hxxps://tunnel5[.]dlproxy[.]uk/download/oFE-OnhoZW7HiBbs7-nI15YgzJaAOjmt_UvtaleF2QGqgjshrIGrJDCsxmOrrHtgJBp4xnwP4Q0tKCzlcWdOLesMzGujMka_Y39QIrHhOtSA3ZLCKqHik8gffqQeZAWKUGThONLu1epQ5wBzsaZ1l3ml1VBMkSGVsIy_qukkLlCPrb5d_q60d_4h0Hja5ycWmbTwuUEYuD37PV3KpoaioX_KZkUYub46Us2wPqLvkVnOA8VwSQ7ItfP9IPOOSkj_TA5pmGSNg7cenQ3rB8Oryq0XIQ2hs6jBwsd_ZFxF0bp5eRnRymC5mr_A_9KPplxEAwqPa1JwSBPB8_0ubB2g5H111tDu2Hf1xn2QywyGd-nj_FTm-luB7eb2xmi87nK9EiG-_2AWkDMTUbCFT_p9yQ?sig=OYZitT8S2E65vLGwt_H_WdNqC2N3Z00ACQXOLp8uX00

Analysis

user interaction
yes
max time kernel
505s
max time network
464s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/08/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tunnel5.dlproxy.uk/download/oFE-OnhoZW7HiBbs7-nI15YgzJaAOjmt_UvtaleF2QGqgjshrIGrJDCsxmOrrHtgJBp4xnwP4Q0tKCzlcWdOLesMzGujMka_Y39QIrHhOtSA3ZLCKqHik8gffqQeZAWKUGThONLu1epQ5wBzsaZ1l3ml1VBMkSGVsIy_qukkLlCPrb5d_q60d_4h0Hja5ycWmbTwuUEYuD37PV3KpoaioX_KZkUYub46Us2wPqLvkVnOA8VwSQ7ItfP9IPOOSkj_TA5pmGSNg7cenQ3rB8Oryq0XIQ2hs6jBwsd_ZFxF0bp5eRnRymC5mr_A_9KPplxEAwqPa1JwSBPB8_0ubB2g5H111tDu2Hf1xn2QywyGd-nj_FTm-luB7eb2xmi87nK9EiG-_2AWkDMTUbCFT_p9yQ?sig=OYZitT8S2E65vLGwt_H_WdNqC2N3Z00ACQXOLp8uX00
Sample260823-rfp2csstgt

Score

7^/10

discovery execution persistence ransomware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4272	Big Walk.exe
3852	Big Walk.exe
5816	Big Walk.exe
5124	Big Walk.exe

Loads dropped DLL 12 IoCs

pid	Process
4272	Big Walk.exe
4272	Big Walk.exe
4272	Big Walk.exe
3852	Big Walk.exe
3852	Big Walk.exe
3852	Big Walk.exe
5816	Big Walk.exe
5816	Big Walk.exe
5816	Big Walk.exe
5124	Big Walk.exe
5124	Big Walk.exe
5124	Big Walk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2192	cmd.exe
4632	cmd.exe
3892	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5332	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319677223990759"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1131776342-1023621610-2767477260-1000\{B1FAEF76-FE49-462A-8A9C-57D7A6B8EEC2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5544	7zG.exe
Token: 35	5544	7zG.exe
Token: SeSecurityPrivilege	5544	7zG.exe
Token: SeSecurityPrivilege	5544	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2600	SecHealthUI.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 6132	4824	msedge.exe	82
PID 4824 wrote to memory of 5332	4824	msedge.exe	83
PID 4824 wrote to memory of 4080	4824	msedge.exe	84
PID 4824 wrote to memory of 4080	4824	msedge.exe	84
PID 4824 wrote to memory of 4080	4824	msedge.exe	84
PID 4824 wrote to memory of 1220	4824	msedge.exe	85
PID 4824 wrote to memory of 1220	4824	msedge.exe	85
PID 4824 wrote to memory of 2160	4824	msedge.exe	86
PID 4824 wrote to memory of 2160	4824	msedge.exe	86
PID 4824 wrote to memory of 648	4824	msedge.exe	87
PID 4824 wrote to memory of 2160	4824	msedge.exe	86
PID 4824 wrote to memory of 648	4824	msedge.exe	87
PID 4824 wrote to memory of 648	4824	msedge.exe	87
PID 4824 wrote to memory of 3536	4824	msedge.exe	92
PID 4824 wrote to memory of 3600	4824	msedge.exe	93
PID 4824 wrote to memory of 3536	4824	msedge.exe	92
PID 4824 wrote to memory of 3600	4824	msedge.exe	93
PID 4824 wrote to memory of 5676	4824	msedge.exe	94
PID 4824 wrote to memory of 5076	4824	msedge.exe	95
PID 4824 wrote to memory of 5676	4824	msedge.exe	94
PID 4824 wrote to memory of 5076	4824	msedge.exe	95
PID 4824 wrote to memory of 5076	4824	msedge.exe	95
PID 4824 wrote to memory of 5380	4824	msedge.exe	98
PID 4824 wrote to memory of 640	4824	msedge.exe	102
PID 4824 wrote to memory of 640	4824	msedge.exe	102
PID 4824 wrote to memory of 640	4824	msedge.exe	102
PID 4824 wrote to memory of 4464	4824	msedge.exe	106
PID 4824 wrote to memory of 4468	4824	msedge.exe	107
PID 4824 wrote to memory of 1804	4824	msedge.exe	108
PID 4824 wrote to memory of 4292	4824	msedge.exe	112
PID 4824 wrote to memory of 4292	4824	msedge.exe	112
PID 4824 wrote to memory of 3972	4824	msedge.exe	113
PID 4824 wrote to memory of 1644	4824	msedge.exe	114
PID 4824 wrote to memory of 1644	4824	msedge.exe	114
PID 4824 wrote to memory of 4060	4824	msedge.exe	115
PID 4824 wrote to memory of 4060	4824	msedge.exe	115
PID 4824 wrote to memory of 4060	4824	msedge.exe	115
PID 4824 wrote to memory of 2800	4824	msedge.exe	116
PID 4824 wrote to memory of 2800	4824	msedge.exe	116
PID 4824 wrote to memory of 2800	4824	msedge.exe	116
PID 4824 wrote to memory of 4640	4824	msedge.exe	117
PID 4824 wrote to memory of 4640	4824	msedge.exe	117
PID 4824 wrote to memory of 4640	4824	msedge.exe	117
PID 4824 wrote to memory of 4208	4824	msedge.exe	129
PID 4824 wrote to memory of 4208	4824	msedge.exe	129
PID 4824 wrote to memory of 4196	4824	msedge.exe	130
PID 4824 wrote to memory of 4196	4824	msedge.exe	130
PID 4824 wrote to memory of 4196	4824	msedge.exe	130
PID 4824 wrote to memory of 3052	4824	msedge.exe	131
PID 4824 wrote to memory of 3052	4824	msedge.exe	131
PID 4824 wrote to memory of 3052	4824	msedge.exe	131
PID 4824 wrote to memory of 1436	4824	msedge.exe	133
PID 2192 wrote to memory of 4272	2192	cmd.exe	140
PID 4632 wrote to memory of 5816	4632	cmd.exe	144
PID 3892 wrote to memory of 5124	3892	cmd.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tunnel5.dlproxy.uk/download/oFE-OnhoZW7HiBbs7-nI15YgzJaAOjmt_UvtaleF2QGqgjshrIGrJDCsxmOrrHtgJBp4xnwP4Q0tKCzlcWdOLesMzGujMka_Y39QIrHhOtSA3ZLCKqHik8gffqQeZAWKUGThONLu1epQ5wBzsaZ1l3ml1VBMkSGVsIy_qukkLlCPrb5d_q60d_4h0Hja5ycWmbTwuUEYuD37PV3KpoaioX_KZkUYub46Us2wPqLvkVnOA8VwSQ7ItfP9IPOOSkj_TA5pmGSNg7cenQ3rB8Oryq0XIQ2hs6jBwsd_ZFxF0bp5eRnRymC5mr_A_9KPplxEAwqPa1JwSBPB8_0ubB2g5H111tDu2Hf1xn2QywyGd-nj_FTm-luB7eb2xmi87nK9EiG-_2AWkDMTUbCFT_p9yQ?sig=OYZitT8S2E65vLGwt_H_WdNqC2N3Z00ACQXOLp8uX00
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x27c,0x7ffb745fc188,0x7ffb745fc194,0x7ffb745fc1a0
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,11503843520193805070,7946009962282861161,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,17863737397680145797,7778684543081544196,262144 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,8518966419201208576,7687336799595912027,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,10434935367045260516,14283963762808261700,2097152 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,6376590657947969091,6521316473422685710,2097152 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,6463624898888554758,11964860147654973697,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,13353143799720437843,5304633649858059548,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,14797084963422257406,18240186774775801614,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5668,i,12190618436469788104,12749938415487485495,2097152 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,6343704812429456576,11334541059072436114,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,6343704812429456576,11334541059072436114,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3584,i,1487647461169121315,5669740187242474427,2097152 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,11281475089066171679,7457620129593206864,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,10019298801387384154,12961396815567390812,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,3972859053754422469,8282228322603309575,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,7904032420086880465,6899315278731343441,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6956,i,13846377999744703059,16833124616862014051,262144 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,15679628519183456561,16811180272397000757,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5704,i,5471833113422564793,15239261473853916059,2097152 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5176,i,3182081194796977085,14685470585420821269,2097152 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5864,i,16269639745019940361,9105127583201935591,2097152 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,8386770349406898882,2289388544109144845,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6580,i,7560731366640825830,12944216189050159689,2097152 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5628,i,15580088301223745493,17143755795725414059,2097152 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,16708807115262107487,2348504935011195539,524288 --field-trial-handle=2116,i,17293003687025422862,8777803133575963623,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1260

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2600

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5136

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:3916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1140

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Big-Walk-AnkerGames\" -spe -an -ai#7zMap9431:100:7zEvent4823
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Run Me!.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\Big Walk.exe
  "C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\Big Walk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4272

C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\Big Walk.exe
"C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\Big Walk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Run Me!.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\Big Walk.exe
  "C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\Big Walk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Run Me!.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\Big Walk.exe
  "C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\Big Walk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8365d8597d396643eb3cb27ae8751c52f3b1ae3e25576cd2bd50becbaaae5ffd
MD5 b16e94a14013394e81faaffb1edb0866
SHA1 095be96d92aca0f788caa8c464e88fe0093428bb
SHA512 d08bfded37a6166d23fc97a47902156684e9e48ea9630c13d74b30f201e0b1cbdefd310a06a35543c33ad6c261585c043ccdbbaf6a515ba32c8540521104e42a
TLSH
T12CD022223B4AB000E2AB4132E2228740236908A128824604A218C86C4EA00C022C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 911e07e0fc86b71498aac8f24db642d92571fac2aadfbc582f8d4de4376567d6
MD5 83fc5fa3af6f8594dd2a663e21d12d45
SHA1 ef997108ce873f47039968b0bfec20942e002870
SHA512 bb9b65a3c0be85fb34a6b265d3d8e22f81bbc2f1a48de142059166a3bfdcb950010e99147a1868eea26375eca4818401878d8a66e818a9124e829b8da9a13e7e
TLSH
T144E0C04943C0C15B0DC1A047907DB31A1030F4C2FACDE958333EE38F3810990E7D6598
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ae99fdfc3fbac7deff206af98556f3993f1c3f40fe1176939f3effc93833bc8d
MD5 9683ee0effa2bfca240118d3a9a92e68
SHA1 7f5846f3cd2adc8fd0788f67733e1a66a9a4502d
SHA512 063dd8a1a4838b395fcd50939ca3e5b24ac72a8407ffd4463838b0b2ee5bb8d41938609e4216ead91f6f1a45a694113987c815ba88fb7d83f6eb6cc2fa33d737
TLSH
T194D02B9AFDEC9E5ED7E41ABD5BA5B4000A4802A2840B9B1300747EC03495AF01E25030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a691f6b48ec76550406468ffc24a4fcc040b316d289d7db263b054bc11db2f0d
MD5 a809165e7c56f9b784c1dbebfd3e620e
SHA1 d2090310863522ce1d6b0b98ebf3a7fd6c3eaa19
SHA512 5a8e4daae5d9f3c72824c2d2e94ff9da7f9629f5a9d0e77a04c30ed8988248a3e610ee10c6b4e069091f42860ac2d96dec3a105fa1d38f6babb3466c3afa843f
TLSH
T150E02BAAD831BD2B18FE1B5950905B06EB9013172791854B7B3E9209CFB423742868AC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b25c0d6734701892f0f20618b3d1946de49315e8b3b5549ac558edf14a6f4b86
MD5 a71d6ef176c6ba01bf5ffa4d3eb259d3
SHA1 9d80ad14ee3e10a6032be8c713062cbea6fe1c9f
SHA512 b6b7c91b7487dd5845b451b28fe909d8a613a0aff3a6d18469fb9244bee7d9349019993f9d1b3944b38f25ad22f76860fff997a7376dfbd276b8bd60a87e1be0
TLSH
T10F41AEF783F4856ECA1196F0EA18BE2FCE1D0514432C3DAA85E4AF1B93E2471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5e345c6f4271ac197ef9a8ee86c1c6bd0500a88a908478ebc74f32df7c4e5b06
MD5 81659b49bf4a6f71bdf705705eff74e0
SHA1 de22b6b48e8567cfe259f59c35ae5af8181bc57e
SHA512 3a13a5d8205630a1feb3747f60376ff759427346ee5bc2d7b65db6fa6581577df8e9afb6b8787baa8582a68b4136f180b2180b6110d752f51744436cb727c800
TLSH
T11631A0F783B4856ECA1196F0EA18BE2FCE1D0511432C7DAA85F4AF1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7ff112172cb2b54b477b54e6418816d7606acb977663cc300896142cb9e26168
MD5 3f773277a6e7aa010033125b69fb0fb8
SHA1 e1d87f58c9ffa042a03ff216f56d7acb1b0f9ad5
SHA512 9210e9d02c3ad9b11a86016188bcdc0f94da52d67a0af1c0b2e291e00eeb56d5d1b4ddf612c7733efa4236140a695daddbf1600e7b11b23ed072ea0a00e95bf3
SSDEEP 192:sxZrR2yMqZjK1Ml8UQY69a/fYsE+TCZtJezodpLHW6+WNGYqaNqxl/Ig5BlkJ:sxZrlqLa/fYsE+TEtJFLHbGdd/lo
TLSH
T1CD62E6156A389977CCDBD219FA857F93D7F95023A1904E44A9FC8E1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bfc951d0610b6546737e24c9a380bfdf4f27db92f9238249e6ca629866e2b1ac
MD5 926b242c36817ec05ec5732e1bad24a9
SHA1 9b30e6000f433cc776b37f950ac88fa9a624a09f
SHA512 fec187fe61bce5f7d6c1b47f856ce856426567bf25cf25ed655726940818716a49d346113f15ce864d73dc1997be3820aa21b616f8990131699fa1d039175c82
SSDEEP 192:sxZrR2yMqZjK1Ml8M9a/fYsmu+PCZtJezodpLHW6+WNGYqiNqol/IgjlkJ:sxZrl1a/fYsmu+PEtJFLHbGUdjlo
TLSH
T1D162D8156A349977CCDBD209FA457F93D7F95133A2904E48A9FC8A1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 651d18d7abaf1b4f4507289af79e93ffe95d6e230d9c89fe5a8aebdede26c27c
MD5 9dd7ae8c57ce3535e5c2baefe9ca8bf8
SHA1 42ae411589278d4b5e0d59c5b7cecdaffcbff912
SHA512 d3970861ce02bd450fc80ac93673893c9c190b78c5522e34d9398cded070a8ea2caf937ed0e05f9dcab65c8f17b0460350ce2b7ac68e6d0f0399bc5ac40ac43c
SSDEEP 768:+IM2tv5WvF32/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4sLl2cNV9rolDWr5ljo:+IM2tv5WvF32/u1ja1sLUcV2lqrc
TLSH
T1EED2FA3B680CCB7E4F840E9CDC265F976ED4018BA698495487FA494C03C77EB522B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3b15da60-2b0a-45cd-8620-f9f71b059842\index-dir\the-real-index
Size 2KB
SHA256 2cf3d2990702e118802e1d9f32c381c5dc202b02c40d560f6b6f1af3f049894c
MD5 8a659ba62fb8a1dace20ddfb93e24218
SHA1 5d5203e5d158cfcc113aa73f582ce19fbb855b8a
SHA512 96bbd1c3c4c52f5fc7d3a4a590720f094c643045b128636f6dc8dc213cb8af070d59e22d43f0a6a37c8f2e6879be1788604fce76767d17fdffe72bd6850cc7de
TLSH
T11041C68D8D85866FDD5849B314B278B833B4ACCC27409253AC7D233B7C5376E1A5B5AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d0811.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3b15da60-2b0a-45cd-8620-f9f71b059842\index-dir\the-real-index~RFe5d0811.TMP
Size 2KB
SHA256 012a66a3278f18fd226427fc61bd22f26bb1acfc26bf0e5837d82a956e685ae3
MD5 897716beb6f383d21acbe4800c664b1b
SHA1 e75b3c8d75b83075c457ec126fb46e31feaedf81
SHA512 002a597eab422eae7247fea68482ce864ac73e10b50d22ea62d61d8080e57c8c277ca01eded999c5c5c7f81b6fc5b042519d67ab9fa59e9e3432f25257c48510
TLSH
T19541868A4E41461FDCD044730993B4A43339D90097127B47B4BC563AB8A17BD3D5E1D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 bd289dd0416e6df8de4d22fb42522cdfe43350fdce26e911cc52335ebd47eee0
MD5 a5762d5f7b8a6dc1e8b83a16e9f22589
SHA1 a4831cfd7a837d2a60773d1d7a67a1fbfdf2254d
SHA512 5b0995f2ae4caf9509b6d6acb06976771dafd8f56d4d8d5c464d29b12a9826f44ba63c8dcfe049881e5c2c3d258324807ccf92bdaf19eb18801b93eca9958812
TLSH
T174E0D8BB3DE71920ED2FC3D5283144A4824578F4C8957C4E6859AAEB20B23053456C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 3d8e43f1db5d7bdc6ca420f0dac70ee1c880e6ff09ecc7dad4e8a29ac3a77762
MD5 811c95a690ef7b47a0d69c641932ee25
SHA1 018563f55a728c09a746483b1377aa0e4bab46d3
SHA512 d47b4ca4636ac728315d7b47305c664517893dc801f2dcea79b5732f6330f6510b03dd28b4230ed257b50694aae4724e7fe3b52e260769e2f26eed5126bee608
SSDEEP 96:KMkAKd6OezWKEADWcKHqy6UgKhCK7+Ko8iq68K3qYKAKjai6oIKp+SaUKXquWJSZ:KrFjPXY9/gfrWThFLh/DNTVl913Cpg
TLSH
T152B27E16303B16123CBD2808A7A6D6779E8231B33119E66F7BAC04664E67E125CFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 60de17af79a1908c60445c3a46369195224ed7e59cc695f7dd6ef82245224c74
MD5 ae2b7839ac05d6147d43be8f5db9cafc
SHA1 44cc400cb1f4b17318f56e3cf8190c8658721e9c
SHA512 71c370a3e13c765cfa506f3ecb1213ecd26cf4aa9bb0cf9acfb5d0cdbacf607ac2c546d57e246dc63a195a4b6d00a8956e776b0c248a4e0b496e7c0dab9a7db6
SSDEEP 384:nB5iFiZcIusNTZ8TUNTUlI4k+n7fWjvDC2iBfCUG3rBBmE1r0bTivn+aPty/7IgG:BQFQuewgTmhG7bz0ni/lFV
TLSH
T10FC23A35DC64C9B7BCE68BC5BB0A3607AEE4416395CC9AC8D9D95E1C00DB5ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d7bf152784e93706f82743643ea5c5236e4dfb21b581d0b8958bff95812584d6
MD5 68fb51a4250fbb6be07b3b684cd1528d
SHA1 e0b9142ce23d582cc7e6c98f389234f9ce1a1002
SHA512 a19d423138ba502bd9f7f3ff094f0c0d13ecc40a56bbf2b6d77fbc6e6bfee8ffaf78ef6a63f2b07bbcf01b37f77c5b4472c157ba80af747f49f7d8ce36325107
SSDEEP 384:nB5iFRZcI3sNL4Z8TUNTUlI4A+n7fWjTC2iBfCUG3rBBmE1r0bTivn+aPty/7IgG:BQF53giwg/OhG7bz0ni/lFV
TLSH
T1A1C23A36DC65C9B7B8EA8BC5F70A3607AEE0416395CC9AC4D9D85E1C00DB1ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f7cef692d14c46aa6457f3b34815ffa9e6ab15a00d718fbcdfa154569decb5ae
MD5 9659f202501889112e5237aeefd1cb0c
SHA1 06f778627a726f9d4fff58cac9f28d15dbe2eddc
SHA512 31bd629e82d30c0a4cb6b9198624b7bfb4e1733ad347fae21a8612dbd030b215f06f49b089ee1dd3e45add3bf32e8ca7c4f8efac069c5dab9731429cb4ef64f3
SSDEEP 384:nB5iFQZcIZsNL4Z8TUNTUlI4A+n7fWjiC2iBfCUG3rBBmE1rybTivn+aPty/7IgG:BQFuZgiwg/hhG7bzyni/lFV
TLSH
T119C23A36DC65C9B7B8E68B85F70A3607AEE4416395CC9AC4D9D85E1C00DB5ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 67d9746c31b44e3f2adc7e9a9e41af685ae8a462ccce1efbf3234ff351e1d249
MD5 7c7fdf57c01b8c408b835a70eac37ea4
SHA1 5ebca3a8ba7c9015d8c67794905b18bf55f470af
SHA512 4943160dc7225149befb215802406a416c6488c3fce2dd4cab70f703338e1eec82dc5483450d6e90a486904ee71183ef88767b2185c606ccfd92b62746693d3f
SSDEEP 384:n4miFiZcILsNTZ8TUNTUlI4kun7fWjvDC2iBfCUG3rBBmE1rNbTivn+aPty/7IgG:4NFQLewg7mhG7bzNni/lFV
TLSH
T1F8C23A32DC65C9B7BCEA8BC5B70A3607AEE4416399CC9AC8D5D95E1C00DB5ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 368c16d2127652d9babd638dd32bc287864613d7eca70e2d8657d1813bb9c624
MD5 f48e13f60fb26974ca0cced25fc9fc80
SHA1 9a341ce2347adc2862cae092451bc14b75da6b7f
SHA512 065d3285681eed1b938dafbed8bbc9a61d194f58270fde5dfc7588f9676c68069ce7a9614d90b24a51862191c89a10fc2759b06da3a9e865c339fcbf7d0c89cb
SSDEEP 384:nB5iFPZcIYsNL4Z8TUNTUlI4A+n7fWjmC2iBfCUG3rBBmE1rybTivn+aPty/7IgG:BQFHYgiwg/FhG7bzyni/lFV
TLSH
T1DCC23A36DC65C9B7B8E68BC5F70A3607AEE4416399CC9AC4D9D85E1C00DB1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 3a0de8e7549f4eba1d744e65b3a040e964202bf947371291dba5923d0f8be773
MD5 e1ccb97a721a95b5408d4e03c1beaf65
SHA1 5de3ae3861cf78bd4b20008393517f3dcbe8b9a6
SHA512 53512c717177898f5a0a92fa353e333c88816cab63182a21382e9fb839d38582c7ef0a8e570d3d36029b96468bd7f4730a243e5f22019029449c0bba93b46412
SSDEEP 384:n4miF9CcmyWCkx3sNTZ8TUNTUlI4kqn7fWjTC2iBfCUG3rBBmE1rxbT9kdFty/7+:4NFccpy3ewgHOhG7bzxn9O7
TLSH
T13DB24A36EC65CAB7ECEA5B85F74A3603DEE0416789C89AD8DAD85D0C01DB1ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1162880d32cc2f12f99e966f088d0da973df8346928a6313f23967d4c33a5db4
MD5 6ed5d549934189797c281d6de0b68a89
SHA1 55b9f3781cf53b9f2ec66b6f3e83299b001ec25e
SHA512 4d2e548a7e79a561e71d71d008e17cc178f5fd5baf4a6732d2171a500597dd9cfe5fe190f2e303dfb6881e8f6d7a33f957707dc7ec3d5aa8f7715ebe7e6b4f3d
SSDEEP 384:nBmiFiZcILsNTZ8TUNTUlI4k+n7fWjvDC2iBfCUG3rBBmE1rNbTivn+aPty/7IgG:BNFQLewgTmhG7bzNni/lFV
TLSH
T161C24A36DC65C9B7BCEA8BC5B70A3607AEE0416395CC9AC8D9D95E1C00DB5ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0af9b10986b306ff654e470d6c186a7359cf29a33013db4bda55fda90ec5953a
MD5 cd653ca1da8ed0727c663b5d1239f83a
SHA1 0debeb3e8aad3a91d54bf7c084e653f405e3f5b5
SHA512 0136af75ff7b72920b065df57a557ab83352c595e75dbfed97c2320d3a299574043f95f51b5a1718a92d8e275ab62a57f81ed396afc77de758de66233cf9a5fd
SSDEEP 384:nTiF9CcmyWCs3sN/8TUNTUlImkrn7fWmRmiBfCUG3rBBmtde4KV8p0QHbty/7Ig/:+Fccps3EwgzRG7bodI8p0SI
TLSH
T199B26C35EC65C9BBECE64F89B74B3A03EEE0116785D89AD8DAD85D0C00971DD130B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 daf0d02c632c7bb30fd0e436da36809a6b21565cd45563ee5c0d93cddb9e6b8c
MD5 07cda16a703f19e386099914c82f58ba
SHA1 6a7b1c512688335990c73aaf64345038d5ff1f9c
SHA512 d8e87aa569e000e5add72bb85b3292ed7ff2f5c0b568f4ff29b6929a0e7588a985356271e5ec130a382f95e1019bdd102c58fc113c3bc99de2adb1d72ad06d25
SSDEEP 384:nsmiF9CcmyWCs3sNHZ8TUNTUlImkrn7fWUiD3iBfCUG3rBBmE1rxbTe4KV8p0QHI:sNFccps3uwg/M2G7bzxnI8p0SI
TLSH
T165C25B31EC55C9BBECE64B99B70B3603EEE0526786C89AD8DAD85D0C00DB1ED570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 123dfaa9ee1ad8e60187ef53e2d1446ee82668dd80479f1bbba25a25c8288f1f
MD5 93c35f25d8629e91ee289ebc5b4f1b5c
SHA1 05c7341c81c0c5a2ad3e8090239962b128a6602a
SHA512 4d726387581cfa9d0163a07d5f3374f0af6df64de409db8a3bc1e69cee13ef0dcd25f1376321f9cc87b119ed0c7d45937dd8509f77d2a055f407d942882719c3
TLSH
T160410658BAFA1108B3B72F5AABF6A86E547EBC332E07D55E10110E4F0662A40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

Big Walk.exe

Path C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\Big Walk.exe
Size 651KB
SHA256 0a028a824131983558d0bec7fc7dfd89981894672263778d8e26bd3f76f308a6
MD5 89427a96fede3f05aa71694654d1f685
SHA1 935d9cbd88164449504161710fc841947bf18ed2
SHA512 d6bd9a09d7fe8dde9a8d2aa7c8c4c3757035e2f3740db6e03a2387a63186642746c2355218bc7bfc0371ff8d3ddde69ffd653b4c42093b970c29c3a70e8f167d
SSDEEP 6144:maMjvuUwZpwUhLjKMovDgqIu/boyrpe4+dJibLkka:mtVwZpxh/KMovDgqIu/boyrperdJOw
TLSH
T1ECE43702A6A4F0A5D45642F0CC628FF657EC9D17DE426B5B069C7C023933F9FEA11A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamOverlay64.dll

Path C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\SteamOverlay64.dll
Size 114KB
SHA256 f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df
MD5 0a5429b888c75f6525e1100e32dd2b69
SHA1 8ae224580aa0838a7b1570c79d4d8f27a1b46d19
SHA512 5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef
SSDEEP 1536:h1iaPnCtV4+1/IGiaA7bSMhP3rOy843NxnpWJtRsWkd09dl38s6BtcBRXh4:h1iaPn5+uGi/7bpxaX43Ni3aMLJB1h
TLSH
T163B34A5B73E500BBE0768239C8A71A15D376B8110760DBEF03A0466A1F277E19D3EF62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityPlayer.dll

Path C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\UnityPlayer.dll
Size 34.8MB
SHA256 723633283c8e8886bc3a0ee3d155ad12c4928abd6d447d6d5c5c5f7aa1066efa
MD5 6f5f565e316e7232a970a549a27b207f
SHA1 de7a38790f3cc404a994231c2d29312cb027458d
SHA512 2ea6c9724653dae9c8f3462fc48be6f26cf3c25cbe69accd8cd3f581130fb102207d5cedda8bfe583615ba2941e0233faeb01976c3c90d552dde8aa7fd300bd8
SSDEEP 393216:DR4/etUbxY2Uab4gF/ZbY9edVbkOt52fQh0KNB451JLo4qnX+Rb:D0ZTdmQh0V1JynX8b
TLSH
T15A87AE5662B801D8D47BC078D65BAA1BFBB1344903309AEB52E049A56F33FF16A7F350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dlllist.txt

Path C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\dlllist.txt
Size 35B
SHA256 662dd415e2796635702c49586fb99ae62a3c6f595976d6923ec8a4e7c23fa8fe
MD5 ff98c62757cb7c9f5dbedcd67d3781f6
SHA1 82076991ee9a824bcf9969b416fcc163d02a6160
SHA512 42973bbb4feb375354684c0356c45bfa7f0bf63056906244c2c0ac89720326cfa41c9aa51e2522d1d9da66c019ccf3dba570a732007e8b3306e66920faaae791
MD5 SHA1 SHA512

Submit Download

winmm.dll

Path C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Big Walk\winmm.dll
Size 490KB
SHA256 063a8d5e57cd760a8eafb3573146cc97e18180412a5a0efc23614e23dc1a2568
MD5 3fb1fae80a788ffd42b7f7047bc0903d
SHA1 079be776a6618e43865bb4c033e119fcb7ae3306
SHA512 08f994f0f4e8f268e77d29556eef805cb3405862fa9986c7e7dd15d5257e2d7366a4e77e07d6a4ba693fc2bc53be0f13eb36a5ee36b8e1dd2d05a8c394f14221
SSDEEP 6144:zz01cAnrjsEtjiT5BZhK6H8jEY6tbNUvvJgVGs3YUlXULmyU1vwjmvy:vecAnrJjefK6c5vqVGGNXULmJvmk
TLSH
T178B48F19A2A842B9E567E178C9430A07E7B1BC464761D7CF03E09BBB2F277E0563E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Run Me!.bat

Path C:\Users\Admin\Downloads\Big-Walk-AnkerGames\Run Me!.bat
Size 1KB
SHA256 044f05fb96aac85336fbacd481fd67183bee06fbace69d64c866fcbb0c0568a0
MD5 5b49080725e8cdb0bb3b068f2b3b2be1
SHA1 9c544ecbcb4015f78b1cb43fdf10a9a200ad0602
SHA512 10d7288171bce231eb5d7b35758d2cdd0e19f534e6062b6186c86e2fa75f61bc023442d2b4d2af9b122e3814b1f408cae617640d6d5aa24f0f3bbfada371224e
TLSH
T12E316A797ACC69D3099D40085B2EC690302A434F7904FFAC151A993FA97EBCD1DFE544
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.log

Path C:\Users\Admin\Downloads\Big-Walk-AnkerGames\launcher.log
Size 325B
SHA256 ffa2baa47ae99db8165e5873c12cb24794c27d01600ba1574762c289eba59ae7
MD5 875ffa6d1ae56ca071605d4242347879
SHA1 f5dfc0a6bf1110c337df30b789f3d566f94e6f84
SHA512 b3b283ee11c4c7ea49e6f4b96b038895a3bd6de07248f258ccb0a57ec42d530b1fabc934750a1c91bc3c819239fe329e2cd785681c4ba0effc0d599ca49781f7
TLSH
T1D1E012DA04CF970B0760E0178F39A56C44F594422E016ACC8E7169D3F5197BC9456543
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.log

Path C:\Users\Admin\Downloads\Big-Walk-AnkerGames\launcher.log
Size 750B
SHA256 7ffd3391a54687196c9e11878bcc8f785652e5e8ad9207211d38b192e247b571
MD5 80a162f8d56fee40a064bcd82818399c
SHA1 997395bb778f5485611b2b76c9fcf2df630c9cfb
SHA512 308d9eb2f34c6fab3620801d99cbbf6df6ce5f68f5a58b9cd1e8c8f8e1416a178d00447d4f35238a1686de8ef33cf49fc6efa6f833d4e9ca51b9b522e207e9db
TLSH
T1C9013CDA04CFA60A0761E0168F39A56C94F5A8422E01ABCCCE7169D7F90A7BC9496543
MD5 SHA1 SHA512 TLSH

Submit Download