Overview

overview

7

Static

static

3

2026-08-08...op.exe

windows10-2004-x64

7

2026-08-08...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 17:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_f0107b1cbbc2819868e93c4b9d071783_elex_stop.exe
  • Size 11.0MB
  • Sample260808-vlnx2aam8v
  • SHA256 81e497301cc5d9d22b86bbfdce9875c455a2e7b8198267b0c743343d566f64b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 35 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 37 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_f0107b1cbbc2819868e93c4b9d071783_elex_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_f0107b1cbbc2819868e93c4b9d071783_elex_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\ProgramData\PowerOn\PowerClean\InstallCache\{1C34704A-5718-4AA3-AB50-E3B15BC50734}\PowerClean.msi" TRANSFORMS="C:\ProgramData\PowerOn\PowerClean\InstallCache\{1C34704A-5718-4AA3-AB50-E3B15BC50734}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-08-08_f0107b1cbbc2819868e93c4b9d071783_elex_stop.exe"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Program Files (x86)\PowerOn\PowerClean\PowerClean.exe
        "C:\Program Files (x86)\PowerOn\PowerClean\PowerClean.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2092
        • C:\Program Files (x86)\PowerOn\PowerClean\machineid.exe
          machineid.exe {F80169DC-9F88-4D6A-BE8B-1F6ED07EEE87}
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5820
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5B958B0CEFC8B9B6DA080FC74263A1E3 C
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6108
      • C:\Program Files (x86)\PowerOn\PowerClean\machineid.exe
        machineid.exe {E0724AD2-DDF5-4242-BD61-2926B6C34C4E}
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4172
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2772
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 4BC376E5827A0B7B7CB5C6930CDB9971
        2⤵
        • Loads dropped DLL
        • Badlisted process makes network request
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4976
        • C:\Program Files (x86)\PowerOn\PowerClean\machineid.exe
          machineid.exe {71BC56BC-457D-4C37-B637-C273F5EABD53}
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2856
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 194DF6CA9095F5CCA921611A30A45892
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:5444
      • C:\Program Files (x86)\PowerOn\PowerClean\PowerClean.exe
        "C:\Program Files (x86)\PowerOn\PowerClean\PowerClean.exe" -syncadd
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4220
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2356
    • C:\Program Files (x86)\PowerOn\Tray\PowerOnTray.exe
      "C:\Program Files (x86)\PowerOn\Tray\PowerOnTray.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4908
    • C:\Program Files (x86)\PowerOn\Tray\PowerOnTray.exe
      "C:\Program Files (x86)\PowerOn\Tray\PowerOnTray.exe" /hide
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:808
    • C:\Program Files (x86)\PowerOn\Tray\PowerOnTray.exe
      "C:\Program Files (x86)\PowerOn\Tray\PowerOnTray.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1216
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://login.globalloginsystem.com/Loginsystem/Gotopage/?Login_Product=RCPRO&Login_Lang=EN-US&Login_PartnerID=&Login_UserID=&Login_MachineID=-d41d8c&Goto_Page=Welcome
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5052
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffcf499c188,0x7ffcf499c194,0x7ffcf499c1a0
        2⤵
          PID:3632
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,620524581940635263,986325320379270857,262144 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
          2⤵
            PID:3320
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,5618170718407218306,4316126679909150525,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:11
            2⤵
            • System Time Discovery
            PID:4604
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,6232267081196385667,2260485247829883770,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:13
            2⤵
              PID:2688
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,4868193373105171848,4804618158503637360,2097152 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
              2⤵
                PID:3692
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,2864701463418715815,13932654123630171736,2097152 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
                2⤵
                  PID:4084
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,10675960936784761624,4922708402779069106,2097152 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
                  2⤵
                    PID:5788
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=2288,i,7979419891902259642,3642173398840347656,2097152 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
                    2⤵
                      PID:2856
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,16057124331702390819,11509832601001801664,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
                      2⤵
                        PID:6140
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,6852860483867250399,662703750384930540,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
                        2⤵
                          PID:3924
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,5601424033619121995,9230951015915948657,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
                          2⤵
                            PID:4108
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12937717447566460,1947949869825638170,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
                            2⤵
                              PID:1052
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12937717447566460,1947949869825638170,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
                              2⤵
                                PID:4860
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,12181126666595451655,10005229098729994384,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
                                2⤵
                                  PID:488
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,14824466433988467631,16665649359534999626,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
                                  2⤵
                                    PID:3880
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,16206480429535399002,4280527674870675389,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
                                    2⤵
                                      PID:2684
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,10610341311918766267,18244419132320580034,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
                                      2⤵
                                        PID:4444
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,933641593056881945,6283478495951118768,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
                                        2⤵
                                          PID:2272
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,13516753078612619646,4815319223403096717,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
                                          2⤵
                                            PID:2188
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,17218974887026030281,46142181494257139,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
                                            2⤵
                                              PID:1108
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,14376859792341413034,8053837281751150845,524288 --field-trial-handle=2404,i,4137854171961273259,17737890372763285516,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
                                              2⤵
                                                PID:5296
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                              1⤵
                                                PID:256
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                1⤵
                                                  PID:4172
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                  1⤵
                                                    PID:4472

                                                  Network

                                                        MITRE ATT&CK Enterprise v16

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        e59f6ad.rbs
                                                        • Path C:\Config.Msi\e59f6ad.rbs
                                                        • Size 29KB
                                                        • SHA256 f32e4bee2b20ef95a00bd205e6196975fff32230fdb2accb51a00e90efb48871
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        CommonToolkitSuite.cts
                                                        • Path C:\Program Files (x86)\PowerOn\PowerClean\CommonToolkitSuite.cts
                                                        • Size 335B
                                                        • SHA256 54dc2a7cda356563af6ff3aa1365307aca09ece5c348c5cdf6198b325e952a5a
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        CommonToolkitSuiteLight.DLL
                                                        • Path C:\Program Files (x86)\PowerOn\PowerClean\CommonToolkitSuiteLight.DLL
                                                        • Size 1.3MB
                                                        • SHA256 a5305f92ce8ba6da7a4cf59a544cbe83c37977e5b1d395c62214d62f20c89674
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        MachineIdGateway.dll
                                                        • Path C:\Program Files (x86)\PowerOn\PowerClean\MachineIdGateway.dll
                                                        • Size 279KB
                                                        • SHA256 1ef9fd039051c599e192762bc1466f9b0e07976499015e188abf1e327b59d569
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        PowerClean.exe
                                                        • Path C:\Program Files (x86)\PowerOn\PowerClean\PowerClean.exe
                                                        • Size 11.6MB
                                                        • SHA256 dee7cf61d0d44f8f9a42bd14c29abee1f5a5c0cb8bf168195c4d7e4af516a182
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Sync.exe
                                                        • Path C:\Program Files (x86)\PowerOn\PowerClean\Sync.exe
                                                        • Size 346KB
                                                        • SHA256 046a823734051cbf32472050ab44dd71cd6ddaf3735d0b0bfd6d462154d28cbf
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        machineid.exe
                                                        • Path C:\Program Files (x86)\PowerOn\PowerClean\machineid.exe
                                                        • Size 369KB
                                                        • SHA256 ac0df443bd7e013737c94f492b355d41bff1f31246d964275651960018d5339a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        PowerOnTray.exe
                                                        • Path C:\Program Files (x86)\PowerOn\Tray\PowerOnTray.exe
                                                        • Size 1.6MB
                                                        • SHA256 fea5c2197ac9474ec38b382120019e41b6f17e40d29cc81b44607dc3247b4c36
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        SuiteClient.dll
                                                        • Path C:\Program Files (x86)\PowerOn\Tray\SuiteClient.dll
                                                        • Size 942KB
                                                        • SHA256 996e92a77b1a4bd0b382449779644c1d30497b792166602fd23402e383a76224
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        sfhtml.dll
                                                        • Path C:\Program Files (x86)\PowerOn\Tray\sfhtml.dll
                                                        • Size 2.3MB
                                                        • SHA256 60d89ab85614275e03bf1c52819f4f72a29b9d0e32eab23e1edab4a78177c9b0
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        RCPRO.xml
                                                        • Path C:\ProgramData\PowerOn\Tray\Configurations\RCPRO.xml
                                                        • Size 551B
                                                        • SHA256 daab889efe68a1509a188e8ea20131a58537cf6c8cbcbd69802ca97b97754c03
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        products_list.xml
                                                        • Path C:\ProgramData\PowerOn\Tray\Menu\products_list.xml
                                                        • Size 71B
                                                        • SHA256 668c7345438b8597cc3898e8fec4a900c85c8511d70aae6435e5ec8a9991c79a
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        BookmarkMergedSurfaceOrdering
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                        • Size 6B
                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        the-real-index
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                        • Size 2KB
                                                        • SHA256 cf9679af2c0502e08656ff36ab4d17556205bc8dc65315b4a21948425a23b9dc
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        SiteList-Enterprise.json
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                        • Size 2B
                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Edge Profile.ico
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                        • Size 70KB
                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        SCT Auditing Pending Reports
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                        • Size 2B
                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Sdch Dictionaries
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                        • Size 40B
                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 12KB
                                                        • SHA256 c6065a2ca22d09b9bdae6dba2578081c1e14f33464abf5ad277bb16f50585020
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 12KB
                                                        • SHA256 025449ae32b11f9d7ada69329fff0ccab3c168522ea5e810ee6a15538f9edf1e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                        • Size 12KB
                                                        • SHA256 24802aa074700e885fe928f144f90f62e441d85f8b24e1b52e7d2ef80a976255
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Secure Preferences
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                        • Size 29KB
                                                        • SHA256 37f779838c5f6b3a3fee272714c5a2e2ba154a38d46d94d0a45a65254c516c14
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        sync_diagnostic.log
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                        • Size 4KB
                                                        • SHA256 5a1cb2aab2fcca8674a32ce7985349b375bedb9b1b79229ea1a9ad4264d4475d
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        OperationConfig
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                        • Size 22KB
                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        OperationConfig~RFe5b2efc.TMP
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b2efc.TMP
                                                        • Size 3KB
                                                        • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 35KB
                                                        • SHA256 c750aa05cdef32c0431ea74ab38872cf8385e8bb7d32c451c55c878d23320418
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 35KB
                                                        • SHA256 2064eb53fbf3f6eec21804c5115bfb631ff2f3597cacc16843f68c341842f8bd
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 38KB
                                                        • SHA256 29068d081f849bab809cb3d2611432183720b6d3d9330d8c46100e21b2a5ca41
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Local State
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                        • Size 39KB
                                                        • SHA256 b4e05c42a595429ec3d96779ab561ca9ab41e678c111914410b74059e49ad848
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                        • Size 153KB
                                                        • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        2fddd5d3-2456-4e8a-b1fe-1002a7ccc6cf.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2fddd5d3-2456-4e8a-b1fe-1002a7ccc6cf.tmp
                                                        • Size 13B
                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        metadata.json~RFe5a6bea.TMP
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a6bea.TMP
                                                        • Size 132B
                                                        • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        87d8615b-8c73-4743-89ca-de164b988243.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\87d8615b-8c73-4743-89ca-de164b988243.tmp
                                                        • Size 1B
                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        MSI4452.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\MSI4452.tmp
                                                        • Size 57KB
                                                        • SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        MSI44E0.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\MSI44E0.tmp
                                                        • Size 138KB
                                                        • SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        RCPROHelper.log.txt
                                                        • Path C:\Users\Admin\AppData\Local\Temp\RCPROHelper.log.txt
                                                        • Size 149B
                                                        • SHA256 603f196cc75f18e5985e174bb440fc241cf4f19e6678115b1ff885478ba92947
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        RCPROHelper.log.txt
                                                        • Path C:\Users\Admin\AppData\Local\Temp\RCPROHelper.log.txt
                                                        • Size 352B
                                                        • SHA256 3505a1c9271681214671ebac8e762522dd4f041f120b8150ee60396a6e765254
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        content_new.js
                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5052_336379694\CRX_INSTALL\content_new.js
                                                        • Size 10KB
                                                        • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        0x0409.ini
                                                        • Path C:\Users\Admin\AppData\Local\Temp\{E7C49777-B273-4827-B708-843496BD7B5E}\0x0409.ini
                                                        • Size 22KB
                                                        • SHA256 a9cf5b5a4303ca758bdeff308cbd59fc98cf918c3d51cd62913e2fc75d2e4339
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        _ISMSIDEL.INI
                                                        • Path C:\Users\Admin\AppData\Local\Temp\{E7C49777-B273-4827-B708-843496BD7B5E}\_ISMSIDEL.INI
                                                        • Size 20B
                                                        • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        _ISMSIDEL.INI
                                                        • Path C:\Users\Admin\AppData\Local\Temp\{E7C49777-B273-4827-B708-843496BD7B5E}\_ISMSIDEL.INI
                                                        • Size 5KB
                                                        • SHA256 902cdb582d8914a1ba89e46a9da772e54a4d723618c10438196e7abbf2673421
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ~2A62.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\~2A62.tmp
                                                        • Size 5KB
                                                        • SHA256 b5793ec9059064d97bd49fc4e5bb38e5a75e5c433e3b24334d0acdf5df7df752
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Client.log.txt
                                                        • Path C:\Users\Admin\AppData\Roaming\PowerOn\PowerOn Suite\Logs\Client.log.txt
                                                        • Size 3B
                                                        • SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        Tray.log.txt
                                                        • Path C:\Users\Admin\AppData\Roaming\PowerOn\Tray\Logs\Tray.log.txt
                                                        • Size 1006B
                                                        • SHA256 63fcc9a7dca1a83c8e66a792f72489e49eca39d1f83b784c9ce78ac34e6365ce
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        Tray.log.txt
                                                        • Path C:\Users\Admin\AppData\Roaming\PowerOn\Tray\Logs\Tray.log.txt
                                                        • Size 1KB
                                                        • SHA256 4f0d23ff31a3e2ef290cb9c81975e6ed8f7e791e217ef739f43e7572220681d4
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        MSI321.tmp
                                                        • Path C:\Windows\Installer\MSI321.tmp
                                                        • Size 990KB
                                                        • SHA256 49d575715ce99fde026c062ff8408ba6940bdfd43862d1bdbb8cb9f9cdf83e3c
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        MSI8EF.tmp
                                                        • Path C:\Windows\Installer\MSI8EF.tmp
                                                        • Size 433KB
                                                        • SHA256 5f80653cf15f7240ae5fdbff7aaaac39426b5a422f62628021e078a326f1a6fb
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        MSIFEC9.tmp
                                                        • Path C:\Windows\Installer\MSIFEC9.tmp
                                                        • Size 700KB
                                                        • SHA256 099ef08fee2af0f3b44a55544bd56adb6f88196ed56c134eb5aa59fd93c4b0a0
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        e59f6ab.msi
                                                        • Path C:\Windows\Installer\e59f6ab.msi
                                                        • Size 14.3MB
                                                        • SHA256 0cd4af56079ceb2e7b7997d96d9bf53e4679866069821ba0c832309d97ca04f6
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        1033.MST
                                                        • Path C:\Windows\Installer\{8EE7BECE-7996-4A54-8AE1-8A9E9549D59D}\1033.MST
                                                        • Size 20KB
                                                        • SHA256 02cce15ac1a27d3d02c82c99bc51e1e7bf10f0b6c9549912d0ef3e2ddb86f2fc
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        metadata-2
                                                        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                        • Size 26.1MB
                                                        • SHA256 a027b20c666485f62cb3e12ed8225927203498c8b43deef73a458b0964287e7b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        {3b4d52c8-1c40-4ad2-992a-3f38aa0ff9f9}_OnDiskSnapshotProp
                                                        • Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{3b4d52c8-1c40-4ad2-992a-3f38aa0ff9f9}_OnDiskSnapshotProp
                                                        • Size 6KB
                                                        • SHA256 8369ca159a9598177daa3e560e1f3e7aee6c4529dce2c30251bbafdcffcd7105
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download