Overview

overview

8

Static

static

3

PCSX2-v2.6...er.exe

windows10-2004-x64

8

PCSX2-v2.6...er.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/05/2026, 10:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PCSX2-v2.6.3-windows-x64-installer.exe
  • Size 50.4MB
  • Sample260516-m2fbtsfz4p
  • SHA256 1f022c5fd36fcf968edbf311eb4b87f84988f526d8fe3babda8e07a3dce38171
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryinstallerransomware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 21 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\PCSX2-v2.6.3-windows-x64-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\PCSX2-v2.6.3-windows-x64-installer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5048
    • C:\Users\Admin\AppData\Local\Temp\is-IRHLCGU0LZ.tmp\PCSX2-v2.6.3-windows-x64-installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-IRHLCGU0LZ.tmp\PCSX2-v2.6.3-windows-x64-installer.tmp" /SL5="$502DA,51549520,1140224,C:\Users\Admin\AppData\Local\Temp\PCSX2-v2.6.3-windows-x64-installer.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Users\Admin\AppData\Local\Temp\is-CGS44BSPFJ.tmp\VC_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-CGS44BSPFJ.tmp\VC_redist.x64.exe" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3896
        • C:\Windows\Temp\{B42B794A-0996-4A09-96AC-3D6CC6F9C28F}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{B42B794A-0996-4A09-96AC-3D6CC6F9C28F}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-CGS44BSPFJ.tmp\VC_redist.x64.exe" -burn.filehandle.attached=732 -burn.filehandle.self=696 /q /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3596
          • C:\Windows\Temp\{7AE6E5D6-1007-4390-90F8-E7E56E4702FB}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{7AE6E5D6-1007-4390-90F8-E7E56E4702FB}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0B12F309-C7D7-4CD2-B7EC-BCBE1ED2D66D} {6CF09568-3E75-445C-B060-82DD5EA28C38} 3596
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4184
      • C:\Program Files\PCSX2\pcsx2-qt.exe
        "C:\Program Files\PCSX2\pcsx2-qt.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/vs/17/release/vc_redist.x64.exe
          4⤵
          • Drops file in Windows directory
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4544
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x304,0x7ffacd37c188,0x7ffacd37c194,0x7ffacd37c1a0
            5⤵
              PID:3028
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,17432590339332308546,3452383445245273213,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
              5⤵
              • Downloads MZ/PE file
              • System Time Discovery
              PID:2068
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,6122258444600619970,5622128219142038029,262144 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
              5⤵
                PID:3792
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,11736428853898987121,17659948597584717289,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
                5⤵
                  PID:1324
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,13261460130281304045,9283124348811285791,2097152 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
                  5⤵
                    PID:1512
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,629983438988543795,5161174099608042676,2097152 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
                    5⤵
                      PID:3720
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,17936125282048352381,14825610408639257751,2097152 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
                      5⤵
                        PID:3536
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,2106852079096502527,17889464637652734963,2097152 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
                        5⤵
                          PID:3252
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4296,i,8360929489432620302,9542137910066079184,2097152 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
                          5⤵
                            PID:3312
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4364,i,10421120088782505650,2501898323390465656,2097152 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:9
                            5⤵
                              PID:1112
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,13483650390137705024,14310381701113070055,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
                              5⤵
                                PID:2656
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,862099370823159610,11158747336499806103,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
                                5⤵
                                  PID:5116
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,2184729698728691080,8815772040602616788,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
                                  5⤵
                                    PID:4084
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,6828516230239283759,12091070498364817380,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
                                    5⤵
                                      PID:1468
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,13857588420421075333,11341004688943885199,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
                                      5⤵
                                        PID:676
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6044,i,14902733512490606347,8991824481456845719,2097152 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
                                        5⤵
                                          PID:4404
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,18404659340524893742,11060074885241472721,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
                                          5⤵
                                            PID:3776
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,18404659340524893742,11060074885241472721,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
                                            5⤵
                                              PID:3540
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,7585104146473274264,11648144145417998661,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
                                              5⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3812
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                cookie_exporter.exe --cookie-json=1128
                                                6⤵
                                                  PID:1896
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,5519091151024264718,1907024820440621248,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
                                                5⤵
                                                • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                • NTFS ADS
                                                PID:1588
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,5083075956136104152,14094670321604506886,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:14
                                                5⤵
                                                  PID:3332
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,16225764697507905852,5603958558178046234,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:14
                                                  5⤵
                                                    PID:1788
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,15104332457427036502,17679468548014520207,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14
                                                    5⤵
                                                      PID:1828
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,16352542096571828484,7758010297540949597,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
                                                      5⤵
                                                        PID:1848
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7208,i,11747241852651725187,13944453472150469736,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:14
                                                        5⤵
                                                          PID:2516
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,16771967169659361573,11605392165246234392,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
                                                          5⤵
                                                            PID:544
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,4344287576539679993,2629447265915509970,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
                                                            5⤵
                                                              PID:2292
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,13989206752716029902,2198153622556867454,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
                                                              5⤵
                                                                PID:468
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,13426853424103194623,16306698800402458243,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
                                                                5⤵
                                                                  PID:2908
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,18139296546004736174,18278625720491899652,524288 --field-trial-handle=2144,i,14264596945467656817,6618118106815958950,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
                                                                  5⤵
                                                                    PID:2864
                                                          • C:\Windows\system32\vssvc.exe
                                                            C:\Windows\system32\vssvc.exe
                                                            1⤵
                                                            • Checks SCSI registry key(s)
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1080
                                                          • C:\Windows\system32\srtasks.exe
                                                            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                            1⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1192
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                            1⤵
                                                              PID:2908
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                              1⤵
                                                                PID:556

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    Qt6Core.dll
                                                                    • Path C:\Program Files\PCSX2\Qt6Core.dll
                                                                    • Size 8.5MB
                                                                    • SHA256 7e740a93adc04eebc0887baa1266578599f54d8290dd48afeaeae8bb65270f55
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Qt6Gui.dll
                                                                    • Path C:\Program Files\PCSX2\Qt6Gui.dll
                                                                    • Size 5.4MB
                                                                    • SHA256 8c348df9270b67d2d139db3b293dfc852aea7a83b7d3dce6219f8170d3cb27a2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Qt6Widgets.dll
                                                                    • Path C:\Program Files\PCSX2\Qt6Widgets.dll
                                                                    • Size 5.0MB
                                                                    • SHA256 0a0355099a440e67ec8c4941873bcddaab5f7213cfa9da356f6c5cf5808b13a1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SDL3.dll
                                                                    • Path C:\Program Files\PCSX2\SDL3.dll
                                                                    • Size 3.9MB
                                                                    • SHA256 12ece2a56c695fb2a100ea7b8c9ec888ca763de43db0dff887c060496b01f5f4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    freetype.dll
                                                                    • Path C:\Program Files\PCSX2\freetype.dll
                                                                    • Size 681KB
                                                                    • SHA256 7678a7de3d5cfcc17374e0278d139ea5846affa0a149032719192003c3e40671
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    harfbuzz.dll
                                                                    • Path C:\Program Files\PCSX2\harfbuzz.dll
                                                                    • Size 1.1MB
                                                                    • SHA256 53703d53a09725057c91d0a32e3b7dbc0d9fe3fbfc0ec5e1b32bac3c160eb9b0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    icuuc.dll
                                                                    • Path C:\Program Files\PCSX2\icuuc.dll
                                                                    • Size 36KB
                                                                    • SHA256 9e132fc1cae204b3be8d5bc56fa1049d6eb2ae5a9701b84bb2ccd4af812e28b5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    jpeg62.dll
                                                                    • Path C:\Program Files\PCSX2\jpeg62.dll
                                                                    • Size 670KB
                                                                    • SHA256 efed454602fdaef9a22030efe5d9f6a1593195f40295d057ddce871696aa4ea0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    kddockwidgets-qt6.dll
                                                                    • Path C:\Program Files\PCSX2\kddockwidgets-qt6.dll
                                                                    • Size 1.4MB
                                                                    • SHA256 dd84de431ba58edcce89f305845a39c3f8dcfdc934d25fd5ab291ff81f33dcfd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libpng16.dll
                                                                    • Path C:\Program Files\PCSX2\libpng16.dll
                                                                    • Size 202KB
                                                                    • SHA256 4993ec7f4998c99488b5e593154c0a87ce75016ca7137dc094a4ef793d1bde27
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libsharpyuv.dll
                                                                    • Path C:\Program Files\PCSX2\libsharpyuv.dll
                                                                    • Size 24KB
                                                                    • SHA256 45273629b59d53c1209ca3e061ad41f92dc3bcaea8d3993f4c7465243b3a7b40
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libwebp.dll
                                                                    • Path C:\Program Files\PCSX2\libwebp.dll
                                                                    • Size 364KB
                                                                    • SHA256 f727f1d497df96c616e467a6f351aa3ce4235ebfe16f59301b44f6d0c96d4f86
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    lz4.dll
                                                                    • Path C:\Program Files\PCSX2\lz4.dll
                                                                    • Size 124KB
                                                                    • SHA256 1eba518745ff7be6c1975c3cf9215a9ae9820ea5a40687b16042f0106ff3d64b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    pcsx2-qt.exe
                                                                    • Path C:\Program Files\PCSX2\pcsx2-qt.exe
                                                                    • Size 14.0MB
                                                                    • SHA256 474dc24acf00ee398183235a15c97934bf099c2fa458dcc0cb174750aebe3cff
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    plutosvg.dll
                                                                    • Path C:\Program Files\PCSX2\plutosvg.dll
                                                                    • Size 54KB
                                                                    • SHA256 c4f1d6f8c485aaca3abaf007d7997765efff426f38f5fc508a500320d470010c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    plutovg.dll
                                                                    • Path C:\Program Files\PCSX2\plutovg.dll
                                                                    • Size 248KB
                                                                    • SHA256 9266323d999c38a94f476e8a8fbd175e5c4b5b41fe211933b9d223f6881e42b5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    zlib1.dll
                                                                    • Path C:\Program Files\PCSX2\zlib1.dll
                                                                    • Size 88KB
                                                                    • SHA256 52a86ec85bfd1562f28dae626c5ef7272f44321c252b9420f83f02025687c056
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    zstd.dll
                                                                    • Path C:\Program Files\PCSX2\zstd.dll
                                                                    • Size 643KB
                                                                    • SHA256 0684d2302c33b443d2059f3d4bb1f8b096423fa2922459eea5a5d0269a723ac0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    blocklist
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                    • Size 105KB
                                                                    • SHA256 9dfa6aedebac0b2a7a6a4b7cf7a5385b714d5fbe36a5f334877adc4e59f7bed3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    BookmarkMergedSurfaceOrdering
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                    • Size 6B
                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    the-real-index
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                    • Size 3KB
                                                                    • SHA256 403f37141b09b73c4f895b08b07e82e9f7baea747732cb3cf3bf408663790b35
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    the-real-index~RFe59b193.TMP
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b193.TMP
                                                                    • Size 3KB
                                                                    • SHA256 522cc16d76a0d33e1ea5d9db53fd24b073899a2a9416f9bf41f46d8a36062150
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    SiteList-Enterprise.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                    • Size 2B
                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Edge Profile.ico
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                    • Size 70KB
                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    HubApps
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                    • Size 106KB
                                                                    • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Network Persistent State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                    • Size 1KB
                                                                    • SHA256 e0f9e98167954ceea17f61f49a683e16d3900be46e9376e4d6cd0fd8767540a4
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Network Persistent State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                    • Size 111B
                                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    SCT Auditing Pending Reports
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                    • Size 2B
                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                    • Size 13KB
                                                                    • SHA256 3158382169fc9c97609b11661e0d034feff1e72bc0c6c5cdbdf79cb142c14db6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Secure Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                    • Size 36KB
                                                                    • SHA256 6b1afd8c2c2b4734a93737f03650b9deb072abd7749ff468138608e6fa148319
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    sync_diagnostic.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                    • Size 5KB
                                                                    • SHA256 bf92fdf5fc06ecff8581ae25a7ff906521656e27c7d86437ba10854d38c28ed1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    OperationConfig
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                    • Size 22KB
                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    OperationConfig~RFe5a4d18.TMP
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4d18.TMP
                                                                    • Size 3KB
                                                                    • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 18KB
                                                                    • SHA256 3b496757feb3b70b17c39cccd0986e9d908678f688fea0ea38d8de7793055805
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 18KB
                                                                    • SHA256 411a56347a67e781bb0a50364d5d0733571c3da30f00a9c58dc59d1c0fed21d7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 14KB
                                                                    • SHA256 0cd0527eecead474aab4123344c78903f811a973a6b5fbe3f191183ed6e6db90
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 8KB
                                                                    • SHA256 e077b7d6b00d0414d93a4a880593f8a6d7bd9e5a41c5b1d1bc2088df8f0b1758
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 8KB
                                                                    • SHA256 a45470433a0dceda308b17f7ab43c752a8b5579251328f649fead48c6112db23
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 28KB
                                                                    • SHA256 2315ef82c0f777fab4d8111e34d9a82aa7ad7a9d957b6987547d9d44f4c44cb7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    metadata.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                    • Size 132B
                                                                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    7fa7026c-4925-4b8d-af79-723701fa2b2b.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7fa7026c-4925-4b8d-af79-723701fa2b2b.tmp
                                                                    • Size 13B
                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    40789863-b89e-4938-a0cf-b48b754c54c2.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\40789863-b89e-4938-a0cf-b48b754c54c2.tmp
                                                                    • Size 1B
                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    9f62fd1e-cbf5-4602-958c-4390a1e14ab9.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9f62fd1e-cbf5-4602-958c-4390a1e14ab9.tmp
                                                                    • Size 10KB
                                                                    • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    VC_redist.x64.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-CGS44BSPFJ.tmp\VC_redist.x64.exe
                                                                    • Size 24.4MB
                                                                    • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    PCSX2-v2.6.3-windows-x64-installer.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-IRHLCGU0LZ.tmp\PCSX2-v2.6.3-windows-x64-installer.tmp
                                                                    • Size 4.4MB
                                                                    • SHA256 d1af9c61fc1219b190091fee99e4fd643b168c6459d7417f8b259d4edc71cb3f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    558ed221-59d7-4991-9814-eb861f281533.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_2027284612\558ed221-59d7-4991-9814-eb861f281533.tmp
                                                                    • Size 147KB
                                                                    • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    content_new.js
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_279617547\CRX_INSTALL\content_new.js
                                                                    • Size 10KB
                                                                    • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    VC_redist.x64.exe.crdownload
                                                                    • Path C:\Users\Admin\Downloads\VC_redist.x64.exe.crdownload
                                                                    • Size 50KB
                                                                    • SHA256 b9802285b4c5573a09b9b067638b92c50a7e1fd819afa08acb249cf4fdd3b42b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    VC_redist.x64.exe:Zone.Identifier
                                                                    • Path C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier
                                                                    • Size 211B
                                                                    • SHA256 0f78d8e49972c57affd3760a34a16453147458db4957d5d69bd9d10372c0759f
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    manifest.json
                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4544_314844746\manifest.json
                                                                    • Size 43B
                                                                    • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    logo.png
                                                                    • Path C:\Windows\Temp\{7AE6E5D6-1007-4390-90F8-E7E56E4702FB}\.ba\logo.png
                                                                    • Size 1KB
                                                                    • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    wixstdba.dll
                                                                    • Path C:\Windows\Temp\{7AE6E5D6-1007-4390-90F8-E7E56E4702FB}\.ba\wixstdba.dll
                                                                    • Size 215KB
                                                                    • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    VC_redist.x64.exe
                                                                    • Path C:\Windows\Temp\{B42B794A-0996-4A09-96AC-3D6CC6F9C28F}\.cr\VC_redist.x64.exe
                                                                    • Size 670KB
                                                                    • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    memory/1992-601-0x00007FF78DA30000-0x00007FF78EA30000-memory.dmp
                                                                    Download

                                                                    memory/1992-605-0x00000243044B0000-0x00000243045D0000-memory.dmp
                                                                    Download

                                                                    memory/1992-597-0x00007FFACEF30000-0x00007FFACF439000-memory.dmp
                                                                    Download

                                                                    memory/1992-604-0x0000024304400000-0x00000243044AE000-memory.dmp
                                                                    Download

                                                                    memory/2852-11-0x0000000000040000-0x00000000004BF000-memory.dmp
                                                                    Download

                                                                    memory/2852-9-0x0000000000E60000-0x0000000000E61000-memory.dmp
                                                                    Download

                                                                    memory/2852-602-0x0000000000040000-0x00000000004BF000-memory.dmp
                                                                    Download

                                                                    memory/2852-557-0x0000000000040000-0x00000000004BF000-memory.dmp
                                                                    Download

                                                                    memory/2852-5-0x0000000000E60000-0x0000000000E61000-memory.dmp
                                                                    Download

                                                                    memory/2852-560-0x0000000000040000-0x00000000004BF000-memory.dmp
                                                                    Download

                                                                    memory/2852-13-0x0000000000040000-0x00000000004BF000-memory.dmp
                                                                    Download

                                                                    memory/2852-8-0x0000000000040000-0x00000000004BF000-memory.dmp
                                                                    Download

                                                                    memory/5048-7-0x00000000007D0000-0x00000000008F5000-memory.dmp
                                                                    Download

                                                                    memory/5048-603-0x00000000007D0000-0x00000000008F5000-memory.dmp
                                                                    Download

                                                                    memory/5048-0-0x00000000007D0000-0x00000000008F5000-memory.dmp
                                                                    Download