hxxp://crl[.]prod[.]cagenerator[.]pki[.]strln[.]net/crl[.]pem

Analysis

user interaction
yes
max time kernel
54s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://crl.prod.cagenerator.pki.strln.net/crl.pem
Sample260925-qpr2msxblh

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2640	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348164046335254"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{CCE29A52-DBF4-495B-9F81-67C3096D864C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2576	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
868	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
4164	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5248 wrote to memory of 4584	5248	msedge.exe	84
PID 5248 wrote to memory of 2640	5248	msedge.exe	85
PID 5248 wrote to memory of 3156	5248	msedge.exe	86
PID 5248 wrote to memory of 3156	5248	msedge.exe	86
PID 5248 wrote to memory of 3156	5248	msedge.exe	86
PID 5248 wrote to memory of 3872	5248	msedge.exe	87
PID 5248 wrote to memory of 3872	5248	msedge.exe	87
PID 5248 wrote to memory of 1752	5248	msedge.exe	88
PID 5248 wrote to memory of 3860	5248	msedge.exe	89
PID 5248 wrote to memory of 1752	5248	msedge.exe	88
PID 5248 wrote to memory of 1752	5248	msedge.exe	88
PID 5248 wrote to memory of 3860	5248	msedge.exe	89
PID 5248 wrote to memory of 3860	5248	msedge.exe	89
PID 5248 wrote to memory of 4076	5248	msedge.exe	99
PID 5248 wrote to memory of 4076	5248	msedge.exe	99
PID 5248 wrote to memory of 5896	5248	msedge.exe	100
PID 5248 wrote to memory of 5896	5248	msedge.exe	100
PID 5248 wrote to memory of 228	5248	msedge.exe	101
PID 5248 wrote to memory of 112	5248	msedge.exe	102
PID 5248 wrote to memory of 228	5248	msedge.exe	101
PID 5248 wrote to memory of 112	5248	msedge.exe	102
PID 5248 wrote to memory of 112	5248	msedge.exe	102
PID 5248 wrote to memory of 224	5248	msedge.exe	103
PID 5248 wrote to memory of 1368	5248	msedge.exe	105
PID 5248 wrote to memory of 5640	5248	msedge.exe	117
PID 5248 wrote to memory of 5980	5248	msedge.exe	118
PID 5248 wrote to memory of 5980	5248	msedge.exe	118
PID 5248 wrote to memory of 5980	5248	msedge.exe	118
PID 868 wrote to memory of 2576	868	OpenWith.exe	125
PID 5248 wrote to memory of 5584	5248	msedge.exe	128
PID 5248 wrote to memory of 3352	5248	msedge.exe	129
PID 5248 wrote to memory of 1648	5248	msedge.exe	130
PID 5248 wrote to memory of 2348	5248	msedge.exe	132
PID 5248 wrote to memory of 2348	5248	msedge.exe	132
PID 5248 wrote to memory of 2348	5248	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://crl.prod.cagenerator.pki.strln.net/crl.pem
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd1ae4c188,0x7ffd1ae4c194,0x7ffd1ae4c1a0
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,3256994130453179977,12867239245122720120,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,10536802947662120145,14114335984734910488,262144 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,8930394570301666715,15330995338813279921,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,18335239464096155818,6921182746758133659,2097152 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,8911563796737445628,7131213552143082119,2097152 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,4111064984965131161,7295461658291450914,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,5444606001546981799,11292432435095217581,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,7289843870040059813,11461707000390946060,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5572,i,14817488808107534470,8540309339717448485,2097152 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,475796925132935496,5374723720620985915,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,8329502013749296297,11698309708852209762,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,8329502013749296297,11698309708852209762,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,8343240873085033702,11457664484229721476,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,8343240873085033702,11457664484229721476,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6412,i,7716355750959288053,14770453420401494922,2097152 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,6113250300430018617,2681696058519781392,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,2019817721832787737,14874369850657673042,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1532,i,5917840844408796110,15759978078433733063,524288 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5648,i,614367223636606486,2696087446905941284,2097152 --field-trial-handle=2244,i,14993826638223218939,14659473775231566065,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3356

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\crl.pem
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 5ee75ac9bf4f4eb72259294ede61788b0c2ef9e5979ee2b255a9da4d78780e2e
MD5 75ea43a1ef29b6614cd07e8f6e42bb5a
SHA1 5929531d2d09267becb726c372493476daa76b49
SHA512 01d085ef2cbadef732b675e08e3a65c576202fec8b282ab0d51bc64716b10df88370e44bc229a1c6389a3bbff33ab4a2f51f04697e6a8c33e1b62eaad998e4c0
TLSH
T188F02DB5CD26FC3B08FC1B2920541A46F75113572B80898B3B3D820D8FF163B854682C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2d0ee464c4f0e7f8860f3a5c1c610cf465bb79c962741303a5965dbee4978d5a
MD5 ed79b89bf058504ea0163e1214702902
SHA1 b4104916748fc44f5c5b3c1a75aefb54352f0c43
SHA512 cf6e2b8a9ebd54ebcfca3794790c519349cc304b0d1b87e7754793d25524dd9a4a1e65f306be8ef7945cf03be1a21880c9d069b18347d94572f042bff7610153
SSDEEP 192:sxZJRs9R/f2sT3QZZsOzodpLHxY6+WNGYbImFYprIgjxJ:sxZJoR/f2sTOZsVLHTGFMYpj7
TLSH
T17F32B715AE28A97B8CC7E21DFA55BF53D7F9503390941E44A6FC8A1C14E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5dc77e636868b9177469c6d731522ef489e41f3be0d39a3d578401a4f25d275b
MD5 8a6faecdc2a47489f0600bb89d985766
SHA1 e4076be06b25c1cd0cd56dfe680ec56ce37f5c8a
SHA512 198b4fb0c1f710535161cb1ca1ec12c03fce7a07fd2099155e52020d2aa83b39fcbdc2b0b6e073edade5c7b65262a722ca58cd71da0691d8f5e11289aa3fcb09
SSDEEP 192:sxZJRs9R/f2sO2QZZsOzodpLHxY6+WNGYbIQFYprIg5yxJ:sxZJoR/f2sLOZsVLHTGFeYpA7
TLSH
T1D442B619AE28A97B8CC7E21DFA55BF53D3F95032A0941E44A6FC8B1C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6708bc9fce5f291205db56f4a311686f761aa033350699a0ba959818d220f11f
MD5 e3528b188c42daced2ca960aab79b6b2
SHA1 205d3b5130e17cc5ee1e970cbbf66c37113db0c5
SHA512 f6f561880f7846389b77eddd5d584608166cef84e3053361930cb896db4d8705418b659ace020ee58b0420865e6ebb37716daa1d2b6d7f50771fb0d2df1f8858
SSDEEP 192:sxZJRs9R/f2sO3QZZsOzodpLHxY6+WNGYbImFYprIg5yxJ:sxZJoR/f2siOZsVLHTGFMYpA7
TLSH
T12D42B719AE28A97B8CC7E21DFA55BF53D3F9503390941E44A6FC8A1C14E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6de10efb0545d79aa9f1a9c0643420b09e8d04a76fa20430163cd29f3e1e14c2
MD5 dd9ab77ad8ea1fe376b32b65033fa565
SHA1 454a95d3f9049206e955ac87aba21de351ddaa3d
SHA512 e3265901f64f816fa7781da62e102cbd5ac5127d9aeab8a98b878fde04e1fbde5a44f033dba7649d1f1ee7c0c676e6bb72ae996f1117b82bde93b9c34e8a176d
SSDEEP 192:sxZ0Rs9R/f2sO2QZZsOzodpLHxY6+WNGYbIQFYprIg5yxJ:sxZ0oR/f2sLOZsVLHTGFeYpA7
TLSH
T1D842C619AD28A97B8CC7E21DFA55BF53D3F91032A0941E44A6FC8B1C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7029d0a3d67ff52c19c042d87a9e56dbf94cb0bff934272de17b174ae8dc3c7a
MD5 26343bdc3b56d36649971c182484d1f9
SHA1 f371213d6ece83ee2c0646b467c557abc80532d9
SHA512 8b90a3e6dd994960a1902f79354253ec7f7b48332961d0681993cb18d88dfabcb7aaa6a1761d0618d2957613c672d5332df09f9ed4ba598c48e08e5af4ff015d
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXE7vL:OtfFvpopPxrB4RhfEzL
TLSH
T1EDB2271571BA021038FE790881B5972F464232B33259EA3B7FBD14A69E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6c455284908c74282fbd4552df714819c8b5b276bd0beb2c0ebca83a1616291e
MD5 dc30bfb90152cd60936cd7d795ec5ac1
SHA1 397b9a09451f7b5c3dd652cb4f1d547d6053544e
SHA512 29cebc100e16bf7ce6e0e1513a83c5eb87dbc08efb27d6b321ec7c53a7e14d1a4844c310bb3933dd0b962ffc125a62ae2ae64f14c57e1c61cb569edfe0378ad3
SSDEEP 384:nBiFRZcIgsNW8TUNTUlI4p5mgF3+K2fMBVvrWfs/9tgOIwZOy+dgL/7Iz5o2:oF5g/wgxiXBVn9XsrV
TLSH
T166C24B36D8A8DABBACEB8A99B74A7A03DEF0015385DC8AC4D5DD5D5D00D71DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 45a253237a186570e2d0bc72ff2daff4b55bb836200aa817d8dfcd9067e7748c
MD5 fc73fd31adf7a220f952740e0c093fdb
SHA1 0df44f5fb8a95774100a6ce751f8035af5e5a2a1
SHA512 a0b8a8985dfcdb2a548d62de47b2fe910ba3fd34ca752affb85d279039333d5b6483614121680b42f186bc9bd54a4f34d6f1f0b899f6b8bbf5e8f0d29144272a
SSDEEP 384:nBiFiZcIA3sNW8TUNTUlI4V5mgo3+K2fMBVvrWfs/9tgOIwZOy+dgL/7Iz5o2:oFQA3/wg9TXBVn9XsrV
TLSH
T1D6C24B36D8A8DABBACEB8A99B74A7A03DEF0015385DC8AC4D5DD5D5D00D71DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bbc314e6dc809d31e612c5978565ebcf986d529df2810517dbff8c011c0938fa
MD5 9525235f27cfb1b97e83906e63251f71
SHA1 8f0d7a3d6fee7e02d2f24433c07882736bbb80b3
SHA512 7ca8711c2a7f1e1566f9e827ec2a7cb4d7a3df7f2c25fbc107e53c8e01bc71fc229c37b2f8bd811b5f2b0f7b2eda535910760b0e516e78ad8bfff5e8e649e8ee
SSDEEP 384:n8iFiZcI63sN08TUNTUlIm25mg56nK2fMBVvrWfVfsa+VYWzgL/7Iz/oB:nFQ63FwgSZQBVEfhgLK
TLSH
T17FC23976DC98D9BBECEB8FD5A78A7A03DEF01163859C8AC4DAD95D1D008719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b49f00e77ffdeaa406f0c7df09bd884559ffc52b996073a2139e50eab1a7602f
MD5 b9ef7529acf7ad537527674df54ebac0
SHA1 e5aecde8a37a5504412ae8311af1a963f510dddc
SHA512 8d8216550ebeb45791891cf5bb727e6b6d6dab8fa939c1d2fba359296bdabbbbd6c87d99cfa66e9f769e2777ea9f7aca4d881d134e5013e1f828f4648590de12
SSDEEP 384:njiFRZcIgsNW8TUNTUlI4p5mgF3+K2fMBVvrWfs/9tgOIwZOy+dgL/7Iz5o2:OF5g/wgxiXBVn9XsrV
TLSH
T151C24B36D8A8DABBACEB8A99B74A7A03DEF0015385DC8AC4D5DD5D5D00D71DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d847c8eb963cd92bccfd5eef6b0c1add7b8b08876f6291e5a21aaf7e19acfce8
MD5 e84d7f3ddf0aaabca1169e83a2188201
SHA1 12927346570e37d3f1d23eed8ff8cc83080fa0f4
SHA512 1ae124e44f0533761f8a2ed21468bd0d8ec49d520c2b49f56ac553e554873a8acddb92ba96d6c13796d787607990612871e8dc2824a9a8ebd97266ddca9dad23
SSDEEP 384:njiFPZcI+sNW8TUNTUlI4p5mgO3+K2fMBVvrWfsJ9tgOIwZOy+dgL/7Iz5o2:OFH+/wgxZXBVh9XsrV
TLSH
T1D2C24B36D8A8DABBACEB8A99B74A7A03DEF0015385DC8AC4D5DD5D5D00D71DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a9c435c6e0e43cd841b316fd38902a957a8821abbc1d3d50f7d844b43fcfa1db
MD5 2251b92d4aeab87f4ea32ec79e996a41
SHA1 b895590fb173251dd0fc0f840c16d27dd8c4dec7
SHA512 bb1350744e705f86a7b28bac4aacc49d6239e80f7229add4cacb3d38b80b255bc8745dcd17df44df1983c45ee87b68d42fb7a1bf333b2fd4584d6e152a718d5e
TLSH
T116413A98A6F91148B3B76F5AABF6987D487BBC772F06946D00110D4F0A72A40C9B1733
MD5 SHA1 SHA512 TLSH

Submit Download

crl.pem

Path C:\Users\Admin\Downloads\crl.pem
Size 816B
SHA256 7b4a74ce5dc9917bb11404a7bdf334b8c27535bb7603efad636c6d8d7aae20ed
MD5 6156fcf5f94cfe735601304fb39bfbb7
SHA1 b505e763302d73db2771c8137751ed56b2129db7
SHA512 f5e4e8618db02180d191f5bce59e3552ee67a45ed823c20afae1c8a5985df70d951927d83442e6e8b03d5ce94cbfa0495004f395303a312d8bd461f793565133
TLSH
T1450152798D4C121F5C8BF54CF2CE8269E72DA007AC2FA51258192A04C74BE7A626D6E8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1368-197-0x000002AD540E0000-0x000002AD550E0000-memory.dmp

Download

memory/5640-219-0x0000025600000000-0x0000025601000000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads