onesafe_pc_cleaner.exe

OneSafe PC Cleaner

AVANQUEST SOFTWARE

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from webtools.avanquest.com and multiple other hosts.
Publisher:
AVANQUEST SOFTWARE  (signed and verified)

Product:
OneSafe PC Cleaner

Version:
4.1

MD5:
ff78b2992aeb893c51cae5a753397d56

SHA-1:
4262e59de39a8c5b138ef11e19d5ef678c134dc7

SHA-256:
6f4d43c4324b9f9d66538f5f05a9b88ff2fd591b5901d9c8c028686af8fd8162

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/5/2024 9:31:55 AM UTC  (today)

File size:
1.7 MB (1,804,168 bytes)

Product version:
4.1

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\onesafe_pc_cleaner.exe

Digital Signature
Authority:
Symantec Corporation

Valid from:
2/13/2015 1:00:00 AM

Valid to:
3/7/2017 12:59:59 AM

Subject:
CN=AVANQUEST SOFTWARE, O=AVANQUEST SOFTWARE, L=Paris, S=Ile de France, C=FR

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
6720EB953FB3B3DD5351FF987A4D7CD7

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:d2CFp7ipMRYWvd4Bf0HX77pAVL0PpfjL7Pwt4:IoWtWvRHXCl0PVH9

Entry address:
0x9B24

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, A2, 95, FF, FF, E8, A9, A7, FF, FF, E8, D4, C9, FF, FF, E8, 1B, CA, FF, FF, E8, 0E, F3, FF, FF, E8, 75, F4, FF, FF, 33, C0, 55, 68, DB, A1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, A4, A1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 9B, FE, FF, FF, E8, 02, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 04, D0, FF, FF, 8B, 55, F0, B8, E4, CD, 40, 00, E8, 53, 96, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E4, CD, 40, 00, B2, 01, B8...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file onesafe_pc_cleaner.exe has been seen being distributed by the following 50 URLs.

http://webtools.avanquest.com/download.cfm?filter=176681&tracking=AQ_ES_PP_MTM_OSPCC&keyword=ES_LP1&campaignID=MTM-3&mrmid=&mtmid=&clickid=20ZEQ14oSuWvvVWm3tHplT1zYVOS000.&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?tracking=AQ_ES_PP_AFD_OSPCC&keyword=ES_LP1&campaignID=AFD2&mrmid=&mtmid=&clickid=AGyGZ5T50ggADTrAE9mKoquJTXhBT570oZsUUoui1qMFAAAAAAACAAE&filter=42080&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?tracking=3951758&keyword=904088&campaignID=VEL-CVM&mrmid=&mtmid=&clickid=v1_7921958_190378_3o1_68925A1F8C4182742517417625_-1_3951758_riso_533_68925A1F8C41827411578646214_m_19_-2600643692305198677_794448___2_68_44tm_19&filter=794448&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?tracking=4101547&keyword=1075047&campaignID=VEL-CVM&mrmid=&mtmid=&clickid=v1_7944807_190438_3o1_70A9A486379242721720591429_-1_4101547_10pr7_533_70A9A48637924271980408706_m_19_8619969306289401002_746178___2_1b_3qka_19&filter=746178&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?filter=32841&tracking=AQ_ES_PP_AFD_OSPCC&keyword=ES_LP1&campaignID=AFD2&mrmid=&mtmid=&clickid=AESjddzq0ggADToAwCWqmK6jxysIQ6Al6QDj3pq9wJE6CAAAAAA&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?filter=795558&tracking=4101537&keyword=1075047&campaignID=VEL-CVM&mrmid=&mtmid=&clickid=v1_7944807_191158_3o1_25927572CC102682482883953_-1_4101537_10pr7_513_25927572CC10268231645184235_m_19_-378961839181935177_795558___2_48_4548_19&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?filter=176681&tracking=AQ_ES_PP_MTM_OSPCC&keyword=ES_LP1&campaignID=MTM-3&mrmid=&mtmid=&clickid=20ZEQ10dQ2DUAqds3uK7cf1zZ.hU000.&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?filter=176681&tracking=AQ_ES_PP_MTM_OSPCC&keyword=ES_LP1&campaignID=MTM-3&mrmid=&mtmid=&clickid=20ZEQ131eZzfFpCt3uLBph1zXNku000.&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?filter=32840&tracking=AQ_ES_PP_AFD_OSPCC&keyword=ES_LP1&campaignID=AFD2&mrmid=&mtmid=&clickid=AHB_Rnr70ggADToAY0dZCyBs8PGnT6HKNGvtyDS3CyiAAAAAAAAJAAE&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?filter=176681&tracking=AQ_ES_PP_MTM_OSPCC&keyword=ES_LP1&campaignID=MTM-3&mrmid=&mtmid=&clickid=20ZEQ10X8xBtjamh3ursi41zXmHG000.&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?tracking=AQ_ES_PP_MTM_OSPCC&keyword=ES_LP1&campaignID=MTM-3&mrmid=&mtmid=&clickid=20ZEQ13HXMuZF45.3tV6Ty1A4vjy000.&filter=176681&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?tracking=AQ_ES_PP_MTM_OSPCC&keyword=ES_LP1&campaignID=MTM-3&mrmid=&mtmid=&clickid=20YCSR1TgW3JNzPz1K2tSy1A3Njs000.&filter=176681&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

http://webtools.avanquest.com/download.cfm?tracking=AQ_ES_PP_MTM_OSPCC&keyword=ES_LP1&campaignID=MTM-3&mrmid=&mtmid=&clickid=20ZEQ1557uVO5lUe3vmJeo1zWZuk000.&filter=176681&go=http://cdn.Onesafe-software.com/OneSafe_PC_Cleaner/.../OneSafe_PC_Cleaner.exe

Latest 30 of 84 download URLs

Scan onesafe_pc_cleaner.exe - Powered by Reason Core Security