hxxps://gofile[.]io/d/itr2iZDS

Analysis

user interaction
yes
max time kernel
35s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/itr2iZDS
Sample261113-x77clsfx8s

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
53	1764	msedge.exe

Executes dropped EXE 13 IoCs

pid	Process
3696	snus.exe
4744	snus.exe
2524	snus.exe
2780	snus.exe
3884	snus.exe
4712	snus.exe
2524	snus.exe
4524	snus.exe
3132	snus.exe
2660	snus.exe
4024	snus.exe
1592	snus.exe
3816	snus.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
36	api.gofile.io
28	api.gofile.io
29	api.gofile.io
31	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{A53ACA76-4C09-44B7-88FF-4DC2B0C26C38}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3696	snus.exe
3696	snus.exe
4744	snus.exe
4744	snus.exe
2524	snus.exe
2524	snus.exe
2780	snus.exe
2780	snus.exe
3884	snus.exe
3884	snus.exe
4712	snus.exe
4712	snus.exe
2524	snus.exe
2524	snus.exe
4524	snus.exe
4524	snus.exe
2660	snus.exe
2660	snus.exe
3132	snus.exe
3132	snus.exe
4024	snus.exe
4024	snus.exe
1592	snus.exe
1592	snus.exe
3816	snus.exe
3816	snus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 3908	3876	msedge.exe	83
PID 3876 wrote to memory of 1764	3876	msedge.exe	84
PID 3876 wrote to memory of 4372	3876	msedge.exe	85
PID 3876 wrote to memory of 4980	3876	msedge.exe	86
PID 3876 wrote to memory of 4372	3876	msedge.exe	85
PID 3876 wrote to memory of 4980	3876	msedge.exe	86
PID 3876 wrote to memory of 4980	3876	msedge.exe	86
PID 3876 wrote to memory of 4364	3876	msedge.exe	87
PID 3876 wrote to memory of 4364	3876	msedge.exe	87
PID 3876 wrote to memory of 2188	3876	msedge.exe	88
PID 3876 wrote to memory of 4364	3876	msedge.exe	87
PID 3876 wrote to memory of 2188	3876	msedge.exe	88
PID 3876 wrote to memory of 2188	3876	msedge.exe	88
PID 3876 wrote to memory of 3152	3876	msedge.exe	90
PID 3876 wrote to memory of 3152	3876	msedge.exe	90
PID 3876 wrote to memory of 3152	3876	msedge.exe	90
PID 3876 wrote to memory of 2280	3876	msedge.exe	91
PID 3876 wrote to memory of 2280	3876	msedge.exe	91
PID 3876 wrote to memory of 2280	3876	msedge.exe	91
PID 3876 wrote to memory of 2984	3876	msedge.exe	97
PID 3876 wrote to memory of 4544	3876	msedge.exe	98
PID 3876 wrote to memory of 2984	3876	msedge.exe	97
PID 3876 wrote to memory of 4544	3876	msedge.exe	98
PID 3876 wrote to memory of 4568	3876	msedge.exe	101
PID 3876 wrote to memory of 1108	3876	msedge.exe	102
PID 3876 wrote to memory of 1108	3876	msedge.exe	102
PID 3876 wrote to memory of 1540	3876	msedge.exe	103
PID 3876 wrote to memory of 1540	3876	msedge.exe	103
PID 3876 wrote to memory of 1540	3876	msedge.exe	103
PID 3876 wrote to memory of 4356	3876	msedge.exe	104
PID 3876 wrote to memory of 3696	3876	msedge.exe	107
PID 3876 wrote to memory of 4744	3876	msedge.exe	111
PID 3876 wrote to memory of 2524	3876	msedge.exe	112
PID 3876 wrote to memory of 2780	3876	msedge.exe	114
PID 3876 wrote to memory of 3884	3876	msedge.exe	118
PID 3876 wrote to memory of 4712	3876	msedge.exe	119
PID 3876 wrote to memory of 2524	3876	msedge.exe	120
PID 3876 wrote to memory of 4524	3876	msedge.exe	121
PID 3876 wrote to memory of 3132	3876	msedge.exe	122
PID 3876 wrote to memory of 2660	3876	msedge.exe	123
PID 3876 wrote to memory of 1204	3876	msedge.exe	127
PID 3876 wrote to memory of 3808	3876	msedge.exe	128
PID 3876 wrote to memory of 4360	3876	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/itr2iZDS
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff5d40c188,0x7fff5d40c194,0x7fff5d40c1a0
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,2342494710557887832,9203705562293636118,524288 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,10892340265958913575,6899272183003360946,524288 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1492,i,5438809062554833417,5351409661143463983,262144 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,14965616486266643088,7839945659758574286,2097152 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,9870208558371344068,5967519981680530711,2097152 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,14674691043538388354,11652782803890068184,2097152 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,12199355351440145762,1894735328377745040,2097152 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,3179587944537087363,450151771506569309,524288 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,12369553922590484292,3578776780207499201,524288 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8589267379425837180,374977357170798386,524288 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8589267379425837180,374977357170798386,524288 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,5999701082353351224,5705648934615419708,524288 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5008,i,12514341423952642903,8487962027934071803,2097152 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,4589858471106685206,229542919068674076,524288 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:4356
- C:\Users\Admin\Downloads\snus.exe
  "C:\Users\Admin\Downloads\snus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Users\Admin\Downloads\snus.exe
  "C:\Users\Admin\Downloads\snus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Users\Admin\Downloads\snus.exe
  "C:\Users\Admin\Downloads\snus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Users\Admin\Downloads\snus.exe
  "C:\Users\Admin\Downloads\snus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2780
- C:\Users\Admin\Downloads\snus.exe
  "C:\Users\Admin\Downloads\snus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Users\Admin\Downloads\snus.exe
  "C:\Users\Admin\Downloads\snus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Users\Admin\Downloads\snus.exe
  "C:\Users\Admin\Downloads\snus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Users\Admin\Downloads\snus.exe
  "C:\Users\Admin\Downloads\snus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Users\Admin\Downloads\snus.exe
  "C:\Users\Admin\Downloads\snus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Users\Admin\Downloads\snus.exe
  "C:\Users\Admin\Downloads\snus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4012,i,2948840594079645002,5897223866617619044,524288 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,8143304246741499374,10340412063724141419,524288 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,9536064822110367637,13244635484118807231,524288 --field-trial-handle=2932,i,13905643204533306759,3780511400560235207,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:332

C:\Users\Admin\Downloads\snus.exe
"C:\Users\Admin\Downloads\snus.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4024

C:\Users\Admin\Downloads\snus.exe
"C:\Users\Admin\Downloads\snus.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1592

C:\Users\Admin\Downloads\snus.exe
"C:\Users\Admin\Downloads\snus.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18c5391f-ff91-45e1-8c98-67ce633741f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\18c5391f-ff91-45e1-8c98-67ce633741f5.tmp
Size 18KB
SHA256 94bf6fef235841263b59b436deed5578a999d401312d32c45c24dded632cf87b
MD5 7df421649b248fd585d366248bb6ba10
SHA1 b6bd0f52eaa0ebf8f0efa1481472996748054e91
SHA512 ca9d98da3d7d421d37b774cf67bd5b657890be1bf97f2e9216c4528cd9a33b09a67eb3edf6a81d2ba64e9e7e5d878df7bf4d075a59dac7f99a10f2f8387d6fcb
SSDEEP 384:RQkUSvhsNp4XqfbCxVh//Rj5d6H7vBEuYIIlo:DhR/L/zd6H75ETLe
TLSH
T123825C36A8B86C3B8FE3A650F04B3A139FB49157D6C91F94D5DDAF1C01DA29C234B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f923613-337d-47bd-8e8e-bd5565b58bea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2f923613-337d-47bd-8e8e-bd5565b58bea.tmp
Size 18KB
SHA256 9b2db91f7df80023daf1ce58e9284520dbb71974af32d5856264e138cc02fde0
MD5 fecc537af594195d45cfea3ee325d359
SHA1 db0708746bde7c1924e0caead3cebec35ea5c515
SHA512 bd75469ff6d7241f3f8c05ea4c30cd98979a8749eca843ab23315d23b8f6cf460009a5e1260a0a09e2807218b1e620cc224ccce993bbd4308ce9ea5e5214e9fc
SSDEEP 384:RQkUSvXsNplXqfbOxVh//Rj5d6H7vBEuYIIlo:DX8XL/zd6H75ETLe
TLSH
T101825D36A8B96C7B8FE3D650F04A36139FB49157D6C91F90D5DDAF1C01DA29C230B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3097cb2f-ef6d-4155-a9ef-8045535cb3f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3097cb2f-ef6d-4155-a9ef-8045535cb3f4.tmp
Size 8KB
SHA256 b06c6bfb2200acb7efae735e601e49fe4f6888fa48c194247ebabdcdd3c22b25
MD5 12e95644b0e2aed5d22fbbd8e8418216
SHA1 9c1670303acfc976ae7186de7cf41d2e8e9a34d0
SHA512 d3f85408ccebbf364461fad30295e8ffdd0022f5445386cdbfafb6379d227da44c50101c1ca89c79b527df6c154be1bfb5f3ccf60aacbede8d9d31ff8c4bc30d
SSDEEP 96:KqONkWQsjpfbUmjH5ih/cIPURHl8h4otop5UXaDUJBKP4v+Y1xf//ojduxfP7wF+:BONu6JUm0QmiUytIso//F7+BCQN4U6
TLSH
T19B02E939AC787C7B8EF39E45F08777239FA4116BA6911F40DAD92E1D01D725C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44c3d223-3724-4db8-973d-91f882d73e75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\44c3d223-3724-4db8-973d-91f882d73e75.tmp
Size 18KB
SHA256 6c6d8f431174ab03e33773269d36a3b9d81141300be3a9e23cebdbc3802bf48c
MD5 b4bd16999d8d9c27fc7c3956d2a607c3
SHA1 6b321aaa7fdfc6291aed702c7f15f907f516e035
SHA512 bbdf489a43eff1cff6483fa05aad61dd02b6a8e8e955da2b1c611adc60df84c04f4b7627239ac0abd17e61a93bf79a8d619933b96d4a15437a392e4350e511f5
SSDEEP 384:RQkUSvXsNp4XqfbOxVh//Rj5d6H7vBEuYIIlo:DXRXL/zd6H75ETLe
TLSH
T1E3825C36A8B86C7B8FE39650F04B3A139FB49157D6C91F94D5DEAF1C01DA29C230B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

486f7817-30e7-4447-955c-829a49d82392.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\486f7817-30e7-4447-955c-829a49d82392.tmp
Size 10KB
SHA256 22e4c301bd77650506b227716f471114bbae04394205d3d4110659ede6c61a57
MD5 bba5df0df1c985255ea414c53a039467
SHA1 d41060053353a297062dee7de3b5a3a87fb15a73
SHA512 c781c9d8107392f2bfd9201fe5b02e281995e4f5d34428fca5203d8723c9f7f46e3497e7e3294d8ddb8665efac854c1ef921df6c0b46a8e0b4de9bced5bfb5e7
SSDEEP 192:sxZjRL5p/fus/q0eIdpjlpHW6+WNeQvXY36OW0nIg5yJ:sxZj7p/fusy0PzHbRXX0s
TLSH
T1D022A656AE28697B8CCBE209FA15BF53E6F9503261D11E48A6FC8A1C05E77DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f76ffd6-0b1a-442d-9e8c-774c938b78d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f76ffd6-0b1a-442d-9e8c-774c938b78d0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 e4a53abacb0cffa948642e5337b891346e13492f793bb210d78388c5026e96be
MD5 7d6fe7f9620215774e3f7db1237bdfea
SHA1 cdc12052a597fcc3c4ccd55e90ca54c8efd85a92
SHA512 f44873418f283b45f38c3ba8fdaaffe11d72e8aca9d771d9fa6ef6a85ea5d82143244e9189779faec444d4fd44becd3b0139e13447cdf13ca64f073b625157a1
SSDEEP 48:EBfWl+9NUABwvKlpolzIlWYjEKzb1GKTWpZI0525rtc8/BxV+DkVSYrMVcK:EglANUAB0qolzwWOZzxGKcINFm8/Bmmi
TLSH
T1C49181CF97D90660F769767541DC7E8731776AC209A7BF8220C4EAB60806B4D84A3C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9c444aca1146d148183f31e6deae939ff4fd8c751d2a5b1a019c20578838f25f
MD5 ff071f5ddc680a43c33471a626dc1d02
SHA1 bc25d18c86db258a105ae75b90d525610189279b
SHA512 c0bb98553e362075c56d956cc83484d4181da426ac184ed6149018b8eeb6f1e2fd20d48af39179c4874dbaca68e36eb014e2d310295edde2bc433c393f41ff56
TLSH
T1B65174CF87D24450F75A7A7482EC7E8B31B759C24A8BBFC12494C9B71807F048821C98
MD5 SHA1 SHA512 TLSH

Submit Download

232316f6-377a-4135-a598-2642f94f240f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\232316f6-377a-4135-a598-2642f94f240f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b7e7061c-64dd-4384-b037-ff94b70ad253.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b7e7061c-64dd-4384-b037-ff94b70ad253.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e0b30bf0-666d-4dd9-bf78-e1245b92f5b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e0b30bf0-666d-4dd9-bf78-e1245b92f5b8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 668B
SHA256 b35e659ef4bd97a6721b2ed448c4d2d9b84996e65c0867e7f506a627b8e8980b
MD5 630f3cc9bb620d9f30a98bd11c30a808
SHA1 81900818ea51f162014409fd8a551bf984e916bd
SHA512 f4e59642c61db572a07a8aed5d6a5bf3953d1ad5315c5ee0d2c040435de71286b1ccfe230c47f90449d735f628bc83c45ff77ea8cc611945cddb4f27ac5d363f
TLSH
T1A701AC023C9B22502AFEB92440BFA61702816477361CEE7E3BBDC0DA0917E1119FC5C9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 bdc82cf4a4b62dc890afde313a3f3e700b030dbf11d3e35071c19d98a48baffc
MD5 1305ece012bbfebe9bcb3c15e4e5726b
SHA1 a9630eda4237a186c78f9387ec70633d0ab29976
SHA512 8ced35e2be1a1bb2211e0da219202d335087b0f74e70d5405a7e1db95cbd715f2021bcd2d402d4671b71415a43ad5f01b1e4a000bf12f957625f1a9e62b39163
TLSH
T1D7219C126D9722502AFDB528017FA61702827477321CEA7E36BDC0EA0A26E216CFC5C9
MD5 SHA1 SHA512 TLSH

Submit Download

a09e8af9-8f2f-43d9-a86f-f12b4e36a440.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a09e8af9-8f2f-43d9-a86f-f12b4e36a440.tmp
Size 10KB
SHA256 69d164650059cbf8e7e7511d8cf54c6f30fa7dcbd756728dc220b2aa74a93cf3
MD5 229c8e0daaaf09d12df0eef5b826029c
SHA1 c546f9870a150cbfd587cb0744340b5c2c593728
SHA512 8b198dc09786d987fba413e2201ac7795d100e5b312e88335c6fe0d1a97833c0c58bfc6f8bb5b6af1eb31d7b249052c292501e052ee44191b5cabeb21efd646f
SSDEEP 192:sxZjRL5p/fus/j0eIdpjlpHW6+WNeQvXY36Mb0nIg5AJ:sxZj7p/fusr0PzHbRXX9+
TLSH
T17322B852AE28697B8CCBD209FA15BF53D6F95032A1D11E58AAFC8A1C05E77DD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b41ee73e-f576-44d0-bb41-8bb5c74dd4a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b41ee73e-f576-44d0-bb41-8bb5c74dd4a4.tmp
Size 9KB
SHA256 699591e4bff75d1a537e6c15e02198cf3e4e80f6514c18c6f23723cacda1b97c
MD5 4b6ef752dc3ad8906264f9858f7a6824
SHA1 7eb6bff93209c822a02d84f6a0c3056d494765b0
SHA512 406156da6a9a6b0d498eced6edba28119ff4ab4c6236302a042575a9d0eb6179fb1a7fa0b1b823f2fb20fe4b1722019775143a4ceefb41abaf4b9c049a96c9bb
SSDEEP 192:sxZjRLnp/fusDj0eIdpjlpHW6+WNeSa/Y36Ob0nIgrJ:sxZjVp/fusn0PzHb2/XH9
TLSH
T13022A8526E28A97B8CCBD20DFA15BF13E6F95032A1D51E58AAFC8A1C05E76DD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd452a3f-409b-49d3-9592-7f0de261143e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd452a3f-409b-49d3-9592-7f0de261143e.tmp
Size 27KB
SHA256 a8aaccafa314cd4200e97e84b8272f294dbd2b58d0c05b888f6417ee4ca9a25e
MD5 e669b45429c5f62757eb6b3f80dccd55
SHA1 378de1ec9e3e4c896377f98a8d4c3fea661df550
SHA512 327fbbfe76f5e8bd12b0c6dc87f940371afc080b4ddbf67256a9057dfdc42cb10fe95a69b267791db327b62957ecffb3469947e14969b6788701019168ea31ec
SSDEEP 768:jPKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/EroG9:jPKlm7QWvUYe0u1ja8/L/E/PG9
TLSH
T1B0C2FA3B640CCB7E4FC05E9DDC5A6F976EA802C7A6588D4047FA984C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb8ed2a6-5a37-4f7d-bdf7-83f4e637a7d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bb8ed2a6-5a37-4f7d-bdf7-83f4e637a7d2.tmp
Size 8KB
SHA256 0f793e0e4f84c93950b0b20b159c1162184e9d41eda0717f580898e51783965b
MD5 05bd4cb7453961bf0f2813a73255c758
SHA1 602393fd9202c0c6238f15362d12656a52fdfb95
SHA512 a0ba767394c556c43e3204aaf19d8215630b94217f48ba683c95d1135d2ab725fb09f7dd69947b3d29b60585aa3e92c1c054db4200128d4df7dbaa2233fc6cb8
SSDEEP 192:HONM6JUpQmiUyAIno//F7jfezWNxQaSqZ4U6:HONM6+Hwno//RjFd6U6
TLSH
T1FC120B35A8B8AC3B9EE39994F48336139F744267E7C96F50D5DD2E1C01DB19C130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c6ea987338d7bce4e3c34ddec2f35e5ec0738b8a1223bbc0d7a8ee9ead69dff2
MD5 ca99a396fed7243ed5d22f1a2b23a8cb
SHA1 976e5a17f9259f756182d894d9600ddea927e36c
SHA512 d3b78093aeb3680f660d35486cd9715b7f68f66acd62379490d90f3786d3396122b645863543d715ecb336f2b4796bc6ab4fcae015a77fe3f6a0716be866e09c
TLSH
T1C341166CB6E91148B3B76F1A9FF6A86E447E79372E0BD45D10110D4F0662B44C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

f9cc8da2-02b6-4e69-ad1f-2ef37350fecb.tmp

Path C:\Users\Admin\Downloads\f9cc8da2-02b6-4e69-ad1f-2ef37350fecb.tmp
Size 15KB
SHA256 08f6c2d8f7f027970e19712053e1df74da7d77169d17738a6c73310c98e17afa
MD5 3bf3093eccb8de15dcd73c3f24af3202
SHA1 9196ed0af66a69525cbc3a376ef70ba55c139577
SHA512 7261c4c57dc6261264dccbdca68565190f705c375bcacb5a888ef6cfb98ae735b860c46086b9b09fa87f16b236fad2476300a66cddeed4f7a3c416cdaa9d4a06
SSDEEP 384:ex3ptab9KPw8QMV+kRYJYDg3FJWDefJjQD275:437ab9KP1f+kvE2W+k
TLSH
T1E562D79D955C64A5E4CBA273D22A4FF85119220E13E86AF71147F43E9313FE41E32EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snus.exe

Path C:\Users\Admin\Downloads\snus.exe
Size 6.3MB
SHA256 c668804330621bdbf978204192720aae497822eadeab2096fbdf27b83d38e19d
MD5 90ffc4e0164b3c57732687d804cbc09a
SHA1 d1344f28a234a41684b33471ef51b38cedfb28e4
SHA512 dae66dd048c341d2a51ec978343355e151616a9b5db3380f80532f64800047ac78b15303f2f8d2b14e5c3b44489770bac7d095683589a4e426b8e82d8a03e7e8
SSDEEP 98304:J6qQ042onSRHIJTzXqZMg9FNhfVXpEm/tvmoATIwsF32v+WR0:fQ0jUSRH8/aZMg9FNhfVXpEm/gvt
TLSH
T10C669DA9A6BC00D5D4ABC1BCC2465227E772B49517B057CF1A648AFA1F23BE01E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download