hxxps://drive[.]google[.]com/file/d/1y9cx7kxZMVECfX1Td2Tpw8EUlbf2iNyl/view?usp=sharing

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
11-01-2025 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1y9cx7kxZMVECfX1Td2Tpw8EUlbf2iNyl/view?usp=sharing

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
4512	7z2409-x64.exe
3896	7zG.exe
1324	Gorilla Tag.exe
5628	UnityCrashHandler64.exe
6072	UnityCrashHandler64.exe

Loads dropped DLL 15 IoCs

pid	Process
3288	Process not Found
3288	Process not Found
3896	7zG.exe
1324	Gorilla Tag.exe
1324	Gorilla Tag.exe
1324	Gorilla Tag.exe
1324	Gorilla Tag.exe
1324	Gorilla Tag.exe
1324	Gorilla Tag.exe
1324	Gorilla Tag.exe
1324	Gorilla Tag.exe
1324	Gorilla Tag.exe
1324	Gorilla Tag.exe
1324	Gorilla Tag.exe
5628	UnityCrashHandler64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
3	drive.google.com

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	Gorilla Tag.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2409-x64.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5704	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Gorilla Tag.7z:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 764768.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
3140	msedge.exe
3140	msedge.exe
4076	identity_helper.exe
4076	identity_helper.exe
2104	msedge.exe
2104	msedge.exe
2572	msedge.exe
2572	msedge.exe
2600	msedge.exe
2600	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5704	powershell.exe
5704	powershell.exe
5704	powershell.exe
1324	Gorilla Tag.exe
1324	Gorilla Tag.exe
5628	UnityCrashHandler64.exe
5628	UnityCrashHandler64.exe
5628	UnityCrashHandler64.exe
5628	UnityCrashHandler64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	3896	7zG.exe
Token: 35	3896	7zG.exe
Token: SeSecurityPrivilege	3896	7zG.exe
Token: SeSecurityPrivilege	3896	7zG.exe
Token: 33	5496	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5496	AUDIODG.EXE
Token: SeDebugPrivilege	5704	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2948	OpenWith.exe
4512	7z2409-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 2672	3140	msedge.exe	77
PID 3140 wrote to memory of 2672	3140	msedge.exe	77
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 4708	3140	msedge.exe	78
PID 3140 wrote to memory of 2900	3140	msedge.exe	79
PID 3140 wrote to memory of 2900	3140	msedge.exe	79
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80
PID 3140 wrote to memory of 736	3140	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1y9cx7kxZMVECfX1Td2Tpw8EUlbf2iNyl/view?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe52043cb8,0x7ffe52043cc8,0x7ffe52043cd8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1652 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4372
- C:\Users\Admin\Downloads\7z2409-x64.exe
  "C:\Users\Admin\Downloads\7z2409-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7940 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8000 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,18408082334564063299,10504941085049787910,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:576

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Gorilla Tag\" -spe -an -ai#7zMap14054:82:7zEvent30
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Users\Admin\Downloads\Gorilla Tag\Gorilla Tag.exe
"C:\Users\Admin\Downloads\Gorilla Tag\Gorilla Tag.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1324
- C:\Users\Admin\Downloads\Gorilla Tag\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\Gorilla Tag\UnityCrashHandler64.exe" --attach 1324 2494832840704
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5628
- - C:\Users\Admin\Downloads\Gorilla Tag\UnityCrashHandler64.exe
    "C:\Users\Admin\Downloads\Gorilla Tag\UnityCrashHandler64.exe" "1324" "2494832840704"
    3⤵
    - Executes dropped EXE
    PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Read-Host 'WyvernUnbanner You will have to enter your license key to authenticate you. Enter Key'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5704

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
88518dec90d627d9d455d8159cf660c5

SHA1
e13c305d35385e5fb7f6d95bb457b944a1d5a2ca

SHA256
f39996ab8eabdffe4f9a22abb1a97665816ec77b64440e0a20a80a41f0810ced

SHA512
7c9d7bd455064d09307d42935c57de687764cf77d3c9ba417c448f4f2c4b87bcd6fea66354dfe80842a2fa3f96c81cc25e8bf77307b4ace1bbe1346cbe68435f

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
c4aabd70dc28c9516809b775a30fdd3f

SHA1
43804fa264bf00ece1ee23468c309bc1be7c66de

SHA256
882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863

SHA512
5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
696KB

MD5
d882650163a8f79c52e48aa9035bacbb

SHA1
9518c39c71af3cc77d7bbb1381160497778c3429

SHA256
07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff

SHA512
8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
17KB

MD5
a7c5d90fc9b7b041c7e5e0281e1c6ebb

SHA1
dbc8cb772a6c41987b0f5adad1c79eb4a6769948

SHA256
d82662b572d7670968efa08a872326b4f9d84b5425da7c122bc760674406b84c

SHA512
eceaf3343ba549644c3874758ba8223b6188b9011052bf626d94361b8460e86caf7442cbdf6a5ab80e83e1d33ac606592718de2e9c156a535f6b01670d937921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
bccd3182ebe0e8515b953cfb2fbf9d57

SHA1
ee3d43db538646d06d8d7fc7b635db9409cc25f4

SHA256
87cb76dddc0947cbef34a276dbf931b17cafc93d9bea10145e6471e11ad58f78

SHA512
269ecee9e118f7dd47b8faa302050c8db016a6096630d22a9819a6cd1ae767bf5297b8d39c507bad1d9330bae655e18ab110950f12dcf6e99f45bc656abf3b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
053cdef4313238e92b7a9a61d8a4962c

SHA1
086a386e9b0f95f4ab9fe4f39193e226d5a0fa09

SHA256
2b97cec9bb152e258607495be540b1c0cf3c1432702ad8f5e59f0b9f4b17b333

SHA512
bc857a9aa3a4dc52cfc2e2357ee0ea9f60fce1e1ad1badb23aa7d10c94d87c7796681985863341844c9a1a669752ebc8cec44fc128b6b6ee2028eb7049978f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
830e063c444ef7a8f3279d22188f73b1

SHA1
6c1cbf107871a0dd2e488f30fd753098970c247a

SHA256
433a149caa0954157e453db3c9a793f46aeea5ab3c6b2fc121aec5ae79db5d7d

SHA512
453941b29541516773c944e56d7febd7c0f7587a1331942b17da59d8164e8d3136a9db4798113445628cdbcf6e646bba30c954069798d3a21191d7038cde5206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
9dd7c0e8ae1261840bdbd3f36b9aa496

SHA1
bb615998b14397e9afadc5f7c6907cf83a071440

SHA256
efb009ac7d74b1dd599ebd9b28a4fcfde791a43225643e612abd84bdcc5afe03

SHA512
87f9ea2b65c52a02977598501a7454e4ca6188c54c80f04767ec667672bd0bc3200528a6da331ecb4b5c891b95af130db02f28b8ab97f7cfa0801d2b94ccda86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64a5a62f00fc763b31412b70d037fc9e

SHA1
130594e0175025c7e068f1d7be1fad68225e5c3b

SHA256
77f8a216eb6f3290e1791ac345e55eda51b833289200093fb5023453096a5c40

SHA512
6dd52c263c3d3f3c868ea02aa720e258b8105c36bcf49534b84713f19c074aa41de6050b1b91bd2dfae285652c19be22a3a533b83e0a07ac0587ff74f4b25663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
29e401c24407771a08bf751abdcc02f8

SHA1
0997f34fe1d563f027b425be722c56acf36eb614

SHA256
d68c90fd9981877ac8b79ed152bfb4afc7d9bdf0e1d68f15e2da8aa5557f7ed2

SHA512
2f72edb50382ce1e0f671d448982dfd4de59b0a4932227b62c56826731df8c541c2a0b4894452b2839a75f7e2dff2b32688318b3fbbd343facfc46ce360a6498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ffddeffea989d3078dbed718b40d6cf4

SHA1
bf351de5b0c9296ba4eab980974328d7a71e9c06

SHA256
a428f85acf39cc57281655ef608bd2d7b1ec779cdf5531dce1955c20175ef005

SHA512
d45908d6e7e44ada6953be32477810ee80bfc68acaf267b234192147a89f6dd3f19be36fd0d9db811dd0843421ab614eda7f34f0299b6c2a0c599de8fdba78cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
866a32e750385714b245c3f0bb8e6087

SHA1
3359d820c2ccd402f22cad58561f3d5337f360c6

SHA256
c28d0d4f040bef7690994441ca7efc39891334ccd4d127beeaa8b3bd46d03029

SHA512
d3c09e246623787b1a60b88f3d58a2e06e956ffd1ca874e9ba5ad8d99358d33b0884e15bd62d6d9456ebb60cabad878abb4cf2f877d8a85e85e5aadd276f83c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
65284ce6972f05982301fe5f9159bcf1

SHA1
6eb4689fd3c526034c88e159db40b723ea14da2b

SHA256
18c36e6666a9ebaea81761cce231bc8c34819eaf4e64dfa1df0f6728551209e8

SHA512
ec22265c257b24e401e2da6eb0478c5b191035788450a7b9e69d557359daa0e3140543adb2735baadb0ab80a23bf55b2af355e3648570cec95f9cb2635e52d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4c842ebd2f6620b7ada0cb2aef636851

SHA1
dc804edbaa925f30b3641dfd994dc8ba5ba6066e

SHA256
4335354eee223d0045d8a0dfdc8433000878fd3c9835d83f48d67dbbd521f6bb

SHA512
26daa631484c87f285062c166a10d04763ce044cfd0c8d51d7373bc6932e28d3838cc7a658c18218eb623e2cf226af7c1887b32e10c077a92eeb4cfccd4b7077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5cd307.TMP

Filesize
1KB

MD5
86cd097c1fcbe2a7c4696d5d08b979fe

SHA1
b09cc7bd2963f961dce9e52571b81ebf509d1a66

SHA256
e49630d021af5eaf0c1ac061c6795b90957f2e5e81af9cae51bd1c4717ea9733

SHA512
e4e0ce3d584495c0ddd4097221f568122e8011f1f145546a31bbd0fb5f8a95306ae9b5da1bb4088a643f6b3099d24e81589f5b75a57614a936c437d63632b39c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
60b819af8e5fabf2041360e51b54d56c

SHA1
48ad0de070a56567a48449c837b2e39faf84ac9e

SHA256
a866cf0ed81d1e9e598f37db90bccbce35164acadbe0e09a89f5ca3a061a7e83

SHA512
d607f5fe3965fdd9081a3a3c96dc2b64a2aa995bfaa502d768ecb0724f78965aed1f3877438adace668c6977e69b55a2d7dece87d609266be04d8b997496179e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
85b9073cc21b876131b22b7884bd140c

SHA1
a48addd5b70d551a9594dc6200b7f0123a4c1ce8

SHA256
4516100f0b28c640fd87f166831524260e2783bf51ac27cf85e7ef93b77795d4

SHA512
ed9ab810cddfd9995ef67946e9cf4a45cdab7dc8b4cd4ea87070ee6752b9d62c892ccbf6453a6e8a4d551b3f537ec81e8e968f325d0cf2d852681c6f05d8baca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
40ff2c70bdda27e9e25df8254ca2325e

SHA1
c4293ebccc8d5d9bbf40b5ada5c6c770db7a2ecb

SHA256
32ff318f5af854562a4d0cb8de680093fa6115fbb23c64c0f56baf54acb5b12b

SHA512
5856da10b197fc71c2705fb0ee15f9345d3f76c206ce8baf2f86af6b6db555dcfdc5cb1c00e1b12f338652286c8fb68aa47728b8969b208e7e202f59f2dea421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
63fc5618589c043c0c9f0c6d0b54cd2c

SHA1
a30000ee2c7f2cf39e3399abede869aa3834be25

SHA256
f5038eab4a2f0f5fc90c94856f3b02a053f5aa78d0e4ea12f771ea96173e77dc

SHA512
777f4b48531d1b2ac88d4d7dc73f9b5b414056fd1f9d48a49fc349d38a6ce8d120205b8d17cf0f8232538d0da610edae37be0a7cad413baf05a858c83858773c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_433nkjtw.5yg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag.7z:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\BepInEx\config\BepInEx.cfg

Filesize
2KB

MD5
1b9a983490aa94f268a13332c4650a7e

SHA1
c9e0529f83581b3e30a369959d780893a7030a92

SHA256
0ec53056b312b1f44499e5f504c8b473bc6e1c282f8b28d19f690c65aa6365e3

SHA512
bd0e09bbe2540e2cfbdbbf03bb11f1b96056603a7c70c962baba5a207ff1fcce9a15ffd0801056e6f16fbb9cee6040c7128bad039877ee703cb6ba8b251cef4b

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\BepInEx\core\BepInEx.Preloader.dll

Filesize
41KB

MD5
b0df694c373fbda5be068a407ed8d1d4

SHA1
5514c4cbe2270e8fb4e3c31e46b793fb940ac1a8

SHA256
116f8b879b1b87566f5ce30106fc5d5718da69d3870315d184a4460379a765c7

SHA512
c9db37ae84e6cea8086b69ec650a6545a13a318725bea1280e07deca7b7edb20c38f3870028dd5bbb70eb7f7d9a24469a743fe6e8da21163eb6160ad4b7a2122

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\BepInEx\core\BepInEx.dll

Filesize
124KB

MD5
a7d497dac6ba93cd93acae43f35d408b

SHA1
45abef98afe654aca3cca103900bc3db82b8c4ad

SHA256
c65b42034bc8ffb9f0b336e416dc3884e3f99fc5a5a89eb1f2ff7868412322cd

SHA512
efaa782efdb7c71f122871dad12ac2f0a4bd47239d1d91a4e5a8889102c09d5a6306561ce8b35c609ab4a443e6c222e4c18a3b903315c59766a93de953c6a569

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\BepInEx\core\Mono.Cecil.Mdb.dll

Filesize
42KB

MD5
5a8b48fcf5e445095799e2c9149ff932

SHA1
d4c514fbac7a30ddee7d0f597c3eae23a32ccedc

SHA256
5896d1898f616701fff18f3b2c71e6b844d2390ef9f41e1c5fccce8cb27c698e

SHA512
b99b02f296e5c817b8f984317e67c885099a3cc1198ee1808a0033b48ef60d27866719f0986d7f9a1ad547939bf6dc1886e858b9db7ba4375013b96db31957b6

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\BepInEx\core\Mono.Cecil.dll

Filesize
331KB

MD5
50ae8a86b701c83fce3a814ae8d79321

SHA1
7c8b821367897baa1b78157d5cea0767f424bc40

SHA256
7ae470288fff4a402899c254d0a76cefef55877f5c54f96e83c797cc5bb6e2f6

SHA512
04b57207d4fd9fa9f1a71323ea803f023b4b0f2f7a7070bf431806c7a7f41277969c0f5979ecf134812001b47f5d36ec8e8541982473287323e783b3ffe93121

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\BepInEx\core\MonoMod.Utils.dll

Filesize
183KB

MD5
96c7b1340105a3b86f3e8d19a844903a

SHA1
bc258633aab1a2a1839dcc44eed944d865fd6038

SHA256
9d1495f147ac93c4f81f84538c1a326e8f8a6aefc78d6289d798f3ce1162c5e9

SHA512
36706eb655c995d81aa731c067912452a566ef5b752effdf212603aa0099e28de56588191acced82fb97aeae33df06f229d8cbed969c92cf9b8d439d04c223de

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\Gorilla Tag.exe

Filesize
651KB

MD5
96f469bc1ad1ffe1a66fd2f0339a57a3

SHA1
6e0559a8ce322a795c1cd8787967c0f6dd09e804

SHA256
27fb5aa684dda1deaef7735d18d9df92c616cd9216d47f7a050293194c97176f

SHA512
b36bca90a78c9d18c9fa944c844e8992f02b353750b1f63760b44d9eae036dde507ed492f6f798f3870ba5692461b9f5a5da9e439eb903b8fb15344e7fe554ab

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\Gorilla Tag_Data\Managed\System.Core.dll

Filesize
1.1MB

MD5
2f1eab1e7beef8c37fd508f7216dc14f

SHA1
77c907ce5147ca065bfe9f78e1a06bcb81cb03e1

SHA256
5250334c8af57a92690da69acb662e665ab8001d02ceb38c5010b28eca93c9f0

SHA512
48f982e696fb02275283f7c6c7cc034ab91375c884085577f7b32d4ac65db79eda9942cacea0bc48f19e964b6ce14be983dc8947492be89951d041b8a9bf98f0

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\Gorilla Tag_Data\Managed\mscorlib.dll

Filesize
4.4MB

MD5
87f93aecf04f9e65205ade77353afb68

SHA1
1ae268e275d60d08a9a5bc61305654c35eacefb0

SHA256
7533eaf81e6442f0b61c338070e639cf36590d2e1fc27bf038cdee30320bdd46

SHA512
2e704762eeb8c08af814b7f839d91bf38aef5560f40edf43f2f56069012481bc8a58fc5baaa4663352872df1f670f2e993655563a200c3eaefc56dc87f1fd624

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\Gorilla Tag_Data\app.info

Filesize
25B

MD5
6be3ac14897729b8f4c837b3a18694ca

SHA1
c407ba7a2439819035ac8fc34756f7942f9d2f5a

SHA256
1517749f589e05549598043cdf04a90f9d0fe42ee99353f8ec660711303f8c15

SHA512
d4b1a7a259c38a6e741a49a0767a0cf4f2dd416ddad2ef695156597296fb1a1069a2aed05223df0dcc0849c7d1380b594e1c55ed3debaa90e73bf35bc19e7606

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\Gorilla Tag_Data\boot.config

Filesize
165B

MD5
5432e3fb7e58c436c6fe71e40a526536

SHA1
7e14f8e6597045c4f4bb0d6fb8ed4e1509897f82

SHA256
1a71e4617ebc24e049271fadabbbb8ba1ee013ff620012d490b429971265377f

SHA512
283b05a3ed1673f3e5181e0ee39f92b925460562975338f895af8e7bd51da2783a4da213c6700f3d0101000984e59b81bfc86f1120432709715d7f061c65da80

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\MonoBleedingEdge\EmbedRuntime\mono-2.0-bdwgc.dll

Filesize
7.4MB

MD5
40636d9373d6cb506302e1b824131a4d

SHA1
391bf63091480917d2eeb2121d918db4847ab9b2

SHA256
aa9359eedfdca730d07fbeab66172347d8f9938e3f9f4604d505043855b9c80d

SHA512
b9e91f1bed484b5c9957af5e982e17504a81678bf7af137108a0c463f42fca7fc968ea49a1f8f12d9bdee1b99c0fbe1219c9559016738396efd556a30758a9a0

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx

Filesize
59KB

MD5
f7be9f1841ff92f9d4040aed832e0c79

SHA1
b3e4b508aab3cf201c06892713b43ddb0c43b7ae

SHA256
751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

SHA512
380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\MonoBleedingEdge\etc\mono\config

Filesize
3KB

MD5
67611b783439b35abfe05a97413bba46

SHA1
52795ffda8b88701793acc05e87897bdba99a633

SHA256
5776169973a26a387b8b3e5c0f2301a7ab9a6dd7c7d3efa22a96abc47fbf8662

SHA512
046dc9fe5cb46bea23668eb0d9742d32ddad30a6ee85c20839b68cb022f9e2ae6a38b87b9e267edb152b29420e3d169348cd9d3bcd4a7c7d82b3d50ac24b4748

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\UnityCrashHandler64.exe

Filesize
1.1MB

MD5
8d8b0c1ce7c59096c84938eb2127bc06

SHA1
b73017e6aa8f90916e5bc1f9d1477e33c10261e9

SHA256
598587247f628861d542143885749e3c139e91ed35563ed9eb278b2684039213

SHA512
5b7c27a6d9fcca72079fa12f392429386734fa7756b85103cc0b9940a0f5b2af5a1100b873a871436a08b0ad1622c12af76cf70efada1952cca42155060bec33

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\UnityPlayer.dll

Filesize
29.3MB

MD5
171856aac50f39a6f3805ab75f6222c4

SHA1
64b1218742e2bc1d02755abd2e435285b3307a65

SHA256
97f2e1d9d502feb07614d725c0a1efaaa36feaf69249d848bdf2495ef4658409

SHA512
a398c96e8a6bfaa80c854eac819c63a6d55eb4ef750f6902f49e4b08dee4366d4569529d7e6870f19ac5a28a7b10e2a36bdbac2fe3a35842b50ae91d2df02e09

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\doorstop_config.ini

Filesize
1KB

MD5
387896b4ba25b5a00568e92165c1bd01

SHA1
7a21f8110f36dd3beed80393e584772be7a98918

SHA256
4d5c6dfa0f771c6a5b1b0c559aca0bd0ece7d08b08fff894708dc3b73ce73cfc

SHA512
81461e8ad50b2fac073179d51181a26ce102cff227933abdc73808c10f66419a5f7d5be64366bd687c59da8eb5059781c6f7d7e2aa817e2d74f6e13ca92dc928

Download Submit
C:\Users\Admin\Downloads\Gorilla Tag\winhttp.dll

Filesize
25KB

MD5
b2a4d0cb04bf8f5a27ccab237ecc2586

SHA1
c305de177f4193558d2a9a7a8cddff21a0db7f8e

SHA256
d3b62f4c9c3e2196ef82603c52d6b98c043a0d6c125c081fd33d7ca3798b41b8

SHA512
1b2e91ae3a636746aab68cbaccd0c4fba98cf434ad710d2fb9c0985b458fbb3724dc73ae209e2a7db1d48555bd7733c721775e5b0d3d901e80f0d7eba7e7d8f9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 764768.crdownload

Filesize
1.6MB

MD5
6c73cc4c494be8f4e680de1a20262c8a

SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

Download Submit
memory/1324-1582-0x00000245A3530000-0x00000245A3540000-memory.dmp

Filesize
64KB

Download
memory/1324-1594-0x00000245A3610000-0x00000245A3620000-memory.dmp

Filesize
64KB

Download
memory/1324-1572-0x00000245A3510000-0x00000245A3520000-memory.dmp

Filesize
64KB

Download
memory/1324-1571-0x00000245A3510000-0x00000245A3520000-memory.dmp

Filesize
64KB

Download
memory/1324-1578-0x00000245A3530000-0x00000245A3540000-memory.dmp

Filesize
64KB

Download
memory/1324-1577-0x00000245A3530000-0x00000245A3540000-memory.dmp

Filesize
64KB

Download
memory/1324-1574-0x00000245A3510000-0x00000245A3520000-memory.dmp

Filesize
64KB

Download
memory/1324-1581-0x00000245A3530000-0x00000245A3540000-memory.dmp

Filesize
64KB

Download
memory/1324-1584-0x00000245A2370000-0x00000245A2380000-memory.dmp

Filesize
64KB

Download
memory/1324-1583-0x00000245A2370000-0x00000245A2380000-memory.dmp

Filesize
64KB

Download
memory/1324-1589-0x00000245A33E0000-0x00000245A3400000-memory.dmp

Filesize
128KB

Download
memory/1324-1590-0x00000245A33E0000-0x00000245A3400000-memory.dmp

Filesize
128KB

Download
memory/1324-1593-0x00000245A3610000-0x00000245A3620000-memory.dmp

Filesize
64KB

Download
memory/1324-1573-0x00000245A3510000-0x00000245A3520000-memory.dmp

Filesize
64KB

Download
memory/1324-1598-0x00000245A2200000-0x00000245A2210000-memory.dmp

Filesize
64KB

Download
memory/1324-1597-0x00000245A2200000-0x00000245A2210000-memory.dmp

Filesize
64KB

Download
memory/1324-1602-0x00000245A3610000-0x00000245A3620000-memory.dmp

Filesize
64KB

Download
memory/1324-1601-0x00000245A3610000-0x00000245A3620000-memory.dmp

Filesize
64KB

Download
memory/1324-1570-0x00000245A3510000-0x00000245A3520000-memory.dmp

Filesize
64KB

Download
memory/1324-1613-0x00000245A3610000-0x00000245A3620000-memory.dmp

Filesize
64KB

Download
memory/1324-1612-0x00000245A3610000-0x00000245A3620000-memory.dmp

Filesize
64KB

Download
memory/1324-1617-0x00000245A3610000-0x00000245A3620000-memory.dmp

Filesize
64KB

Download
memory/1324-1616-0x00000245A3610000-0x00000245A3620000-memory.dmp

Filesize
64KB

Download
memory/1324-1569-0x00000245A3510000-0x00000245A3520000-memory.dmp

Filesize
64KB

Download
memory/5704-1638-0x0000027B4D0F0000-0x0000027B4D112000-memory.dmp

Filesize
136KB

Download