Overview

overview

8

Static

static

3

PCSX2-v2.6...er.exe

windows10-2004-x64

8

PCSX2-v2.6...er.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/05/2026, 10:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PCSX2-v2.6.3-windows-x64-installer.exe
  • Size 50.4MB
  • Sample260516-m2fbtsfz4p
  • SHA256 1f022c5fd36fcf968edbf311eb4b87f84988f526d8fe3babda8e07a3dce38171
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryinstallerransomware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 19 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\PCSX2-v2.6.3-windows-x64-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\PCSX2-v2.6.3-windows-x64-installer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:700
    • C:\Users\Admin\AppData\Local\Temp\is-9FE62SWFBW.tmp\PCSX2-v2.6.3-windows-x64-installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-9FE62SWFBW.tmp\PCSX2-v2.6.3-windows-x64-installer.tmp" /SL5="$901C4,51549520,1140224,C:\Users\Admin\AppData\Local\Temp\PCSX2-v2.6.3-windows-x64-installer.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Users\Admin\AppData\Local\Temp\is-YT6O5JC8JI.tmp\VC_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-YT6O5JC8JI.tmp\VC_redist.x64.exe" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2072
        • C:\Windows\Temp\{2221DF93-6FBF-45AA-BD74-D1DC043B5DC0}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{2221DF93-6FBF-45AA-BD74-D1DC043B5DC0}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-YT6O5JC8JI.tmp\VC_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /q /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3532
          • C:\Windows\Temp\{6AFF0177-E31E-4B53-844E-E6F62BE42C6B}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{6AFF0177-E31E-4B53-844E-E6F62BE42C6B}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BCA2304D-DBF0-469E-909A-44F2D5C920E1} {4117CE4B-DF94-4F96-9C9E-33138CE8355E} 3532
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:692
      • C:\Program Files\PCSX2\pcsx2-qt.exe
        "C:\Program Files\PCSX2\pcsx2-qt.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1776
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/vs/17/release/vc_redist.x64.exe
          4⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2136
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff8e768c188,0x7ff8e768c194,0x7ff8e768c1a0
            5⤵
              PID:2224
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,11219311891623576132,7531313248940918564,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
              5⤵
              • Downloads MZ/PE file
              • System Time Discovery
              PID:3792
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,2761397451783219868,17914973201709868480,262144 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
              5⤵
                PID:3228
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,309217057111769997,5098753291323601470,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
                5⤵
                  PID:2956
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,7715313771092892441,16480445954731062356,2097152 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
                  5⤵
                    PID:2080
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,9177478748141391720,17960679536341863975,2097152 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
                    5⤵
                      PID:368
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,3422526992961581261,10174178538092671676,2097152 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
                      5⤵
                        PID:4652
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,15591176405885900814,14708085859545863944,2097152 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
                        5⤵
                          PID:4460
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,13629251081716682714,5546450075817025367,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
                          5⤵
                            PID:1896
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,3971480443043978834,3097508800513777635,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
                            5⤵
                              PID:3620
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,12130217461916280152,9246950999852538042,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
                              5⤵
                                PID:560
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,830640197549080222,17941537609818673641,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
                                5⤵
                                  PID:4372
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,13565908696834208094,17889254890945364351,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
                                  5⤵
                                    PID:4656
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5692,i,13137550677453691010,2957121186783950708,2097152 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
                                    5⤵
                                      PID:4772
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,8552982889515997466,15205998547938157172,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
                                      5⤵
                                        PID:2700
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,8552982889515997466,15205998547938157172,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
                                        5⤵
                                          PID:2036
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,14849472382536822738,5071745439888418466,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
                                          5⤵
                                            PID:4648
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,11301834032648116507,9388891237663721922,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
                                            5⤵
                                              PID:3624
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,10234337226922652513,884616164169575810,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
                                              5⤵
                                                PID:4292
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,14955386639910568919,1383008569915381998,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
                                                5⤵
                                                  PID:4024
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,12205689909974184060,6322959719606390179,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
                                                  5⤵
                                                    PID:2736
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,4205624533647351937,7361529250292207276,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
                                                    5⤵
                                                      PID:2216
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,5626944466663052948,3666829051179840919,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
                                                      5⤵
                                                        PID:3488
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,6270949753215546751,10583536592050263707,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
                                                        5⤵
                                                          PID:4552
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,2823306815753911253,7841416744164648742,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
                                                          5⤵
                                                            PID:2496
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,17344888374116771571,18325245340386460277,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
                                                            5⤵
                                                              PID:2372
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,9322333768720375183,14903521949089226173,524288 --field-trial-handle=2308,i,11853317808364447741,17266587428516576382,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
                                                              5⤵
                                                                PID:3672
                                                      • C:\Windows\system32\vssvc.exe
                                                        C:\Windows\system32\vssvc.exe
                                                        1⤵
                                                        • Checks SCSI registry key(s)
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1692
                                                      • C:\Windows\system32\srtasks.exe
                                                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2316
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                        1⤵
                                                          PID:2144
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                          1⤵
                                                            PID:2100
                                                          • C:\Windows\system32\BackgroundTaskHost.exe
                                                            "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                                                            1⤵
                                                              PID:4652

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  Qt6Core.dll
                                                                  • Path C:\Program Files\PCSX2\Qt6Core.dll
                                                                  • Size 8.5MB
                                                                  • SHA256 7e740a93adc04eebc0887baa1266578599f54d8290dd48afeaeae8bb65270f55
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Qt6Gui.dll
                                                                  • Path C:\Program Files\PCSX2\Qt6Gui.dll
                                                                  • Size 5.4MB
                                                                  • SHA256 8c348df9270b67d2d139db3b293dfc852aea7a83b7d3dce6219f8170d3cb27a2
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Qt6Widgets.dll
                                                                  • Path C:\Program Files\PCSX2\Qt6Widgets.dll
                                                                  • Size 5.0MB
                                                                  • SHA256 0a0355099a440e67ec8c4941873bcddaab5f7213cfa9da356f6c5cf5808b13a1
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  SDL3.dll
                                                                  • Path C:\Program Files\PCSX2\SDL3.dll
                                                                  • Size 3.9MB
                                                                  • SHA256 12ece2a56c695fb2a100ea7b8c9ec888ca763de43db0dff887c060496b01f5f4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  freetype.dll
                                                                  • Path C:\Program Files\PCSX2\freetype.dll
                                                                  • Size 681KB
                                                                  • SHA256 7678a7de3d5cfcc17374e0278d139ea5846affa0a149032719192003c3e40671
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  harfbuzz.dll
                                                                  • Path C:\Program Files\PCSX2\harfbuzz.dll
                                                                  • Size 1.1MB
                                                                  • SHA256 53703d53a09725057c91d0a32e3b7dbc0d9fe3fbfc0ec5e1b32bac3c160eb9b0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  icuuc.dll
                                                                  • Path C:\Program Files\PCSX2\icuuc.dll
                                                                  • Size 36KB
                                                                  • SHA256 9e132fc1cae204b3be8d5bc56fa1049d6eb2ae5a9701b84bb2ccd4af812e28b5
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  jpeg62.dll
                                                                  • Path C:\Program Files\PCSX2\jpeg62.dll
                                                                  • Size 670KB
                                                                  • SHA256 efed454602fdaef9a22030efe5d9f6a1593195f40295d057ddce871696aa4ea0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  kddockwidgets-qt6.dll
                                                                  • Path C:\Program Files\PCSX2\kddockwidgets-qt6.dll
                                                                  • Size 1.4MB
                                                                  • SHA256 dd84de431ba58edcce89f305845a39c3f8dcfdc934d25fd5ab291ff81f33dcfd
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  libpng16.dll
                                                                  • Path C:\Program Files\PCSX2\libpng16.dll
                                                                  • Size 202KB
                                                                  • SHA256 4993ec7f4998c99488b5e593154c0a87ce75016ca7137dc094a4ef793d1bde27
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  libsharpyuv.dll
                                                                  • Path C:\Program Files\PCSX2\libsharpyuv.dll
                                                                  • Size 24KB
                                                                  • SHA256 45273629b59d53c1209ca3e061ad41f92dc3bcaea8d3993f4c7465243b3a7b40
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  libwebp.dll
                                                                  • Path C:\Program Files\PCSX2\libwebp.dll
                                                                  • Size 364KB
                                                                  • SHA256 f727f1d497df96c616e467a6f351aa3ce4235ebfe16f59301b44f6d0c96d4f86
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  lz4.dll
                                                                  • Path C:\Program Files\PCSX2\lz4.dll
                                                                  • Size 124KB
                                                                  • SHA256 1eba518745ff7be6c1975c3cf9215a9ae9820ea5a40687b16042f0106ff3d64b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  pcsx2-qt.exe
                                                                  • Path C:\Program Files\PCSX2\pcsx2-qt.exe
                                                                  • Size 14.0MB
                                                                  • SHA256 474dc24acf00ee398183235a15c97934bf099c2fa458dcc0cb174750aebe3cff
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  plutosvg.dll
                                                                  • Path C:\Program Files\PCSX2\plutosvg.dll
                                                                  • Size 54KB
                                                                  • SHA256 c4f1d6f8c485aaca3abaf007d7997765efff426f38f5fc508a500320d470010c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  plutovg.dll
                                                                  • Path C:\Program Files\PCSX2\plutovg.dll
                                                                  • Size 248KB
                                                                  • SHA256 9266323d999c38a94f476e8a8fbd175e5c4b5b41fe211933b9d223f6881e42b5
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  zlib1.dll
                                                                  • Path C:\Program Files\PCSX2\zlib1.dll
                                                                  • Size 88KB
                                                                  • SHA256 52a86ec85bfd1562f28dae626c5ef7272f44321c252b9420f83f02025687c056
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  zstd.dll
                                                                  • Path C:\Program Files\PCSX2\zstd.dll
                                                                  • Size 643KB
                                                                  • SHA256 0684d2302c33b443d2059f3d4bb1f8b096423fa2922459eea5a5d0269a723ac0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2136_1389148554\manifest.json
                                                                  • Size 43B
                                                                  • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 3KB
                                                                  • SHA256 6060bb86d509d3282816d647d2369287a48e4c4f6955ef76e860d40a64251a43
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index~RFe59b5c9.TMP
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b5c9.TMP
                                                                  • Size 3KB
                                                                  • SHA256 60c92611fb1270dcd57bfc7bfbb9d7e9f8bab6003e2e2a0b54dbf5b841912878
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Edge Profile.ico
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                  • Size 70KB
                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  HubApps
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                  • Size 106KB
                                                                  • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Network Persistent State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                  • Size 111B
                                                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Network Persistent State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                  • Size 1KB
                                                                  • SHA256 c9db6339a90dad5e2be6c47e4db50177546f4cfd16dc5af671ae6a0a650d4ca8
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  SCT Auditing Pending Reports
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                  • Size 2B
                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                  • Size 13KB
                                                                  • SHA256 97039c6f27e2e69bf8c9b29894505cc7baf23655c15558f77def96ff73a01ea9
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Secure Preferences
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                  • Size 35KB
                                                                  • SHA256 8b9da07f3c0b98721c5cb025c942662e5dabd70f3eaccf9d523f0a04b343f7c3
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  sync_diagnostic.log
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                  • Size 4KB
                                                                  • SHA256 6b81d2f7473b71b82aa8de4f4976cb6264311faf69a997821b101c8ed965dbb2
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  OperationConfig
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                  • Size 22KB
                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  OperationConfig~RFe5a5342.TMP
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5342.TMP
                                                                  • Size 3KB
                                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 18KB
                                                                  • SHA256 c5cbfb0620c3fd526add35152ca764d0afab1eab8910ee9681059fc73b37121a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 18KB
                                                                  • SHA256 fd957b17f82ce34332b0af21096e307a87e77a598ee280d733e72b160e5aebb4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 8KB
                                                                  • SHA256 483449fac9f202212a4a2838b608b8ee671f017f4683e7e39197f1c08667dfe1
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 12KB
                                                                  • SHA256 6da92f4634333906c1a48a7fe9a9856ba84ece6a4d37f5cca9d73c2a07999e0c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 23KB
                                                                  • SHA256 85979c3b5be796b748824918d2af85155d57cf0260cf39255631bdeeb293fe72
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  Local State
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                  • Size 8KB
                                                                  • SHA256 b14c9053e065d29ff111ae105b36f6281262dfe1faa8a1dfb376df1329fa51f8
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                  • Size 132B
                                                                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  9caf18e5-fd4d-46d0-a7b9-738cf5848360.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9caf18e5-fd4d-46d0-a7b9-738cf5848360.tmp
                                                                  • Size 13B
                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                  • Size 2KB
                                                                  • SHA256 5e68c30ef641906c66b90998e4013fb2f88f642ecea741310d3d6c004c862e44
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  c5e17c0e-2dde-469d-896d-96e492223bb8.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c5e17c0e-2dde-469d-896d-96e492223bb8.tmp
                                                                  • Size 1B
                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  f39eaded-680d-488c-b716-e9eb435b7ce8.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\f39eaded-680d-488c-b716-e9eb435b7ce8.tmp
                                                                  • Size 10KB
                                                                  • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  PCSX2-v2.6.3-windows-x64-installer.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-9FE62SWFBW.tmp\PCSX2-v2.6.3-windows-x64-installer.tmp
                                                                  • Size 4.4MB
                                                                  • SHA256 d1af9c61fc1219b190091fee99e4fd643b168c6459d7417f8b259d4edc71cb3f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  VC_redist.x64.exe
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-YT6O5JC8JI.tmp\VC_redist.x64.exe
                                                                  • Size 24.4MB
                                                                  • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  content_new.js
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2136_1281965377\CRX_INSTALL\content_new.js
                                                                  • Size 10KB
                                                                  • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  db6f44c0-3c6f-4cba-9fdb-dc19fccd6f23.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2136_1357623023\db6f44c0-3c6f-4cba-9fdb-dc19fccd6f23.tmp
                                                                  • Size 147KB
                                                                  • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  VC_redist.x64.exe
                                                                  • Path C:\Windows\Temp\{2221DF93-6FBF-45AA-BD74-D1DC043B5DC0}\.cr\VC_redist.x64.exe
                                                                  • Size 670KB
                                                                  • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  logo.png
                                                                  • Path C:\Windows\Temp\{6AFF0177-E31E-4B53-844E-E6F62BE42C6B}\.ba\logo.png
                                                                  • Size 1KB
                                                                  • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  wixstdba.dll
                                                                  • Path C:\Windows\Temp\{6AFF0177-E31E-4B53-844E-E6F62BE42C6B}\.ba\wixstdba.dll
                                                                  • Size 215KB
                                                                  • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  memory/700-7-0x0000000000180000-0x00000000002A5000-memory.dmp
                                                                  Download

                                                                  memory/700-601-0x0000000000180000-0x00000000002A5000-memory.dmp
                                                                  Download

                                                                  memory/700-0-0x0000000000180000-0x00000000002A5000-memory.dmp
                                                                  Download

                                                                  memory/1776-598-0x00007FF8E8F50000-0x00007FF8E9459000-memory.dmp
                                                                  Download

                                                                  memory/1776-597-0x00007FF7DCEB0000-0x00007FF7DDEB0000-memory.dmp
                                                                  Download

                                                                  memory/2096-11-0x0000000000250000-0x00000000006CF000-memory.dmp
                                                                  Download

                                                                  memory/2096-5-0x0000000000B10000-0x0000000000B11000-memory.dmp
                                                                  Download

                                                                  memory/2096-13-0x0000000000250000-0x00000000006CF000-memory.dmp
                                                                  Download

                                                                  memory/2096-600-0x0000000000250000-0x00000000006CF000-memory.dmp
                                                                  Download

                                                                  memory/2096-503-0x0000000000250000-0x00000000006CF000-memory.dmp
                                                                  Download

                                                                  memory/2096-8-0x0000000000250000-0x00000000006CF000-memory.dmp
                                                                  Download

                                                                  memory/2096-9-0x0000000000B10000-0x0000000000B11000-memory.dmp
                                                                  Download