Overview

overview

6

Static

static

1

2026-05-07...uk.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/05/2026, 10:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-07_356ff7e2a1ecd9c1f0e973a660e1e8a8_icedid_njrat_ryuk.exe
  • Size 7.2MB
  • Sample260507-l33cbaez2p
  • SHA256 fedc0e3285bc76a56f73806f535b012c8d424bb4f844e7e5e32ccf59d15a510e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 13 IoCs
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 37 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_356ff7e2a1ecd9c1f0e973a660e1e8a8_icedid_njrat_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_356ff7e2a1ecd9c1f0e973a660e1e8a8_icedid_njrat_ryuk.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Program Files\PulseSoftware5116_1451764890\bin\updater.exe
      "C:\Program Files\PulseSoftware5116_1451764890\bin\updater.exe" --install=appguid={2F4E88B4-E690-4E1F-AA9E-B7A4617F881D}&appname=PulseBrowser&iid={aa95685a-f904-7fd9-f3fb-5885f78bfe27} --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
      2⤵
      • Adds Run key to start application
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4736
      • C:\Program Files\PulseSoftware5116_1451764890\bin\updater.exe
        "C:\Program Files\PulseSoftware5116_1451764890\bin\updater.exe" --crash-handler --database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\Crashpad --url=https://pulsebrowser.com/ --annotation=prod=PulseBrowserUpdater --annotation=ver=133.0.6943.177 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff79e08454c,0x7ff79e084558,0x7ff79e084568
        3⤵
        • Executes dropped EXE
        PID:4904
      • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --from-installer
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2784
  • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe
    "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe" --server --service=update-internal -Embedding
    1⤵
    • Executes dropped EXE
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe
      C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe --crash-handler --database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\Crashpad --url=https://pulsebrowser.com/ --annotation=prod=PulseBrowserUpdater --annotation=ver=133.0.6943.177 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff7598b454c,0x7ff7598b4558,0x7ff7598b4568
      2⤵
      • Executes dropped EXE
      PID:1400
  • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe
    "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe" --wake
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3300
    • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe
      C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe --crash-handler --database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\Crashpad --url=https://pulsebrowser.com/ --annotation=prod=PulseBrowserUpdater --annotation=ver=133.0.6943.177 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7598b454c,0x7ff7598b4558,0x7ff7598b4568
      2⤵
      • Executes dropped EXE
      PID:5044
  • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe
    "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe" --server --service=update -Embedding
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe
      C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\updater.exe --crash-handler --database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\Crashpad --url=https://pulsebrowser.com/ --annotation=prod=PulseBrowserUpdater --annotation=ver=133.0.6943.177 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7598b454c,0x7ff7598b4558,0x7ff7598b4568
      2⤵
      • Executes dropped EXE
      PID:3624
    • C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\pulsebrowser_installer_144.0.7559.70.exe
      "C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\pulsebrowser_installer_144.0.7559.70.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\CR_5C323.tmp\setup.exe
        "C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\CR_5C323.tmp\setup.exe" --install-archive="C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\CR_5C323.tmp\PULSEBROWSER.PACKED.7Z"
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Network Configuration Discovery: Internet Connection Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4756
        • C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\CR_5C323.tmp\setup.exe
          "C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\CR_5C323.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=PulseBrowser --annotation=ver=144.0.7559.70 "--attachment=C:\Program Files\chromium_installer.log" --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff6bae3a000,0x7ff6bae3a00c,0x7ff6bae3a018
          4⤵
          • Executes dropped EXE
          PID:116
        • C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\CR_5C323.tmp\setup.exe
          "C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\CR_5C323.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2484
          • C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\CR_5C323.tmp\setup.exe
            "C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\CR_5C323.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=PulseBrowser --annotation=ver=144.0.7559.70 "--attachment=C:\Program Files\chromium_installer.log" --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff6bae3a000,0x7ff6bae3a00c,0x7ff6bae3a018
            5⤵
            • Executes dropped EXE
            PID:4792
        • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
          "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --from-installer
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1312
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,13292065091426435714,12822328347977218455,262144 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2036 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4764
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2304,i,7746724852537355581,9468819813966631389,524288 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2296 /prefetch:3
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:4168
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2492,i,8681629691445965543,18351095060832351652,524288 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2512 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3244
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3456,i,1387537951952075356,4221692572023696105,2097152 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3484 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3860
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --instant-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,1503257703641119669,2754416663865801117,2097152 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3516 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3156
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4716,i,17617526924864943668,13642430925252870638,524288 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4648 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5508
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5100,i,2688013230160779460,8882050234223655678,524288 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5028 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5900
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,17916301040470191090,4409260048435718869,524288 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5180 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6016
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,14447682384551151212,8033546995778359581,524288 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5488 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4972
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,222665377821835892,8261184106313904961,524288 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5112 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5368
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5236,i,8532754747407131136,9228119789957101016,2097152 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5496 /prefetch:2
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5604
          • C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5460,i,7098533704998353014,1776237825866607395,262144 --field-trial-handle=2040,i,10108548476629464425,16826055893259810412,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5512 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:4948
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe" -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1cc,0x1d0,0x1d4,0x1a8,0x1d8,0x7ff7645c3764,0x7ff7645c3770,0x7ff7645c3780
      2⤵
        PID:1920
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
      1⤵
        PID:6092

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            updater.exe
            • Path C:\Program Files\PulseSoftware5116_1451764890\bin\updater.exe
            • Size 6.2MB
            • SHA256 1533d6455ae751d9845d29c671d9b3e17ce3ec5c4a925135cc39ff7afc50e2a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3216_1491455832\CR_5C323.tmp\setup.exe
            • Size 4.7MB
            • SHA256 c35c6006dba712a0417e0710674fcc2a555dbbcedc53309fa824692470cdd4e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prefs.json
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\133.0.6943.177\prefs.json
            • Size 19B
            • SHA256 e03e9d262ca3b7d19e37c3a69c7d8b46bd3f5542aa555a17d864071c28257b2c
            • MD5 SHA1 SHA512
            Submit Download

            prefs.json
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
            • Size 1KB
            • SHA256 21a97bbfa98ae86ea887d23443d85a08afc5fc98a6e3558d3dfe782da801907d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
            • Size 436B
            • SHA256 33531acbbbc0ea755ee31ae42cdad312c8c3e25d3609b009225027e00970de20
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
            • Size 51B
            • SHA256 6dd1d1ee53584cd340ffaba4ac7d15625b2675c00c662bf4808314cf752c3852
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
            • Size 638B
            • SHA256 9f63a0d97ccd1f40cf4d3fcbdf4d7765f8358bbc701e60e5df548958e363802e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
            • Size 216B
            • SHA256 548b827d5de5dd654b58a28581e065b50942ab34b3e7264ef7c336e478dad6d3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            prefs.json
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
            • Size 464B
            • SHA256 0764a02efc46094cc45e73ae360efa6328ff608061398a95889fcaf3be1e5bd7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            manifest.json
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\MEIPreload\manifest.json
            • Size 238B
            • SHA256 44844cf3dde6e80087ae0e6bf0d9326d7ef7d23326d24ac83af0850be26923d2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            manifest.json
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\PrivacySandboxAttestationsPreloaded\manifest.json
            • Size 122B
            • SHA256 51c311a4ba03140bcd1c827f8d93dba50cadda736925903b26e95609275dbffd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            privacy-sandbox-attestations.dat
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat
            • Size 7KB
            • SHA256 59e345dc13aedee9ea46b92e58300ecaca944aaea9384c7af885400ac2ae8806
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            d3dcompiler_47.dll
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\d3dcompiler_47.dll
            • Size 4.5MB
            • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxcompiler.dll
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\dxcompiler.dll
            • Size 24.4MB
            • SHA256 34117a222bd4e9e15807035c3d5db467b65fc05cea1c5a55e9226f58939205c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxil.dll
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\dxil.dll
            • Size 1.4MB
            • SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\icudtl.dat
            • Size 10.3MB
            • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libEGL.dll
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\libEGL.dll
            • Size 496KB
            • SHA256 9a812d76e03abb22e1a07183ce0bef93f8a3388f6dbfc97bb6da3e9922b0083b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libGLESv2.dll
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\libGLESv2.dll
            • Size 7.5MB
            • SHA256 98f72f3672a349161c5a9f4f3dc3e18a5e6b4f8b5916cef353bae2ff9fb00a29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-US.pak
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\locales\en-US.pak
            • Size 483KB
            • SHA256 ca43214d77856f935f7c1a41a19dcb3e20c103e536d4b502d0791d08a02cc2ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pulsebrowser_100_percent.pak
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\pulsebrowser_100_percent.pak
            • Size 699KB
            • SHA256 b2d8cefff009594a0ab040b1d8a2caab24340443dc4d9314d65c1b41ae79e974
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pulsebrowser_200_percent.pak
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\pulsebrowser_200_percent.pak
            • Size 1.1MB
            • SHA256 7e8130fe4cc5bb1535904d5589134a7792c538d7127841ef00fa02882403f9c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pulsebrowser_elf.dll
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\pulsebrowser_elf.dll
            • Size 1.6MB
            • SHA256 41ec443de80eda30f79e85c735e49e83e9b72f5961ab44650767f5dc8e0bb645
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources.pak
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\resources.pak
            • Size 12.1MB
            • SHA256 c867145db099c36cac587a9bbcde678f4717056e2d0fc1b406b2bcfdddd6b287
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            v8_context_snapshot.bin
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\v8_context_snapshot.bin
            • Size 696KB
            • SHA256 012772b3e148777f31583d28669a048ae5863208319ce85d43483f44b268851e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vk_swiftshader.dll
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\144.0.7559.70\vk_swiftshader.dll
            • Size 5.2MB
            • SHA256 ef96c9ec0d2ce875376acf03ab13ccc997b0f6e7254f54c9870c70b4600959be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pulsebrowser.exe
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
            • Size 3.3MB
            • SHA256 390d6c1a3af3ec89b3cc14db1d0302ea4e954acfaee6db8fb6b27fb31025cdf8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            am_MASCULINE.pak
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Temp\source4756_648910550\pulsebrowser-bin\144.0.7559.70\Locales\am_MASCULINE.pak
            • Size 18B
            • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
            • MD5 SHA1 SHA512
            Submit Download

            pulsebrowser_proxy.exe
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Temp\source4756_648910550\pulsebrowser-bin\pulsebrowser_proxy.exe
            • Size 1.5MB
            • SHA256 9f988ab06d5aa41bde683ffeec214de21ff5766ced210be0404cd19aeac6f09d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Crashpad\settings.dat
            • Size 40B
            • SHA256 d78e7d697af78a47774b5a4297ad3a539827cc176ea5eefe05e257146a968900
            • MD5 SHA1 SHA512
            Submit Download

            DefaultConfig
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\DefaultConfig
            • Size 41B
            • SHA256 3530e885118c6d435a75463297ece6c1a7dc6d2abe35efa50c05c31e15b42cd0
            • MD5 SHA1 SHA512
            Submit Download

            3a55f064-dd35-454f-9b22-ff70ba405b56.tmp
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\3a55f064-dd35-454f-9b22-ff70ba405b56.tmp
            • Size 10KB
            • SHA256 9c1a3c52ee69d1050ce21c509a1944b1fad1c5f1fb5f42c8699e5a5e2fa8ed41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            93565d9d-ca47-49b8-a86d-840913a1d2ad.tmp
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\93565d9d-ca47-49b8-a86d-840913a1d2ad.tmp
            • Size 175KB
            • SHA256 a6c8a9a503d94e3db1354495676a4c9ddc4b7b5960d5c6b80efed9cc9c3fa776
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Extension Rules\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            background.js
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Extensions\chiflgcemplicneemgmpmaphbfhekkfm\1.4_0\background.js
            • Size 8KB
            • SHA256 e4065c4d1c020f42a92e02a035649a29b2b37a518005eed754046e018c7ab704
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo_48.png
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Extensions\chiflgcemplicneemgmpmaphbfhekkfm\1.4_0\logo_48.png
            • Size 2KB
            • SHA256 9089cc13d35a4b04abaae2ab915f3a507e27e6290b46043af2c0f38835013e48
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Network\Network Persistent State
            • Size 1KB
            • SHA256 5d2e7cdc1aa023e225ed6028d3c4e4347a3cc6657ff67d848297feff05cb8606
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State~RFe59819a.TMP
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Network\Network Persistent State~RFe59819a.TMP
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SCT Auditing Pending Reports
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Network\SCT Auditing Pending Reports
            • Size 2B
            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
            • MD5 SHA1 SHA512
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Preferences
            • Size 10KB
            • SHA256 6e1bb00fb53fe384a56110b17600f14263efdb58963447a317bbda93645405e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
            • Size 72B
            • SHA256 38d581e9a967701f7e0e59244681a57f9c4cf52742a299743d0bd7279a954cca
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index~RFe58cc92.TMP
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cc92.TMP
            • Size 72B
            • SHA256 ea6f11ac7646dc88bd30e2796fd9f0fc5295cc6492e27b8d7d148f0d69409cc0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Site Characteristics Database\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_1
            • Size 264KB
            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Local State
            • Size 6KB
            • SHA256 0bac7638ea662275ed0b800d72a48636d41695c335b945905d2913df2a8cff3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Local State
            • Size 3KB
            • SHA256 5bc851c19c95f11e31c483fd059a0456e1b9cf4d2a112eec9fcb87f74d266592
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State~RFe5884ea.TMP
            • Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Local State~RFe5884ea.TMP
            • Size 1KB
            • SHA256 41d3b0f1903d62eecb1d7ddf5b677ff21fc34b3b51bb61e72109a55d0040d4d8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            823792af-f8c6-41b9-8631-b59971d3961b.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_20600674\823792af-f8c6-41b9-8631-b59971d3961b.tmp
            • Size 15.7MB
            • SHA256 e6dc7752da8dec8426e0dd1436f87480431c34eeb7cf112d30a2b12ab2fcc189
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo_48.png
            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_20600674\CRX_INSTALL\logo_48.png
            • Size 1KB
            • SHA256 b1aabc9cfa8f04287b6133dddc0a5a1571bd5e0f5e79cbc03a34b62dd00e2b79
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Pulse Browser.lnk
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pulse Browser.lnk
            • Size 2KB
            • SHA256 c8e5f786e75cca375439cd82e716768895c6694b828088d26db6e9a4d15a7a95
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Pulse Browser.lnk
            • Path C:\Users\Admin\Desktop\Pulse Browser.lnk
            • Size 2KB
            • SHA256 fdf44b5a2ea12c82415631dd89692d6835e5ad5b7abda4d4e4de0f13bb0080ec
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1208-51-0x0000019C5F240000-0x0000019C5F3E1000-memory.dmp
            Download

            memory/1312-1014-0x0000029B0B630000-0x0000029B0B64D000-memory.dmp
            Download

            memory/1312-1013-0x0000029B0B560000-0x0000029B0B59B000-memory.dmp
            Download

            memory/1312-1012-0x0000029B0B480000-0x0000029B0B4A7000-memory.dmp
            Download

            memory/1312-1011-0x0000029B035E0000-0x0000029B035E8000-memory.dmp
            Download

            memory/1400-52-0x0000022A3C630000-0x0000022A3C7D1000-memory.dmp
            Download

            memory/3216-55-0x000001F4D1D30000-0x000001F4D1ED1000-memory.dmp
            Download

            memory/3216-57-0x000001F4D37A0000-0x000001F4D37DB000-memory.dmp
            Download

            memory/3216-56-0x000001F4D3740000-0x000001F4D3748000-memory.dmp
            Download

            memory/3244-686-0x00007FFC2E0E0000-0x00007FFC2E0E1000-memory.dmp
            Download

            memory/3244-685-0x00007FFC2E0B0000-0x00007FFC2E0B1000-memory.dmp
            Download

            memory/3300-53-0x0000019B0DED0000-0x0000019B0E071000-memory.dmp
            Download

            memory/3624-58-0x000001A0D2110000-0x000001A0D22B1000-memory.dmp
            Download

            memory/3916-648-0x00000246F7B20000-0x00000246F7B28000-memory.dmp
            Download

            memory/3916-1073-0x00000246F7C60000-0x00000246F7CCB000-memory.dmp
            Download

            memory/3916-1074-0x00000246F7B20000-0x00000246F7B28000-memory.dmp
            Download

            memory/3916-647-0x00000246F7C60000-0x00000246F7CCB000-memory.dmp
            Download

            memory/4168-1035-0x0000025AABB40000-0x0000025AABB48000-memory.dmp
            Download

            memory/4736-1083-0x0000019541F60000-0x0000019542101000-memory.dmp
            Download

            memory/4736-39-0x0000019544950000-0x000001954495C000-memory.dmp
            Download

            memory/4736-37-0x0000019541F60000-0x0000019542101000-memory.dmp
            Download

            memory/4736-38-0x00000195439C0000-0x00000195439C8000-memory.dmp
            Download

            memory/4904-40-0x0000026A19410000-0x0000026A195B1000-memory.dmp
            Download

            memory/4948-1277-0x00000178C0290000-0x00000178C0291000-memory.dmp
            Download

            memory/4948-1286-0x00000178C0290000-0x00000178C0291000-memory.dmp
            Download

            memory/4948-1283-0x00000178C0290000-0x00000178C0291000-memory.dmp
            Download

            memory/4948-1284-0x00000178C0290000-0x00000178C0291000-memory.dmp
            Download

            memory/4948-1285-0x00000178C0290000-0x00000178C0291000-memory.dmp
            Download

            memory/4948-1279-0x00000178C0290000-0x00000178C0291000-memory.dmp
            Download

            memory/4948-1278-0x00000178C0290000-0x00000178C0291000-memory.dmp
            Download

            memory/4948-1289-0x00000178C0290000-0x00000178C0291000-memory.dmp
            Download

            memory/4948-1288-0x00000178C0290000-0x00000178C0291000-memory.dmp
            Download

            memory/4948-1287-0x00000178C0290000-0x00000178C0291000-memory.dmp
            Download

            memory/5044-54-0x0000025EB4B40000-0x0000025EB4CE1000-memory.dmp
            Download

            memory/5116-36-0x00000286FB880000-0x00000286FB8EB000-memory.dmp
            Download

            memory/5116-1112-0x00000286FB880000-0x00000286FB8EB000-memory.dmp
            Download

            memory/6092-1053-0x000002C7F7E60000-0x000002C7F7F0C000-memory.dmp
            Download