad5409eb5602e89d0d4
SHA256:
A837695C510F56FA06FADABDAC301EE93CB0944E80EA680C3F6BC7A6DDEB2680
File Size:
454.26 KB, 454256 bytes
|
|
MD5:
b9bf43a89b95a264ea434137652f0331
SHA1:
de7e25226c3590958825a15ec94835227f4f4b0c
SHA256:
E6E5C6C2B4CB6C7F6FF8CE7D6230D86FB1536C0EA1105388BB968310675C2EE2
File Size:
460.98 KB, 460976 bytes
|
|
MD5:
517ffcd12c0c549185a950da576a2fd6
SHA1:
3d19ed500ef576939372b1a5ff92c64d4f8d9ad8
SHA256:
B22F412F17F25F7B428895AC3F01E2A231E46359F514277233882ECFEC5C2F8E
File Size:
15.98 KB, 15984 bytes
|
Show More
|
MD5:
c998a94dc0bf3ec1254ef27d71dd8a39
SHA1:
dd1a171f4b003d54e57b4b4799c7817d7ea0be79
SHA256:
283D0D337E094A017AD9E1E1CE6D0BC3D469FB81F9BB963D6C6BF435A374C709
File Size:
15.98 KB, 15984 bytes
|
|
MD5:
da5aa1ade4ae53ee0579f9a3cea40a0f
SHA1:
fe0366f858d4e8a42d3c79661527ebaa7a0b6e17
SHA256:
0070DBE2E8D6F47E8BF5B04E6C139793E091F14924965A22DE1AA49722F85801
File Size:
15.98 KB, 15984 bytes
|
|
MD5:
b3c13c13ec5050b1252ce8574742f75d
SHA1:
98b7466a494401cd58640bed9c04a6f72719d1e1
SHA256:
1D1AB8711515FDB7A4F32795EE09D9771013E613EF12EE9F92C937CC06C8049C
File Size:
16.05 KB, 16048 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments | OneStartBrowser |
| Company Name |
|
| Company Short Name | OneStart.ai |
| File Description |
|
| File Version |
|
| Internal Name |
|
| Last Change |
|
| Legal Copyright |
|
| Official Build | 1 |
| Original Filename |
|
| Product Name |
|
| Product Short Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| OneStart Technologies LLC | DigiCert Trusted Root G4 | Root Not Trusted |
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 1 |
| Unknown Blocks: | 0 |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\wow6432node\microsoft\tracing::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey |
Show More
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| User Data Access |
|
| Encryption Used |
|
| Anti Debug |
|
| Network Info Queried |
|
| Other Suspicious |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Syscall Use |
Show More
|
