hxxps://officialgorillaworkshop[.]neocities[.]org/

Analysis

user interaction
yes
max time kernel
134s
max time network
138s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/09/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://officialgorillaworkshop.neocities.org/
Sample260919-vgrhcsvtft

Score

8^/10

discovery persistence pyinstaller ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
250	948	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
6028	GorillaWorkshopInstaller.exe
2068	GorillaWorkshop.exe
5920	GorillaWorkshop.exe

Loads dropped DLL 45 IoCs

pid	Process
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe

Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
523	raw.githubusercontent.com
562	raw.githubusercontent.com
655	raw.githubusercontent.com
681	raw.githubusercontent.com
510	raw.githubusercontent.com
653	raw.githubusercontent.com
678	raw.githubusercontent.com
498	raw.githubusercontent.com
511	raw.githubusercontent.com
531	raw.githubusercontent.com
599	raw.githubusercontent.com
501	raw.githubusercontent.com
505	raw.githubusercontent.com
507	raw.githubusercontent.com
555	raw.githubusercontent.com
636	raw.githubusercontent.com
669	raw.githubusercontent.com
481	raw.githubusercontent.com
626	raw.githubusercontent.com
682	raw.githubusercontent.com
554	raw.githubusercontent.com
589	raw.githubusercontent.com
577	raw.githubusercontent.com
644	raw.githubusercontent.com
668	raw.githubusercontent.com
482	raw.githubusercontent.com
486	raw.githubusercontent.com
530	raw.githubusercontent.com
605	raw.githubusercontent.com
657	raw.githubusercontent.com
665	raw.githubusercontent.com
686	raw.githubusercontent.com
480	raw.githubusercontent.com
491	raw.githubusercontent.com
506	raw.githubusercontent.com
615	raw.githubusercontent.com
652	raw.githubusercontent.com
520	raw.githubusercontent.com
536	raw.githubusercontent.com
594	raw.githubusercontent.com
603	raw.githubusercontent.com
660	raw.githubusercontent.com
689	raw.githubusercontent.com
515	raw.githubusercontent.com
534	raw.githubusercontent.com
595	raw.githubusercontent.com
598	raw.githubusercontent.com
630	raw.githubusercontent.com
683	raw.githubusercontent.com
628	raw.githubusercontent.com
642	raw.githubusercontent.com
650	raw.githubusercontent.com
538	raw.githubusercontent.com
487	raw.githubusercontent.com
513	raw.githubusercontent.com
582	raw.githubusercontent.com
621	raw.githubusercontent.com
548	raw.githubusercontent.com
586	raw.githubusercontent.com
614	raw.githubusercontent.com
502	raw.githubusercontent.com
593	raw.githubusercontent.com
596	raw.githubusercontent.com
601	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GorillaWorkshop\GorillaWorkshop.exe	GorillaWorkshopInstaller.exe
File opened for modification	C:\Program Files (x86)\GorillaWorkshop\GorillaWorkshop.exe	GorillaWorkshopInstaller.exe
File created	C:\Program Files (x86)\GorillaWorkshop\test.png	GorillaWorkshopInstaller.exe
File opened for modification	C:\Program Files (x86)\GorillaWorkshop\test.png	GorillaWorkshopInstaller.exe
File created	C:\Program Files (x86)\GorillaWorkshop\icon.ico	GorillaWorkshopInstaller.exe
File opened for modification	C:\Program Files (x86)\GorillaWorkshop\icon.ico	GorillaWorkshopInstaller.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5468_480720013\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5468_792615611\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5468_792615611\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00080000000285e0-996.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GorillaWorkshopInstaller.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3108	msedge.exe
948	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343106960361976"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-686476835-2493921010-524562731-1000\{A65238A5-1D75-491A-920C-4EC8042AA535}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-686476835-2493921010-524562731-1000\{3C051E5C-1954-412D-81A3-86A4854B6522}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5920	GorillaWorkshop.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5468	msedge.exe
5468	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5920	GorillaWorkshop.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
5920	GorillaWorkshop.exe
5920	GorillaWorkshop.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3296	2152	msedge.exe	87
PID 2152 wrote to memory of 948	2152	msedge.exe	88
PID 2152 wrote to memory of 3744	2152	msedge.exe	89
PID 2152 wrote to memory of 3744	2152	msedge.exe	89
PID 2152 wrote to memory of 3744	2152	msedge.exe	89
PID 2152 wrote to memory of 1540	2152	msedge.exe	90
PID 2152 wrote to memory of 1540	2152	msedge.exe	90
PID 2152 wrote to memory of 2172	2152	msedge.exe	91
PID 2152 wrote to memory of 2172	2152	msedge.exe	91
PID 2152 wrote to memory of 2172	2152	msedge.exe	91
PID 2152 wrote to memory of 2316	2152	msedge.exe	92
PID 2152 wrote to memory of 2316	2152	msedge.exe	92
PID 2152 wrote to memory of 2316	2152	msedge.exe	92
PID 2152 wrote to memory of 3500	2152	msedge.exe	94
PID 2152 wrote to memory of 3500	2152	msedge.exe	94
PID 2152 wrote to memory of 3500	2152	msedge.exe	94
PID 2152 wrote to memory of 3968	2152	msedge.exe	95
PID 2152 wrote to memory of 3968	2152	msedge.exe	95
PID 2152 wrote to memory of 3968	2152	msedge.exe	95
PID 2152 wrote to memory of 3036	2152	msedge.exe	99
PID 2152 wrote to memory of 448	2152	msedge.exe	100
PID 2152 wrote to memory of 3036	2152	msedge.exe	99
PID 2152 wrote to memory of 448	2152	msedge.exe	100
PID 2152 wrote to memory of 4940	2152	msedge.exe	102
PID 2152 wrote to memory of 1640	2152	msedge.exe	105
PID 2152 wrote to memory of 1640	2152	msedge.exe	105
PID 2152 wrote to memory of 1640	2152	msedge.exe	105
PID 2152 wrote to memory of 3124	2152	msedge.exe	106
PID 2152 wrote to memory of 3124	2152	msedge.exe	106
PID 2152 wrote to memory of 3124	2152	msedge.exe	106
PID 2152 wrote to memory of 4140	2152	msedge.exe	107
PID 2152 wrote to memory of 4140	2152	msedge.exe	107
PID 2152 wrote to memory of 4140	2152	msedge.exe	107
PID 2152 wrote to memory of 664	2152	msedge.exe	108
PID 2152 wrote to memory of 664	2152	msedge.exe	108
PID 2152 wrote to memory of 664	2152	msedge.exe	108
PID 2152 wrote to memory of 5004	2152	msedge.exe	109
PID 2152 wrote to memory of 5004	2152	msedge.exe	109
PID 2152 wrote to memory of 5004	2152	msedge.exe	109
PID 2152 wrote to memory of 4320	2152	msedge.exe	110
PID 2152 wrote to memory of 4320	2152	msedge.exe	110
PID 2152 wrote to memory of 4320	2152	msedge.exe	110
PID 2152 wrote to memory of 2408	2152	msedge.exe	111
PID 2152 wrote to memory of 2408	2152	msedge.exe	111
PID 2152 wrote to memory of 2408	2152	msedge.exe	111
PID 2152 wrote to memory of 1416	2152	msedge.exe	112
PID 2152 wrote to memory of 1416	2152	msedge.exe	112
PID 2152 wrote to memory of 1416	2152	msedge.exe	112
PID 2152 wrote to memory of 2576	2152	msedge.exe	114
PID 2152 wrote to memory of 2416	2152	msedge.exe	113
PID 2152 wrote to memory of 2576	2152	msedge.exe	114
PID 2152 wrote to memory of 2576	2152	msedge.exe	114
PID 2152 wrote to memory of 2416	2152	msedge.exe	113
PID 2152 wrote to memory of 3776	2152	msedge.exe	117
PID 2152 wrote to memory of 3776	2152	msedge.exe	117
PID 2152 wrote to memory of 3776	2152	msedge.exe	117
PID 2152 wrote to memory of 4912	2152	msedge.exe	118
PID 2152 wrote to memory of 4912	2152	msedge.exe	118
PID 2152 wrote to memory of 4912	2152	msedge.exe	118
PID 2152 wrote to memory of 4168	2152	msedge.exe	119
PID 2152 wrote to memory of 4168	2152	msedge.exe	119
PID 2152 wrote to memory of 4168	2152	msedge.exe	119
PID 2152 wrote to memory of 640	2152	msedge.exe	120
PID 2152 wrote to memory of 640	2152	msedge.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://officialgorillaworkshop.neocities.org/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc7d93c188,0x7ffc7d93c194,0x7ffc7d93c1a0
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,18079526403523403007,16962475395526079718,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3487105291756248972,12247689158401260906,262144 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,17975009750909291037,5850449042440713359,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,9884663358659928643,636450312309571179,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,11663370237659697728,16778395369671628688,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,664025597938448354,24708089427113024,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,8135940546101147338,12901179529204636752,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,11259834084966354924,985742385497116106,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,11965587073743979505,17075292342914987235,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,7759366541133334319,4775864450710032932,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,7759366541133334319,4775864450710032932,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4340,i,14809921425196979325,6632000598163996775,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6248,i,9676491566271440857,10905438939211241078,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6396,i,1075483306585067557,18231090993409777346,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6604,i,15274683868838472161,622946090167281050,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6948,i,9826758006339304946,333269247947835469,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6728,i,15952277528348161221,6833187077697517955,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7152,i,6395467551397388028,4855515083500651027,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7288,i,16495705228445797201,6041449616481230085,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7532,i,15327006521713235601,11621208337134792548,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7572,i,1196593419710295991,10273318241015774531,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6452,i,18187312005304211062,3247977045559481918,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6480,i,17959893571400001761,14567598789088183187,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6456,i,10990524829894492392,13612575350674746628,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6244,i,9949596651568854540,17525758567342191980,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,11685896389130422704,11455251374350469511,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,13576527296878804725,3402617502928754284,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7316,i,11672635218383875961,6120630514002022827,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=8260 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,8905202437874220261,6459942611285269953,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=8272 /prefetch:8
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8352,i,7947592272414690658,12593591335330261605,2097152 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=8312 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8512,i,10586132444880859206,2136184044011775993,524288 --field-trial-handle=2344,i,9386133849484066936,15369106543509245612,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:8
  2⤵
  PID:5708
- C:\Users\Admin\Downloads\GorillaWorkshopInstaller.exe
  "C:\Users\Admin\Downloads\GorillaWorkshopInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c4,0x7ffc7d93c188,0x7ffc7d93c194,0x7ffc7d93c1a0
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,16379189079181685946,125940028029827049,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,1306381460835150346,11661303498516732343,262144 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:2
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,1743461622405947554,9521991155469000566,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:8
    3⤵
    PID:112
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,5811362019340972391,8209087077093340615,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,5811362019340972391,8209087077093340615,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,8859316858713295059,12904090347458173287,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,15100920419323508658,14647853795810096808,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
    3⤵
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,14337828213469204985,14183906198326166363,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:8
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,4485464399125393829,4611564559331719455,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,12905020917579431379,108440451860475709,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,18221033842508667970,11780321955741738851,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,9959755543486180247,7613536785992008511,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,7643577077158110264,7402207965754457981,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
    3⤵
    PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,9932697272992701427,1692713365609129380,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,11264481338111242901,8049206359673645716,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,6253059973028561527,2015307946607774100,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,5930663152976078647,15117210231279179340,524288 --field-trial-handle=3176,i,14574680473650881402,6637695533077788172,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
    3⤵
    PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3612

C:\Program Files (x86)\GorillaWorkshop\GorillaWorkshop.exe
"C:\Program Files (x86)\GorillaWorkshop\GorillaWorkshop.exe"
1⤵
- Executes dropped EXE
PID:2068
- C:\Program Files (x86)\GorillaWorkshop\GorillaWorkshop.exe
  "C:\Program Files (x86)\GorillaWorkshop\GorillaWorkshop.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GorillaWorkshop.exe

Path C:\Program Files (x86)\GorillaWorkshop\GorillaWorkshop.exe
Size 43.7MB
SHA256 e1820fc4c4abc22dec18d5dc2caa6917f1b6272f6743318a121704ced11a057a
MD5 544ea2afd7f6dc7cb3a7ba6415f318a0
SHA1 6aca9553a3ad7313cd2b2f157bb23e755fb3e733
SHA512 6c2a146e60a319f838f40dad738a667c8ed731f94701f5e3c5a12de1c6b37e0843935af409d6ca87404ea5d572fce46bfbf78c69cd68cfe6e6f12757d5736d85
SSDEEP 786432:ILtlsCX+uMLAfnqT5odzUYhq4OHi91f4nmMCCyNlll13wH2lC82KWJRt060LhXKb:+jpX+uMUfnqlcZhqhC7BMjk13+2k8nW6
TLSH
T10AA73380F2EAD7EDF672387874A21892636738694332DD77229945827E3B0F1773458E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 21916bd4ff5d8352c56dee6a81be174493beaf79015a1cd73bf87d3641937777
MD5 3c64d7d928426c0990a1d275b3d712c7
SHA1 ee73164dabf406188415054f8478e3e0a735499b
SHA512 8362ae4d667e7f8e36014d289a1d224e820d3aa7afde9c1a3cbb3f608d045c8478266170b54db3988b0ce2ef11cec1d52e8dc8464fb773f77e3f48575752d729
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d689794363e91be4e3d40432af9279354599c0ed54686304040d6a59b7db7829
MD5 e58de714840f6fbee1d39b033a0ecbc4
SHA1 6054c414731b3c89cfe5db86fc27446e671d1a22
SHA512 37ad74e09d90232881592dacb5df5c06d03990c25addf4022be40e82cd44284af1f9d402c761a7ce19d1fd4ced4b43cc1d009c97c0c7726a148487574a01097e
TLSH
T17FD09B54B7599D90D456647C17214701758DA9145513E103C5E112D55C86FF241D50B5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85a0acf79b8b86fc4eb30fe2c65838e1ca4747e6a1b57fda9a4542d02c94528e
MD5 83c953e8757f51c93e4d91ff86fff1dc
SHA1 dfa2503f5934d54e0291424c498f4a1a434b7239
SHA512 430cc99e81e9d8bd937719c59b892c5865472a2102532f5606f9b5c81647743c010bca0296a2c7a1b515948d986d6ccf679c670eec5a3ea79aa4e792a64b734d
TLSH
T183D0C010AA29AEE0D025207C03700700358CA9010603A103C6E001910C91BD300C08F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb99b812e0f26496acf7edf8450c7e883ac93e161575fac4f8049c4bbb09dbdc
MD5 92a1815fe5f806ea550dc57373648623
SHA1 7d7c74ac6b25be926d5735733d65769dfa013948
SHA512 8c9be61577e3db490af35f3f6d0968eb947e1058b31432a80348469b982f86c545376176b95332b1cae6dd1db830b221e4aa4c2b602e0a7649bb73ce9732236b
TLSH
T1C0D09B5477999D90D856647C17214701758DA9145513E103C5E112D54C87FF241D50B5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea0e6222a12f80213750d0b2b51b263087ba2757080a2c61edc8d9c8a0e108f9
MD5 45640f918040794a75a9ef2998f73415
SHA1 b2457972011ecd71d0915e3f1f21bbaf6add36bc
SHA512 c9e88dd9b7e113ac20251a55345be24ce871f96003332a297350770f079caeefca5ff6818db70af3ddbc810d3e42ec44bc56ec725194cf893b2352256af350ce
TLSH
T1CDD0C080F305CEA0E402547C1761470836DEEA000803E01398D112C01C81FA301C0060
MD5 SHA1 SHA512 TLSH

Submit Download

5a51a408-cef5-4e41-9e05-98d16d3be1a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a51a408-cef5-4e41-9e05-98d16d3be1a5.tmp
Size 414B
SHA256 9c06aae86e8724f036c7ba87ce4c3727ce50459161255ecb5a374354e4e63144
MD5 1cca1abb7d6763fb00bec303c3fc35d3
SHA1 2b6d6f2d941c104527406373dced17b09cb765aa
SHA512 206f73d3aaaa2fab13451319828f2401dcd40910ec97d7a4f42b62d1d6babf23edf86dab41890cff0ecca50836e32e68836fbfab396aa9c4a716e3b04a89feeb
TLSH
T19FE02BA9C921AC3B08F9172954950A46F75413773B514A1F3E3D920D8FF46274596C6C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b388b686ef5465e2f7f660c8994597b7c57620538ab78f294b162ebe4688b3b6
MD5 650d9cc3fd0782206b769433e56fcdc2
SHA1 996f3efbd4d8868f174d53130ee62955a68d438d
SHA512 52a936bfa403ac5b23ed5aac5edc5b220cb76b8fb314bc7f09814149f8c54245e0c63528bc5f5d91670a08beef8317fc2ed33f898f3ea875db929115a4925984
SSDEEP 96:x/RRDIrT3Q1zGUY3/ctVkCt5vHrU/9gJl3iNYnRx:xjcM1vqCc/9YkYn/
TLSH
T128A186831080C842F7B4FB78EFE4388BB5345CCCDDAB6E1E1056D576A6427E989A2C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595af7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595af7.TMP
Size 3KB
SHA256 d57bc9fc11ab8c18bcf83fd6cdcf11f6bc3747cfbbb831a47bfb71191009ba64
MD5 01278e98424234dd743af50ab0186571
SHA1 53a5e7607b4b7a05e86e978326c291fdd67c5d26
SHA512 424a930687b875c6df018f97e3747261582793df7f4f51e53795ac330f772cbbe08af8f7bde942d7f47e9f810de8f11ad35ec17d57d3c8896f7219d03688435e
TLSH
T14B61404415808946C7B4CF3CFBC0348BB6315DC05CAF5E2A15A8D9BAB6463F8C9B3D44
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 dc747a58dbbdc51664fa238c0410ebb1b79fdd3a3596a80d71f71183b6518a1b
MD5 fabe1ca5f7e545d3c7d5bb3e07e86927
SHA1 364a48c81556b58de0aefbec596e67c195fae699
SHA512 6ce14096d70d07d2d6747779f15803d06be4c8780e61c1d79417a0d0fea762b2d4fe1aa9afdeab5b1f03c9bf2fdfa42f6e959f6909053864b94605a5b137c8b0
SSDEEP 3:MsEllllkEthXllkl2zEklUGl:/M/xT02znn
TLSH
T1554404147FC1440DF71030304411D3501370D4140515774374510433DCC5D501D10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 320bd114fff27b2d7c285106eaba7a72a432ad75f8ef70ce6e0d158e79a43e2a
MD5 77805062b5d03ab53c3edb287c3ca8e4
SHA1 d965968760bfce9f1ec9b310fc9261b05abc4daf
SHA512 5367148a666e55a9208f61e2de24febcaeab71a6f222373785a7b756b6dbaea511692f15eff8a177149cc26c57ed8ab851648400a36d00d29717e608d45f8ae0
TLSH
T16FE0268888CEE129E15C78A3837CAB08C3D0391AA28C3F472B4C98847242FC1A2C7294
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 4f4a2e9d0708a4869a42e5af54c3dfbea4bace9ac88478d641c023cebb947562
MD5 c3b2233ab6699cdab619318c786e220a
SHA1 da9a5c7a96f3b3e22fee732a6bc43858d3a7a927
SHA512 2119eef60975b16afc92c79fcaeb7d96e0671e033177ec77fdc87f022417d786ca4a5082e1e1451386855183b9ee5cf418b3d711bef65ef42566a4d8e92c1c02
SSDEEP 48:uzBmw6QU1Pz/rTPkvi6xVqKRmYhU4VTz7b5E:6BCxDTcKkVqKmAU4hzy
TLSH
T1D892B4435E783003EB960D76223B147C893BE26D5FB6DDD5783590215DF8842A07C9AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 6604ba943bb25d67e722bfb6a81ae4034a5ceae890b94318278c42148df33790
MD5 93da695be6bd4dc1e3b541d968467365
SHA1 21c6e40d7360d083df0af65c91c76c94752e7c55
SHA512 645eaa08317ccaa09b89f5e92a8d310d9afaccccdddb360c3028ca5a33c09f9e1afab769f473990c2646a8933f0082b52f6aa8cb98f49ee111f87d89016df365
SSDEEP 384:jACni6PSTYijq/83uICtTBB8C5SSCni5SeCgSE7DXspU3i8i:Ti6PGzj8ptTBBL5ii5MgaU38
TLSH
T13B241A1F5E601332CD7E24B595972AF19C7DF51E8B63E98A781200A0CFD664270EF89D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 12KB
SHA256 c43290195e8f32dd4e0a2061f3390b3b034ef6340f69ffee67a0ca6955137bde
MD5 5161a099a1d4a68ec2b48841c72ce971
SHA1 dcc652f52d9d123624aa3ad0f38b2abcc9331b7b
SHA512 b60ab1b62e6418af01949026f83e6f9e8b394d55aa4f714a0be767188ed476a141ac5836c2ed1d51a951f780da49dd6f1bd4411ed52ade0f5c9be8342d899b6c
SSDEEP 192:t/m3IVIbVqGTSvJfnv1uTdiSC1uTdiSETdBCGgwDWAJd1CGgwDWAJdmVQ:t/yIV2VlT2HmwDWgwwDWgmVQ
TLSH
T164425E77EAF0CCFE8E2BA4A1E83BBAACB15B8C67DC41FDF8D4C4AD8541151640185E49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 806d9489498e6c3967ceb7c3e0eb2c24243b81cd77b96d546d59cb76dde35969
MD5 69d676f3b9fc4b02ddb015d1d03a77c7
SHA1 3fd2f31344b52cb3bb27af6f3dcfe20b830aa65d
SHA512 127253a927440ceb2ee60cd025e12092e918302c66983adf30682082f252e84b25ccc94be7e93e151cd0809312a4ea47df212647eb10ea8e912fc2384364acb7
TLSH
T115E0D8A488CED1599288206B523C7B0CC3F03A06F78D3B465F45E860B545444A2C21C1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 48de341d0e78d4e15609a7b14142b82ee6a91a36848c9e52aac12e2fb9471074
MD5 a45ec7d00d14d12c97d08eba50857d34
SHA1 d196d433a62c97ad882c8db437fe947bccde0101
SHA512 bda14a0471b8000256233751bca7a5fe468022f40804273ca355cb54459f4128e518e2287cb42fa3c99894bae7c8915024e937c5248f832f36e02f41cc077e67
SSDEEP 384:DidXvONk+bXSLugRyepqOetJR4a7SsTUvl1eEXur1fzy4IKY/BH4YYKLsrhY5AY5:bT3aOTs1wKCv16xjYvXo
TLSH
T163B278F783E6DA6E891116F856146E1BCF1D0719432C3C168CD5EE8BE3E2072E16A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 25KB
SHA256 03528d1a2c6eb4d9019fbe2324dfe288aa5c9648832ff13c43db3c9e06fa4a4e
MD5 3e4b57c9d63a7557b2cfa65860c5dede
SHA1 1f92ed4e407968bfc12b84a6296ea4e8f57e1ca3
SHA512 61232b836f25c1b33aacd6d342288f3041de78459f2946ccb1d1841deeb3e0b31357fd70ed8c6e70066e78878376a979db9d44a8b1a68d142f84fb9e34c70079
SSDEEP 384:DBypE9hXmyo5jhU+lkB7cLeejHeQJspJCDYqtEYCgGoeLmzJ3L1Ey4IKY/BH4YYs:OP8aOTs1wKCv16xjYvux
TLSH
T109C288F783E5DA6E891117F856146E1BCF1D0B19432C3D1688D5EE8BE3E2072E16A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 cb1c77eeb325b68c57e08789d2a494ca6a75267aa5328b8189d89e45947687a6
MD5 aef667f31895db375fc51fc3e2ac1fdb
SHA1 8516a18b9621c9f3954e4b8b2322443e1a46d7de
SHA512 716451e7744c7cd3bdcd2f8e425fe6fc9dc29f0b2a5a636ecf51ad0118d6998a6e26fd4ab688f5c75288f1e2faca09d93abb65830c681142cd236c4829246e90
SSDEEP 192:sxZARHWB/fZs1f5Idpi7mHW6+WNrXr/YrdWsXIgrJ:sxZAoB/fZs1fSCmHbn/+9
TLSH
T10F22B9566E28A57B8CC7E21DBB25BF53E6F9503251D41E48AAFC872C04E66DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 47b57eb47a3d562265d359765be4d9c7f65824b12d5fc504ddd0ee3dc843e956
MD5 ce76d4d87960fb50607b69ecf64a11aa
SHA1 8cef48127bed75849f08dc38373db42d7147dc7a
SHA512 ab23a00cab980dfc5b78ddd153a1b92c02170bedf550d84819310f68c2b75b2a036caa3c8a76192d26d86c48aa481b941fbd214b321068967c5785194d894305
SSDEEP 192:sxZARHWB/fZsip35Idp837mHW6+WNracXYr6WsXIg5pJ:sxZAoB/fZsip3SamHbrXDt
TLSH
T1DD22B8567E38A97B8CC7E219BB55BF53E6F9103291D41E48AAFC872C04E66DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 19edefddf9e2f154d305392f19af9ff3b7939d88fca52221b66ccdaf55bb193e
MD5 452ee201ba6b6e084c136a510579765c
SHA1 fdac507bb22d94a7789e2d4aa88cc53f50be7a31
SHA512 1ac7fa68e9d3cf596a08ba2abd0a79a1ae2cd106e2136957a0d66017f21ff7da16d55653f7326aee414cd6ea7c74c8328c0476176491512ea8968801fefa8108
SSDEEP 192:sxZARHPB/fZsic35IdpViQ37zyxHW6+WNhfuzacXYrDWsXIg5TJ:sxZA5B/fZsic3ShaHbqX+j
TLSH
T1DB32B756B934697B8CC7E219BA15BF53E2F9503251D41E98BAFCCB2C04E67DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d2017266322838eaf348244d1e3ef083519e68e879f36a8e5ba216a8deeee747
MD5 e6c4fac212fa1e76d89d16f0b3c5e850
SHA1 db1f58d8d98073a37bee4fa93de2a4c5491d71ef
SHA512 8f818391929ce767d0d47cf8404560784ce76cb476b361a11ff29bbf474f584f8ff3db7118824e12cdb776f93cff992389128c3af9a4e9111cc2354a45346728
SSDEEP 192:sxZARzdB/fZsiiWpVEy6qEM5IdpViQ37zyxHW6+WNhcCIuzacXYrS2sXIgbwJ:sxZA7B/fZsiiWvEOShaHbvXrY
TLSH
T13A52B716B934597B9CD7E219FA15BF53E3F9603251D45E84BAFC8A2C04E6BDD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0215f2ac7b1ace1e24f39ab18cf8f1ab041ff8518844f7ac2f19c1cedfa9568f
MD5 cf66deb11816991826ed0a8cc7e1ee22
SHA1 20b5f7d4e11fc4b012b9031215d84ff3800942c8
SHA512 51c5262a64a620a5a57131c86eedb3da344d57faacda1b2ab86f4089250bee8132da41cd247459253a0c8d0cdbfdb62490ebb379156565e64fa95ead45a12b9e
SSDEEP 192:sxZARzPB/fZsiVWpVvJ5IdpViQ37zyxHW6+WNhcCIuzacXYrSvSXIgbTJ:sxZARB/fZsiVWvvJShaHbvX+h
TLSH
T1BD42B656B934697B8CD7E21DFA15BF53E2F9603251D51E84BAFC8A2C04E67DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 91dc56f8e5fe81685244faa0631c48e9f88edab9b0340e15085647bcf55a82f4
MD5 f548fa71ee6bbf4dcc5e18bf01284ae5
SHA1 d64d6151aa236f47dfcd2914101147b0510635e0
SHA512 a31f84fc4545ad44dde388c1e41e1cfc62c3766d4c6434516a535269e815b1e01e087139955f83cdd38bc4c3e852f4df4baae6504ba38b2e58436ca8ea1eb8f9
SSDEEP 768:SJqqHHlWvdD/T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU4LliA1nVroN3+1cD:SJqqHHlWvdD/Tu1jaF4LYsnuN7
TLSH
T1FAC20B3B284CCB7E4FC01A9DDD5A6F977EA802C7A6688D4047F9894C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b2716d657ac705788e61fc4b90459897e8a3a2a3e9c6131af26d26fe1d50c45b
MD5 a7823a7c3b3c1aed4a7f633546771e50
SHA1 dbd1d4e69a633edcb310f50f3eb1bba7f660ef3e
SHA512 06078a140a3d1bd8eb88a690a834a965d5e163f5562d9f7e1c83090f1b96479d5210ed6c0edda18858fed5d996558fa83e8225f1b4341b59aec15704b5ec89af
SSDEEP 768:SJqqHHlWvdDHT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU4LliA1nVroN3Z1cW:SJqqHHlWvdDHTu1jaF4LYsnuN/
TLSH
T14AC20B3B244CCB7E4FC01A9DDD5A6F973EA802C7A6688D4047F9994C02C77EA61274CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 c196cf333684c3b738cfa29ec7222e45a04057ae693b6f0fa74e113dcc438d7d
MD5 bcaddfc366ebb8d1f19efdc8a8101952
SHA1 e749a0ada861929f27a93ad67e2acf649d6ffd10
SHA512 eeb560991d1ef7f0ddd551c3c5ced9441238572cdb054c4a3d91323c7da4b9136e46ee8e7bf52a01f6a420982d802ccdc41beb7994985565a91adb5d38fbc854
TLSH
T142E0865809CDE57DA19AA19712789B08B2E4B91BD7CC3E176F84DD407182A94B1D7281
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 755e80678847774c25237d12051a63f8ed7e80cad2566f9d1a3bc04a766931b6
MD5 a2b3104ccd894e5909bf42b0b64d53ae
SHA1 c80cbb61198f3ae556af12fcf5f9b4436b7f071a
SHA512 389193a888533e56b1c87bc22c34d772cf62b6c4bd3a06fe25a9390655b8ecc3b013b7129e0c67227970c6b1368d9d48802c7c81ae0bac4c84c918e1aea14e0d
TLSH
T153A0022603819514C5340A71516103405300C85482124353519804B8DCA22459D41505
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 edd9e7b9af6663013727b13d5bd8cbf6c9803ad0d94e661428a2b26ba97fa98d
MD5 3c97878b3abbe7eef9be5d204bd2d036
SHA1 3910ad9ef8f85d0a3e777852f6af314667f03264
SHA512 a407fe98560588076c1353d2ff97af9462dba9ba1f2ec7924e743895af0fdc288621ad9f155ad6a4db076c351c1335b0eadd8c1490f9149114b29342c7421657
TLSH
T1C7C08C0AAB06156AE8AB4AB2929687805331E0021015052BCC08EA209F1A66C2E868E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 0dabf73f623206f989c93ffd7c0b850bcb3f322251c0ef9fb390591da7376502
MD5 e5d30a8355316413bd4beb0b514eafad
SHA1 2a035d143850127163982fbaced8029c1dd4525f
SHA512 de9b993726b1f2ef8099fed1cb1374c9b4fb8b74bb01cd16140b2243918ba83721b7f3d736a370017f95024813942b61ad2b61fb519adf0dbaf16eef4c493376
TLSH
T188E0486819C9D62AB2C96197A27CE70CC1A2B906D6CC3A662B0CA940B246744F297741
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 12662c273b70ba88b9c0c7c0f0570d89d70b0fdc66e4742f81f6387daaa5212c
MD5 3351c1d8a1cf64d872612b8ece49a846
SHA1 8a9fd75b2dee0b232255721e4b78ccb590d9fdf7
SHA512 82ccd81352d285e3e922b1d981d2506eb30d406117c46d88c4d5549e2d45e079e6da1ee2a7a9796f74edf2393c8f8ffc14d4c7e71c5e9c55fe259e83d77b4318
TLSH
T1CBE0267849C8E63DA148A0B35278AB5DC2F9BD4793CC3B0BA7086881B241610B3EB180
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d924ae88228f37e0fdc902f18eeed9296b1dc09dd5a2ac6988f474b5ae9008be
MD5 368abc527dc533a28ac5d9418892b527
SHA1 b079b540343d7491f52ed407bf22679057a8a33e
SHA512 465d2dabaaed212059fac8e44fb3a3d940e25474306dfbccc49196c7c278b06d1eb275c706f2141ad6f7bfee348ed1dc50f337533668ac097c51e27354f11973
SSDEEP 24:Kr1up0dIHKStLAXSa3xLXzwHv+CIPDzKScha9z1M5jS2dE4UXQyXQCLpOfa0xg8d:KkWIHKzGIHKnK4nylwI7K1yMxnIVKUsl
TLSH
T1FE91104171BB5264387E6D148275972E878236A3702DFA3B3FBC55624F6AE044CFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 862b258aae59fe58c0307382ded624226f27dc69f06cb44543bb9e10ba14ead3
MD5 00c134f18a849a6e7f0f6642134c0a30
SHA1 484e57e9b01cf16fcf7e42ee7ce3316bdc7c4250
SHA512 081682d3495552c39ce203625154fd03759990f1c0103dec23a406d75e0a23ec2a45271d36d41a7ba7e09d5576d4a2f5b91c5b87728a364e76838aa09b7d9a98
SSDEEP 192:j95QkIIIbbLMIMNsYcY8lOjJAsCl8+NusjYq1jL7w/+q/+i:j95QkIIIbbLMIM2Bkjqs4wsj1jQ/t
TLSH
T1B572E82B674407B7C6AF6F36276A879816E98C4505A1559C7072380F8DF3A5FC1D0AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 c0b62881dd8c2f9be81c0be75d731a1e8a56882efbd772ea024f3b3eaadca144
MD5 2054248b0c72f41c0ce9e659455c4b5b
SHA1 4cb1e673aba17914cc4d9a8af4e1cebcfa8a7eac
SHA512 e4e5c00b3d555bd671f56b716a4637b77c997780d6b4a23657075bf254a598cb3bb7f80563f73b37744a222696f0d41af41bb31b1b1987c3f8bf2070f04537f4
TLSH
T151E02614ECCAE16EE2D86197917D570883803E03FA8C3A0B1F00C444B241684B3CB181
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 ca5499dbe14e89590ceeb2549b95ed4c317f9e1ef97a59c713f5f042437287b2
MD5 bc00b4722da46f5d057cdb65a8a4a70c
SHA1 d4258559c811e52581fb1d40337fb8b50c37c610
SHA512 06a71a3c0f83ad278a8ec1ba9f0b1fae2d4513a7902099783f8c5787ec02898d6d9966b80755e5e84cd36ca3baae655e2369008ce56f1a0ee61fcb7b6c2b3862
TLSH
T1222124A2F338C119D249063A507EAB150334E8039FBCEC1F11BA20643E72E100E4B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 5b30ede2337aa784c3b3ab107aea7a3cd6b0f52dff0448d78151f11cc5f71065
MD5 ad368416043025cd4ab9b1a9752a1741
SHA1 c74677abbc06befed0e36572e9caeb37a4d70b91
SHA512 69414b9781cb6e7ccb2bd06ee2f38a4e030e565fd8f1a50935be60a80e893c2ef8fdeca871ee3044e8ff8099bc224267b229022879217e1421bd138674ca4e3b
TLSH
T112E02614ECCAE1AFD2D861A392BDA74883913D43FA8C3F0B1F00CC44B201685B3CB181
MD5 SHA1 SHA512 TLSH

Submit Download

98fcb145-65b6-48fd-b583-034f4ec15f70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\98fcb145-65b6-48fd-b583-034f4ec15f70.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 3950e0de65e5716027762f554fd9da3d496fb2ef70639996d1e3257d8c19f4b9
MD5 3555c82b9c1a05086a944aa661edf3fc
SHA1 4fef711958f25d56be4e7c89447b56a6e8181d60
SHA512 cbd20b3c92a9991a95602f5439689c509521b9d6c898341588f261b37aaa03301158ee6ae1eefda3a687d4fac647021e8df22963cfee2094f95130ebc605ff06
SSDEEP 3:MsEllllkEthXllkl2zEklvV:/M/xT02zn
TLSH
T19F4404047FC04C05F51030344511C7501370D5340511774735D11413DCC5D400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 596ab069c676f67faa53c0a3c44ad792c866d257f61dce0b07d01a9ac0ae86f6
MD5 a1fa44cf926eb9a075091a41e36e747a
SHA1 0a397799eff0910bcfd0ccbae9cca1d41d9a9457
SHA512 b27a522fdc102dac6c272541fe59729575127c9c2a31c6f72d97b69c49d9e3ab3f87c3b93ee9692be52402bc03f82d04ab315e3e2007b96b98ea77c22cade114
SSDEEP 384:nWZcIJsNpksvxvwlSW+S0hZJEx72xcajMPdvK4MiAO6R2FeosgL/7Izjoy:EJexWH0xEaXjUBK4MiATRdp
TLSH
T17AA26B7D7C789C7F08EEB309A64E2E175EF81077D9989E44E3E85F2E0062699770B412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 f777071154d7a4936474421e748333a56ae249bafe46cee59a13e89c55272759
MD5 ab0224a16f7fbb6369c24ea09fa1d6e7
SHA1 74e8d02f2ee647a8864bfd26112b6620ec069f53
SHA512 d476cea8414e1779d5555ac5033e7c43de0c4f9ef4673586c659e6555ed417f5f8ecc62c108f887bcf616f30012277780930842485c529c90d894c0597fbe130
SSDEEP 384:EZcIJsNaksvxvwlpW+S0hZJEx72xcaAdXBzboS29o+7O6R2Feo/oA:iJfaWH0xEaXAtJX29o+7TRMv
TLSH
T1ADB25A7D6C289C3F44EEB308714E2A264EA8117BD5F49E84D3E85F1DC075A58FB1A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 47KB
SHA256 29edbf6a82f91e8bec78dc0a402ff771f4de38789d09659ce2ce5d920cdf8e71
MD5 beb8c169049088e9ee1a6f7f580e2a62
SHA1 980c61906ad80925b84a5f152d620aa4e30b102f
SHA512 2c5221b9f5d1c9512dea4e36d41cf692f56d6c05d25ea219c7475ae098c75fb9e959be3c627bd8700fed03350c8cb9897e54835a0fe423952b84fe074603b0ea
SSDEEP 768:7F6JKwgr6W5A8EmVkR7+eNNDR9UswdOx+AUBK4MijTRdp:sJEu8ZKDR9OdOx+TBKPijTRdp
TLSH
T1EA2328F998D7893AD9AE934B633E2D028EBCC163B5985984F3D85E1DCC524BFD706801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a5656c4a828c71b26f38d862168f3c24c9cd8e99e90ed35f296d934e5bce201c
MD5 b37f544c40a6ea7741ea4ccb9d62bbdc
SHA1 f9071d731ee55a1ac79b8efd7893e31b478f93ed
SHA512 aa93b461a1dba2f35f095c84a3c9189038deab40419a34dc54bc3b4f4e08a461d525c38c76de89b28c4a8c92c4a769e61934cdbaeb1b94f07e8f5e1dc335a362
SSDEEP 192:ZONk6xGuQmiUyID1D0hZ/1bEdjzoq2oRYcaQicY6AU6:ZONk6UqL1D0hZJEx72xcaSmU6
TLSH
T11A02E935BC686C7B9EF2AE45B5872B175FD8102BA6956F80D6E82F1D00CB69C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 44894fb6f32c42bc01372c2fa4463672ca0cbab848ea2946fcbc53732626b418
MD5 6202a2e56506c77495d527e265ecadc6
SHA1 04d9c8608ee79b8445a5aad03b5fcb8911f75188
SHA512 2f043a97653dcd7b9b3c595533499e414a1bd15b077e39ca99583b3f2e353126c07f3907a5f84511159e857044a238d31bdea4fbadf2b2c0da3d0323d6b10e6a
SSDEEP 384:5ZcIosNkkNvxvwIwtS0hZJEx72xcaAdXBzd7O6R2Feo/oA:RooWA0xEaXAtJd7TRMv
TLSH
T1C3827D326C789D3B5DFAA245B54B39074FF8506796C96F80D5EC6F2D01CA6A8130EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ab1a1be1b7ca79abf8624dc425519dd0ea67d1647d236a904e666914eb4a9fd2
MD5 194066591291bca26769d23c61f29d4d
SHA1 7cbd81780ec243b395005998f8082e17e2400d23
SHA512 49dc549f06eb9a414e16d2de3de58d7316dd949836b700249d9b7d9fed0cc8962c708174191e6894fd471e2df745239504b72ce391bbb0bcacb6041f71fd358f
SSDEEP 384:5ZcIosNkk7vxvwMpW+S0hZJEx72xcaAdXBzd7O6R2Feo/oA:RoGbWH0xEaXAtJd7TRMv
TLSH
T1A6827D326C789D3B5DFAF245B54B39078FF8506796C96F80D5EC6F2D01CA6A8130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 64de9077b7f6568f075ee4211875363b43af28f92c4876b8b46cdd4c21b8be7c
MD5 384e97c130b7e47ff9fb18f5e97c6480
SHA1 f3049e3b7e7d35ae51b0f859420cb9deb87e1476
SHA512 2ba5fa95269a1d6e07cd2d29ebd9eafbb3cdd213575bf7e90c7bbff015ba17826d7aae63e3f9369b9e9173220889c639f4f908c842325d2205dfb085bbbfc053
SSDEEP 384:nwZcIJsNpksvxvwlSW+S0hZJEx72xcaAdXBBV7O6R2FeosgL/7Izjoy:OJexWH0xEaXAtLV7TRdp
TLSH
T19E927C313C78DC775CEAF149B65A2A476FF81073DAC95F80E5E8AF2E0085699170B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 834ca360cd79a76bf90830d41400f139c41630253092f8799868a29162698e64
MD5 882b071c6f0daa13b56eb8812a222400
SHA1 5cd83d9c89bd507279c8a210359034e6deb1a1fe
SHA512 4f5c54a2cd70f6395a2d92b902e35ed8d7fec651606681df51881af6a15e2637ea8b890ce40c2fef0e92537af66fd7a9a9ae96118e137c4c28211abef01115fb
SSDEEP 384:EZcIJsNaksvxvwlkW+S0hZJEx72xcaAdXBzboS29o+7O6R2Feo/oA:iJfbWH0xEaXAtJX29o+7TRMv
TLSH
T1E8B25A7D6C389C3F44EEB308714E2A264EA8117BD5F49E94D3E85F1DC075A58FB1A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f3348ddac2a068da02a83e5b08a832b2736a47c23cf5ece3424de628fbc0482b
MD5 aeb238c636d9b3fc72b8817cb4a391eb
SHA1 47ed704d6d5db3da7db70ff8b09747f954ddb71c
SHA512 1f2f5c14aa605c0b810c55a23b19853f04b2facf89410851a8e83de8464da0198ab2b288fc7fd2ca9d03bf1a37ba595f231bbea3a85cddf1b4f8a490cbbb8db3
SSDEEP 384:aZcIJsNkksvxvwlbW+S0hZJEx72xcaAdXBzd7O6R2Feo/oA:YJxGWH0xEaXAtJd7TRMv
TLSH
T147827D326C789D7B5DFAB245B54B39078FF8502797C86F80D5EC6F2D01CA6A8130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 02a8805d43ab6eebcadf7d6c3573a23b0d18159b561ed7723e4dde04c1349ff6
MD5 b439094e99bfa783673c84142b430b7e
SHA1 a99a1847967da311e14f6c1b73a5952cb8eb9511
SHA512 ecbaaf4752f891f61b3e7ce69eb659e731a8556d32a6a730d24c7378ab4b118cb6c1297e1002f9adc0b4e093592c73f01e34071dd758e40f96de02ce8a261bb6
SSDEEP 192:ZON16xG7QmiUy6DvD0hZ/1bEdjzoq2oRYcav4dXBP23h/fU6:ZON16UtvvD0hZJEx72xcaAdXB0dU6
TLSH
T1EC12E9367878AC6B5DE2B645B58735034FA41127E689AF90D6EC2F2C01DF69C134EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 b0efb3073d5b986d22683df53b2637c11601f6f1f1a258bcf65c382cce75a53f
MD5 e7690ea843424c48ae2218264b229fcb
SHA1 4ff30f732cca3fa7783ff80b8cc61057efa29134
SHA512 c0fc7806a7766b7b2814dcdbd4264da7be07d1c4bfd24c5e12c48ce596c22d788da9ef4110742066706ded4d8dd862a0e0520cc2da54f9ca3052b72bea112990
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isuQQtydUeKzbdU/xX:TLyT5UOl0afDdWec9sJdo5pejB5fc
TLSH
T16F92DF236D352033ECDA8B3AFD8349910EB8139EC9A7B8488DD049620DB1BC1A2955FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fd96b97f6303715e6790c24ee92c8448beac2cfe490552f0ea85b9e02465add6
MD5 21c1eccc7dff479011998282be4f4723
SHA1 3fe6086a87daf4d0abf6fe22004a5ae33b802f79
SHA512 9786c9618bc5027ff5560e44a0d5a367290e81b1c471fbdad26ea67638cbe751cd8f55483625f69db819831bf70e31a52ce0441fa0dc25d3f531c2477a317a48
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe594666.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe594666.TMP
Size 392B
SHA256 6db2177e07c9666f90944de0dd49715bd188c2e86df41450027d9f7ebf937038
MD5 6cfa1bb2a11c9065c84dfeb03722815d
SHA1 7f6a8c8559c7d35db945abcc2b6acacdf207f1a8
SHA512 0eaece686f98f95e9cfbedd17dc5b927ede5c0dac5a6b86f6e9b21a4b96acc49dc61b1ed03ba179daf81eb20f6d06c3450e2a01a61f91cb3340aaa15d3ee6eeb
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 ae7bf1392e3f8b631b9ebfbd5c2b241d6f885440295c8bc11413e8644388c2d8
MD5 fd2889266abb75f408e531c0f442dc58
SHA1 9d982a333922540651a7375208292dca4fdcac8f
SHA512 99ef8154aae359fcaf938002f0d31910813a2f7ed4d5c7cd70f80d3d96a1101768e7d7d6be3895ad9c4f451f7b8a083489ae74f98b34ff76aa9149e1addca5e6
SSDEEP 3:MsEllllkEthXllkl2zEklXGf:/M/xT02zn
TLSH
T1F34404047FC0C407D5003034C431C3504370DC140557774334710413DCC5F401D04400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

aa27b6f9-3cc6-4bea-8cb4-b13310069827.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aa27b6f9-3cc6-4bea-8cb4-b13310069827.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ec82845995cc094e32769f43ad5e9e4d99cd8d45100beee36225d1aa9eea39ef
MD5 a294ec810292939d7088f8c0a32f9476
SHA1 349c391d42a9c7b3b5560378c3aeaa522237d536
SHA512 b93736848b55cd13a7dacb88af6fdf2866aa21df30ed63deca00a61b6d262d5148c21a737e3ef31fd86544a4f7281104f5acb1e25f630527b71979fce64b00f0
TLSH
T14A410758BAEA1148B3B76E5A9BF6696D887BB8373F06D05D00110D4F4A73B01C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

62a56299-8da7-4cac-b4cd-883f835c2147.tmp

Path C:\Users\Admin\AppData\Local\Temp\62a56299-8da7-4cac-b4cd-883f835c2147.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ailogo.ico

Path C:\Users\Admin\AppData\Local\Temp\AITMP0\ailogo.ico
Size 4KB
SHA256 d31c6b93b345648ac0dff7c533fb967a15797b6e32e2c863b5dc964ee0b8e7c4
MD5 183f1ba1567675d2ea8240ec9be4e557
SHA1 587218e562d4430a21977179fc5d8abf616bf041
SHA512 6369e481e819a9a2c27ce8a57bb419dc792dfa176457b07ca9a37446a6d8e4b0cd1ebbad0573b6f817bcf21aa8a3933347ac69bcdd5f981b7b7c4ae0e8dec323
SSDEEP 96:dSbgTfCABZvoiQ8uGjh18eBrqkaaNcHlblK7uuuuuuu6qqqqqqqqqUqqqqqqqqYP:d2/ADdQ8Z78srBv2Hlblmuuuuuuud
TLSH
T19891798432E65817E16843BA62DBC02C657BC9D06BA6E0D3588ECFBFBF17357D819050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5468_2109599126\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GorillaWorkshopInstaller.exe

Path C:\Users\Admin\Downloads\GorillaWorkshopInstaller.exe
Size 49.4MB
SHA256 86a3048d286e26049a04bb90cc8c179abcb7cab9485170412e2ccf5317a88459
MD5 b967bf0353eded4504835b553df7d1e3
SHA1 1c80647af110f1506ff8190dd959c9cdb8afc49a
SHA512 199d08dcf617609e555a4aa6503f4d77fd4bd8b0e3a52303a1768024a50ad0c49d46f0df52c0fb48cfae6e337583185afa4466b1dcbefc8732fb162fe09742bd
SSDEEP 1572864:NM6f8C4LkkzasYwEiZvcYCPZh040MM2pIWvD1iCS:Ndf9ukkzcizCLvvD1u
TLSH
T1B6B73313B384643FC06A1B39596B9660D93BFA202B139C6767F4198C9F391813F3A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5920-1234-0x00007FFC6C1F0000-0x00007FFC6C523000-memory.dmp

Download

memory/5920-1245-0x0000013E1F5E0000-0x0000013E1FFE6000-memory.dmp

Download

memory/5920-1237-0x00007FFC69E70000-0x00007FFC6A4BD000-memory.dmp

Download

memory/5920-1236-0x00007FFC6A930000-0x00007FFC6ADE9000-memory.dmp

Download

memory/5920-1287-0x0000013E1F5E0000-0x0000013E1FFE6000-memory.dmp

Download

memory/5920-1235-0x00007FFC6AE40000-0x00007FFC6B1FB000-memory.dmp

Download

memory/5920-1313-0x0000013E1F5E0000-0x0000013E1FFE6000-memory.dmp

Download

memory/5920-1334-0x0000013E1F5E0000-0x0000013E1FFE6000-memory.dmp

Download

memory/5920-1335-0x0000013E1F5E0000-0x0000013E1FFE6000-memory.dmp

Download

memory/6028-1023-0x0000000000360000-0x00000000006C7000-memory.dmp

Download

memory/6028-593-0x0000000000360000-0x00000000006C7000-memory.dmp

Download