hxxps://cdn[.]discordapp[.]com/attachments/1528810377444458606/1528811161204818142/regent_spoofer[.]exe?ex=6a5fa7d8&is=6a5e5658&hm=e21064e7025d04a56d1417721a709ccb5c849623cabbb3f340ed52e66adba6a8&

Analysis

max time kernel
149s
max time network
146s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/07/2026, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1528810377444458606/1528811161204818142/regent_spoofer.exe?ex=6a5fa7d8&is=6a5e5658&hm=e21064e7025d04a56d1417721a709ccb5c849623cabbb3f340ed52e66adba6a8&
Sample260720-vv6t7sa17x

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	4924	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4924	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290415914702058"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{A8CB2077-24EE-4ACD-BC0B-ABE41DE2187E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 380	708	msedge.exe	82
PID 708 wrote to memory of 4924	708	msedge.exe	83
PID 708 wrote to memory of 3604	708	msedge.exe	84
PID 708 wrote to memory of 3604	708	msedge.exe	84
PID 708 wrote to memory of 3604	708	msedge.exe	84
PID 708 wrote to memory of 2364	708	msedge.exe	85
PID 708 wrote to memory of 2364	708	msedge.exe	85
PID 708 wrote to memory of 1996	708	msedge.exe	86
PID 708 wrote to memory of 1996	708	msedge.exe	86
PID 708 wrote to memory of 1996	708	msedge.exe	86
PID 708 wrote to memory of 572	708	msedge.exe	87
PID 708 wrote to memory of 572	708	msedge.exe	87
PID 708 wrote to memory of 572	708	msedge.exe	87
PID 708 wrote to memory of 4728	708	msedge.exe	88
PID 708 wrote to memory of 4232	708	msedge.exe	89
PID 708 wrote to memory of 4728	708	msedge.exe	88
PID 708 wrote to memory of 4728	708	msedge.exe	88
PID 708 wrote to memory of 4232	708	msedge.exe	89
PID 708 wrote to memory of 4232	708	msedge.exe	89
PID 708 wrote to memory of 4408	708	msedge.exe	93
PID 708 wrote to memory of 4408	708	msedge.exe	93
PID 708 wrote to memory of 556	708	msedge.exe	94
PID 708 wrote to memory of 556	708	msedge.exe	94
PID 708 wrote to memory of 1036	708	msedge.exe	95
PID 708 wrote to memory of 4376	708	msedge.exe	96
PID 708 wrote to memory of 1036	708	msedge.exe	95
PID 708 wrote to memory of 4376	708	msedge.exe	96
PID 708 wrote to memory of 4376	708	msedge.exe	96
PID 708 wrote to memory of 4312	708	msedge.exe	97
PID 708 wrote to memory of 3784	708	msedge.exe	101
PID 708 wrote to memory of 1332	708	msedge.exe	110
PID 708 wrote to memory of 4644	708	msedge.exe	111
PID 708 wrote to memory of 3888	708	msedge.exe	112
PID 708 wrote to memory of 3980	708	msedge.exe	113
PID 708 wrote to memory of 3980	708	msedge.exe	113
PID 708 wrote to memory of 2828	708	msedge.exe	114
PID 708 wrote to memory of 2828	708	msedge.exe	114
PID 708 wrote to memory of 4552	708	msedge.exe	116
PID 708 wrote to memory of 4552	708	msedge.exe	116
PID 708 wrote to memory of 2964	708	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1528810377444458606/1528811161204818142/regent_spoofer.exe?ex=6a5fa7d8&is=6a5e5658&hm=e21064e7025d04a56d1417721a709ccb5c849623cabbb3f340ed52e66adba6a8&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff9202ac188,0x7ff9202ac194,0x7ff9202ac1a0
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,6672101501599445138,3567914368700568565,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,3055553394986661052,10696160032120060617,262144 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,15794954578166395866,15967360729974098556,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,17429214933121081452,3295952011993388868,2097152 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,3345034155992028660,5690338460362864357,2097152 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,11647052355472516946,9325863068415191762,2097152 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,17793174039686221232,13188136856017959453,2097152 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,17034533962368341621,959127389121092484,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,15381535478628605344,15106036081925715247,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,12577411390183882875,829833825273491281,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5772,i,1393755970124949672,16840135146432745708,2097152 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,13371582079145597297,10734817204692205045,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,4299427573321479049,3020127554881581405,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,4299427573321479049,3020127554881581405,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,15850804191315099635,16306718410720457263,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,6162337824901548427,16262391086770075491,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,5965653707295704812,1888662529491801506,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,8616508803098847982,3576349891835984413,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,14507957145571740985,10163996164133941202,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,15927277450766935667,1575518486154145756,524288 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5764,i,12910892348718977040,7810572286214184751,262144 --field-trial-handle=2004,i,8958102192603243229,5742482343696179699,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e51b9bee3c2dbb63afcbacc2cde944a53371e66aaf1c8ba0bf71c7ee6eab83a5
MD5 2857cf1b0f1c8c30a6b756a34a37a836
SHA1 b21564c162ba15d8314ad459931f7f7c36b82ddb
SHA512 9fbd8c2a41b37b8a8425570de1371b59602556a9f89dcecaf471ea286b3538f518e368873fcf7b34ac36d9a7de7577953a1abe80c4995e05e1202c1b270d8dab
TLSH
T1F9D012232A5DB011FB695274A812CB00173655A024868711E211C49C96741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7e95f37100c9d7f0117e6b56a53931f2a55ed57b23dcc6068798d1390aec971a
MD5 8fd5f3d92ff8c442086ef292dac1b435
SHA1 bcb6d26cc8146c6842b3da23f9b283b6decdc95b
SHA512 4cb8928ca16945ffacc56d7006e84ebcccc5629b1efb5b9f20ee1327216f0f5258c1f0eee3954d6aab2df506683951c06454cea16787fc53cdde3cbfa8537bd5
TLSH
T12AE026C40ECCC32EFA40B58B817A6B4CC389365A9BCC698E1719C89C3801848A7E7690
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ec4a519333044de837150a6206879e67ed7c5e79c66282aa11b037820d86f73e
MD5 97f6f937ee79b583b8fc6cd76c3c0de7
SHA1 309b3d81ff12dbf520ff23f67cfb8415972da884
SHA512 7089a1f19ec6f639c35bcfd4fce3d62fdabf091346f9d5902b0de5f10e5731d468697ef00477f987983021339e5c70512ea0e7879b40087ac1f720bf13179b15
TLSH
T1F261095839FA48E1EB64C13D52D2420D36318A710B1A2BC682DFD8B63655F274F15B9E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f03ae077f4a7764c0a9de0abfc2f80aa268a04488d8d58b914fc37f768d56277
MD5 b4eb281682fd5865d502129cccb91e22
SHA1 2f18fb743aa4d0f084e2a217c637f1741105db3e
SHA512 6a0c3a1ec1fa960eb5e535e4c859b727e1d6af7f60c4de17ecbc82aa864cd50a585008fa428a06fe1e5b98264c59d932082fab8c241b9615cabd808a57382fab
TLSH
T13F21AAF3C3D586AEC94516F06A14AE2BCE2D0618832C3C1A89D4EF5BD7E3072E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e26610a4de09fe6cf24e4c7321754b97712e412b066b9de4ed8d406cabb76a21
MD5 0a1c30fb46984faea1cee7dfd6a7dcde
SHA1 468ce8f1c7aa4f2b0a5dd4c9abeabeb2ab819a89
SHA512 5b90782825b6a2eaa983478fd53b2c57d6fd6a5990a8a6737a97cea4098b8dbbc47aea66f7d5097778ebdd2ecdac2cd6220067fdfc03359f1ffd19ae49852a1d
SSDEEP 192:sxZIiTRLDyM/jK1Ml8UQbm9bO/f7DsbDyF1RB6kIdpLHW6+WNGYcD1I0f7U5DVGE:sxZ9zq0S/fvsvybwLHbGIMA
TLSH
T1BF52E6166A3459B7CCDBE20DB9517F53D6F94572A2900E44A9FCCE0C01E6AED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fec87ff03c3a07a6677a61b4d5b16106e49de32ac6b33d53a5dda581ae6b59b9
MD5 f25e9df2fc8b8708fdf950d028d938f1
SHA1 c6013afd7956cc48b4e6ba19a24e887efbb421fa
SHA512 44703e7e93f34b8a2dc9893290256071d3cdad2fe78cce41db5f5d177af007a30f0e22f33fd1d32db5d5809aaa6176b4b9cf13ec86bdd52dce46829606e22c4a
SSDEEP 192:sxZIiTRLDyM/jK1Ml8M9bO/f7DsVyMRB6kIdpJHW6+WNGYcDsItff5DVGbIgrJ:sxZ9z1S/fvsVyMwJHbGxM9
TLSH
T14D42E6166A3499B7CCDBD209BA557F53D6F90562E2900E44A9FCCE0C04E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 099daf1289e20127d2030c46f6260a07e17d09094c190446fad4b740c3688e4b
MD5 59d68abd59da5babbb3a0d0c37fd5e53
SHA1 da7ac7a8c1d2b05261552bddbebfb2848cbfa06b
SHA512 9affc6d9addda67e5ec9af7a4331962ad9e0d6abcc70930d4e39e0e8dc5054373d1f71e5cc77ac510b61a54240e88a54923d6ca912f76c69a96f770558508c20
SSDEEP 768:Hu4RkXUWvssLg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlLBERIrojMQxcfu2:Hu4RkXUWvssLgu1jacTLBWRzo8/2
TLSH
T179D21C2B284CCB7E4F845E9CEC26AF966ED802CB97644D4447FA844C03C77EA511B9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 89b5315f1b94764ca1757fd3968434983414cccf35ce14244fa977280169f157
MD5 881b7ea011aa4f4e084441fa94fbec23
SHA1 38f4c9967b1a91744064da92701843147ef6d853
SHA512 dd5a4b0d7168da86afedd621fdadc43054a528a042922918d48ef44df4d54262ac762888f42f3464e43c5bc7d81b4a2b8081470ce638f12929020587259f509c
SSDEEP 96:KUQwKl2CebaKsUmCAgKxOOBWKSE6rTuKEwU+rSe0p:yLJR7wVGF
TLSH
T1BBE19A16313E469238BE2908A2B2C7374E9272B7751CE66F379811B60E66F125DFC5CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58d983.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58d983.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f5a0a35cf57d3e92c11dd51690db14318968fba274799d796db120b1211de2e2
MD5 5fd6c73a6731986b79f3cee7ffe160a7
SHA1 349789894e172173719eb86185350e5ab8c0e7f1
SHA512 38a5aa46c94aa93af205306969e1f48f3acadc09e99804d87cb1758bc3801700fe00fe9b383231df0cab91d895799fdeef32d633b00fe6e594aa746f2b098dbc
SSDEEP 384:LtNn/s3n9SfsN1kTag+udHdQ4sw2Fg6QvXSTindOObjI9G6w7vM:Lj+9UsgR9qmPCind29M0
TLSH
T1BC927D369C799C765DE3A96AB5873E23AEB0413B93C42F54E5EC6F0C02DB19C4306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 711ccdf08b3a5ef0f7662439cef7745485d96daf4b01b00aac53a0524246b6ae
MD5 0ff95076778eb2fcf49d7b905c569c29
SHA1 41eeffc62c198001bbb3ae2f22034b2bf524951d
SHA512 772d256538dc523065be37ade7cefebdb0ce00880f140cbdaa18dc8a885086a36d8510a0fdaa202ba64b11c5c582df55e9f4401e574973f156c10f65198fe0c5
SSDEEP 384:XiF1tNn/s3n9SBUzsNP8TUNTUlIlk6ag+udHdQ4sw2Fg6QvXSTGzdOObjI9G6w70:SF1j+9FiwgggR9qmPCGzd29M0
TLSH
T168A26B378C649C7B9EF29E95F64A3A13AEF0417BC685AB54E2DC6F0C02DB19C4306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05da5d74c67e80a8fe35f8b53aba74ecf60954d809d090753e38e137c94d1566
MD5 dbe96949627fd6ada33ee4591734119e
SHA1 433d1c35e3e2df7d792e9d932a3adc386d7a89ba
SHA512 e2253d60bdb0de395b49fab15f92b57e61c39cd0f62bcec12c299cf0954396461c9d4a35d2edf1ea1c467fb2ce3b43c568991f9298053573f02c155953e8c9a0
SSDEEP 192:lONG6JpdQmiUyIKIQgcQ4sw2F4jzonmsFHJnqU6:lONG6jYgcQ4sw2Fg6mkwU6
TLSH
T17202E739ACB86C7A9EF3AE05B5473B236FA41137E6D06B44DAE81F0C01D724C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b2d720f435286a35db8461fea9096794dc89687528435b2a612125d9a5b976cb
MD5 15e499673fe7817851dae67cb613eca2
SHA1 0553cb0b3a11176f81d5c42c7e85ae024d7c1045
SHA512 079348561e647c7000e9e0f790e15f8c2892bf36b29d91f0749c7036e320ea465601d41df180a4f4bea08a9b6ed5de54c9e43b80ab58a2a54f58fc1b138dbe6b
SSDEEP 192:e+ONSd6JpGIQmiUyItIQeicQ4sw2F4jzonQvXOFQEXshsJzcqLNU6:ZONo6Jf1cQ4sw2Fg6QvXSTX7dU6
TLSH
T1DF120B3698B4AC7B1EE3A955B5473A236EB14127EB846F50D6EC2F0C02EF55C134AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d19e316d-957b-4fe7-ab12-6a1c853eb301.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d19e316d-957b-4fe7-ab12-6a1c853eb301.tmp
Size 19KB
SHA256 58d1396b7f1e40ff85ca3261f63bfc3539c3839aa3fdf11d5b7ad9d031a636f8
MD5 26fcb4bd6fddb5408a88c7517634811a
SHA1 3dd6c78f62b91504137778bc56f024d1a79f822a
SHA512 f54df50ef50f23881730feab1fd7600e9338943ce984551fcaec63aeb5a81972b9dab863a2619ddb307ca588742f75488ee6b531b1f88a1290572864de0aa777
SSDEEP 384:TtNn/s3n9SfsN1k6ag+udHdQ4sw2Fg6QvXSTindOObjI9G6w7vM:Tj+9UlgR9qmPCind29M0
TLSH
T13F928D369C799C764DE3A95AB5473E23AEB0413BD3C82F54E5EC6F0C02DB19C4306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2587577a-932d-423c-bb5d-4926919e8457.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2587577a-932d-423c-bb5d-4926919e8457.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f1ca141c0ab0a8e20039f4e765390189ad499ec04290a1b6f427a7ec3967b210
MD5 ed57bd4d53b32f17ad56ad044cb9470b
SHA1 3ea869fe2f9a77cf908e4172458bfbefe94bbb27
SHA512 86693f356f34b848de8b513a08836dce31b15f1ddb93935a99148a6b505178cb864510c3a2139a4afb2136d079947342e0bf7d6aad7f521217186625fe1e36be
TLSH
T16641FE58B6F91148B3B76F199BF7A8AE587FBC772E05D49D00110E4E0622B40D8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

regent spoofer.exe.crdownload

Path C:\Users\Admin\Downloads\regent spoofer.exe.crdownload
Size 966KB
SHA256 24330b0ac0294c4a2d39a9b7cbe87978a48485f923fdbc2e30303a6f3eed4778
MD5 690bacb042415a51150b95eac1753e42
SHA1 d12cf1eff90ab1a3bf2dd27c973475c46d90a499
SHA512 b9af864cf9e9d90e8cc2c850bf60ecb418d44c4587e45e8982e00d3154e6a405fe3aa87c2577b26a74661192d81073df62ded666c3643cc23d37478d30670fd0
SSDEEP 24576:AFbZlgpwyDOiVnhV6q9a1CK2ifiK7cJtaV9sFX9:0bXCVnhV6q9a1CGiicJtaU
TLSH
T108259D43EBD460EEC717A1388512AB13A9727D011B114FE727E5A3E44B726E46F7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download