hxxps://free-robux-700[.]soft112[.]com/

Analysis

max time kernel
112s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://free-robux-700.soft112.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\apk_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\apk_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.apk\ = "apk_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\apk_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\apk_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\apk_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\apk_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\apk_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\.apk	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\apk_auto_file\shell\edit	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
4544	msedge.exe
4544	msedge.exe
3632	identity_helper.exe
3632	identity_helper.exe
5740	msedge.exe
5740	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1592	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
5504	OpenWith.exe
5628	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe
1592	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4472	4544	msedge.exe	83
PID 4544 wrote to memory of 4472	4544	msedge.exe	83
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 60	4544	msedge.exe	85
PID 4544 wrote to memory of 3192	4544	msedge.exe	86
PID 4544 wrote to memory of 3192	4544	msedge.exe	86
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87
PID 4544 wrote to memory of 3808	4544	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://free-robux-700.soft112.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb7ba46f8,0x7ffcb7ba4708,0x7ffcb7ba4718
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,13474596955639080642,3067008618962393375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4504

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5504

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1592
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\android-comKUADRAFreeRobuxLite-12.apk
  2⤵
  PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
26KB

MD5
086122a4bfb7a51510e3f0f0358446c2

SHA1
409d7940193c0a6201fb28376f9ca1ec4e09d979

SHA256
3c982a4b7283f4a728760190c40feaef16cceafab2f04f372c7848ff1b65c270

SHA512
1db1eb3cc8fa2fea162297b95d6f9d5fff99d2ddecb2e5a70eee014585f6c51550816dff2b295aa268e7040c5414c89c6c7d45f0c924a612dd98ff4e7974c309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
50KB

MD5
c84848bc7f23ae0d6d344720b353979a

SHA1
8d7d18e015debb44c19628f3f18873043495cbd9

SHA256
5e5b6fd1313d15d145a52ad4ef20db96eef8b2d55ef44a0c54c37988e910e4d3

SHA512
053dc9a28605d939d1ff3f528c9a76e058b5ac8904a9f3570bd1e192140b60653eab1ab95bd612a0457a2344864b4535e4340d753d7f5cda49a56bfe717b6428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
72KB

MD5
793edc0f9b830fb7728c93dee27f7fc4

SHA1
1b7e7695fa94cdc34b3acadedf5a22d0ad5d4951

SHA256
779c8934afd925f187388baca29c47fdaf6c1adbaecdc00aa2be9dc0f563aa34

SHA512
3e66f3c3b78211290f71aef181be18fcd614a7c67abc573cab366e94a091a641d411c8c581073fb14f5c6279e94a805e7628629a51123cb60f9da7f971c1f1db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
101KB

MD5
4b7e255873af413d37e44dcc4877ea72

SHA1
d175161b8ece05f4cf16212aacbe9462fed46b19

SHA256
e00f8798739bc41b09a9ca5364afffa17e68cb15f4d0961ded82b413a7ff38cb

SHA512
bd41d87fc6e55b463ebbee0fede12a12c5b3e3fb9c65f78c3ea1a119b58283ab4c7d48d1824f2021eb12c05dbb2d1bb032fc01645647307590cd028bc7cb8c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
19KB

MD5
69ef77257c7fa3a494a232f90b05d55c

SHA1
19dc83dc05f718e9693de231d48bf0307d8d29a2

SHA256
d1ec04bcd468208a30012d660d1e857bd9d4d937957d45bb10cc7483de435421

SHA512
1b95ee10d622e1468e04691dc47fcb59da6349ba8cdc0814ac8d27a0ebcb9c09692ef1b86533ebd59f2bca87f3340cbe032a011223afe4e7db018af47bab38ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
19KB

MD5
b776233322697ee26b8834e35359764d

SHA1
327a743d304c4b27f243a5d4738c401e5dec3e24

SHA256
15e5a253f62978e07e4823d23bb97d956099ccde8704fdd38aba02b11cf7e40d

SHA512
73eec5c89887b99f089c610826dbe273a86f9f4c0f5f0f987d87b7d9ed12e78a1cb5741d30d23d21aff6536dc34a1258cb3eda9a811d2294e96af4fcda1637a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
33KB

MD5
1aca735014a6bb648f468ee476680d5b

SHA1
6d28e3ae6e42784769199948211e3aa0806fa62c

SHA256
e563f60814c73c0f4261067bd14c15f2c7f72ed2906670ed4076ebe0d6e9244a

SHA512
808aa9af5a3164f31466af4bac25c8a8c3f19910579cf176033359500c8e26f0a96cdc68ccf8808b65937dc87c121238c1c1b0be296d4306d5d197a1e4c38e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
901e095ab5bd863577bed24de217ead5

SHA1
786a92cf3d27cee060672fa7e9e0e346ba2f3a0c

SHA256
da88b7e0669e64bc6a086a6522ea23bf931b176ce184f1f01a54deadf6a14378

SHA512
506df89c546774df2e03e5a727d929aaeb7b616b561c0d82fad201eb1dfbc161f6111e890a7b4ea59dfac92570ede4c0d31116150f4ca05293fb357d5e2b438a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9ea02f5b7c5fd94cdfc777873871c4f9

SHA1
c679f60680ee1bb16c94bf0920f16c9579831a37

SHA256
329a7730625fa8d49228371e21037c7e61ce60109567eacd325c4426dee856bc

SHA512
e6c40d3b6c6f0704d2884d6d76a899056da0f4092a54a47fd74552b279b954b4442543e62d2045a35f0a132c8a1816ce17d4e023ad5d2561ed7e31135dc8a8d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a48d3bc285cbe08d7e0e4fc0b905b37

SHA1
bffee27c56a2540843372aa33601947e2daa6932

SHA256
408dfbac5c7af8da1cc73f2d6b4f969e23b660fe01fc1d4106c917c6a98cc5eb

SHA512
328affc5f9682c277537b6b88eb3d2ad56fca299c7686533d732519d3e11f3bf23d97dca6632e221e0068895c36fccccfd907a5c3728495c37e7a3bbb51ead32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d395c69ef325511820745b7e9ccf1c39

SHA1
e848279b466331eab8cc98c51f8a4741aeb8d4ea

SHA256
4a7c750783e04f9b30f50823bcf3a18506fe636eb5e93002277f96f4990f9010

SHA512
4aa31641b7d1a9051e941b299387aa491f6ecfee0ec3fe29b593f054a3905269667253816e5c0c6744683120fd78837b5d94436592cfbcfe94abf7ab3a2103d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3bfdd3c1521641cec84aa94a6533de90

SHA1
5af28028387adc44d834605cae53cbfec8380e6f

SHA256
b98f79e1eba64496428a6f4c3e720f65b07ed3905b902d3aedce9f1572bd7867

SHA512
05669e533ac8a852a5c61367b02857876f632c2e3564c37094e62e4ae25ad92530346c53e086578b982e5f3f2c8878fe0e6a426b30c2c81fd278a1fcd0c52fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
a98dbc21141ed345ebbefd5ef68de0db

SHA1
f58db7bce342dfe51be44a7666ee024ab35d0d20

SHA256
b47ae7edc8714ee4ef66972d3d7d58d625dda9b6ee673afd2c35f6126a0f8cb1

SHA512
be09702bea1c889ef56acb16ad95ca619aae111b4662c6d26ec80b1feb2f6c69932a3ca641f27f6d248a170f13c588e03606ba6ebf51f36383259b2257deafb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
28c13120dd3e23f7e1c916f8d5f22e6a

SHA1
310e91b03960fa9e1373aedda63ec1c984568714

SHA256
cba3017ef6b0c8ef92968cea63670dc578866f8183138b531e29ceaaac110bfa

SHA512
ee4acf4ab883ffd4b64515f6f4927625de5af1333b4a66f7b31e6b94897ae21292f324f35fe25ff9cd0e9bb1393aa4a486d74e87cba7dbdeb78ada7cb7ebef6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578fcc.TMP

Filesize
703B

MD5
fbf308074415dabad30a6b94932731c7

SHA1
c5bf603fde7c5b5bbecd0b5652d2d119e7a994bc

SHA256
882d69f48f392db5a863bff2ca0872122ad0930d1cb32c5a3c2db5e3d5e4cc5f

SHA512
817ade019b758c45eaa9c17f7ae58c2b783e53860ba11ac418144dbe7b285d16d9af6ce83cc9e8f6037ea9f719d83bca5bfeaf3618ffe8fe50f29aef68a61f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
77fe636bc228eea203c3897cc67d3891

SHA1
f6e3cceaa375dd4ec67455e658b3df522512fd70

SHA256
bf150fd3b57fbfad463f627e8e494b800df789a5a97be6b37f91a7f6f62d284f

SHA512
3819572fa818985cedede19fce29fb850ff44fcaa132ca599a8c0e5b3f62da61771377b07442f1acf01058061db782bf588e2b6c90a5efdb3b6e97ea4b4c6d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
428a0ccbaea39bc4e727fd63d6e164b5

SHA1
5a52ae406a7e419ad7167d629d22999f14a41665

SHA256
89060804d4dd7dd5c57ebbcb2b626417cedc85ac2171b36756a20cfbf270c956

SHA512
a9e8dc0735766698c9ef87793e11588ca6dfbac9da463104eaf831034203c27e4570cba0f0e8a9222172087759cae379449bc7abef707fd210e02db22e6040ee

Download Submit
C:\Users\Admin\Downloads\android-comKUADRAFreeRobuxLite-12.apk

Filesize
19.8MB

MD5
f226cbe47d7a8351861331e010620214

SHA1
b184f399e3cf4473018b530344c03dc10f454101

SHA256
885cb28ae72c37d707f47e8a6dc88faf6225b66e5338340855649a7a67f7a27a

SHA512
f071f7afaf2e99c2373f8044959060022d1365074ed9f4d16bd81bc3e3f1a59c781aa792939e0e178c9a68400cadcb9f29ad4b0f74cda3c24d0a38e2ced5fd45

Download Submit