hxxps://github[.]com/BruceLi20110501/Pulsar_RAT/tree/main/Pulsar[.]Client

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
264s
max time network
265s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/BruceLi20110501/Pulsar_RAT/tree/main/Pulsar.Client
Sample260727-hdd2msam9v

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
153	1844	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
476	windowsdesktop-runtime-9.0.18-win-x64.exe
1864	windowsdesktop-runtime-9.0.18-win-x64.exe
2856	windowsdesktop-runtime-9.0.18-win-x64.exe
2684	windowsdesktop-runtime-9.0.18-win-x64.exe
2600	windowsdesktop-runtime-9.0.18-win-x64.exe
1644	windowsdesktop-runtime-9.0.18-win-x64.exe
2360	windowsdesktop-runtime-9.0.18-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
1864	windowsdesktop-runtime-9.0.18-win-x64.exe
3708	MsiExec.exe
1644	windowsdesktop-runtime-9.0.18-win-x64.exe
3708	MsiExec.exe
4452	MsiExec.exe
4452	MsiExec.exe
2876	MsiExec.exe
2876	MsiExec.exe
2592	MsiExec.exe
2592	MsiExec.exe
884	MsiExec.exe
884	MsiExec.exe
1852	MsiExec.exe
1852	MsiExec.exe
976	MsiExec.exe
976	MsiExec.exe
5124	MsiExec.exe
5124	MsiExec.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe
1448	Pulsar.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{b21e7fe8-9175-483b-a67f-0fd948722740} = "\"C:\\ProgramData\\Package Cache\\{b21e7fe8-9175-483b-a67f-0fd948722740}\\windowsdesktop-runtime-9.0.18-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{b21e7fe8-9175-483b-a67f-0fd948722740} = "\"C:\\ProgramData\\Package Cache\\{b21e7fe8-9175-483b-a67f-0fd948722740}\\windowsdesktop-runtime-9.0.18-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.18-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
79	camo.githubusercontent.com
80	camo.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Threading.Thread.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\de\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\PresentationFramework.Fluent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\de\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\tr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\zh-Hant\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ko\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ko\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\Microsoft.WindowsDesktop.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Private.Windows.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\PresentationCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\es\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\it\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\fr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\tr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pl\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ko\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Xaml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\zh-Hant\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\WindowsFormsIntegration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\tr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\de\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\de\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pt-BR\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\createdump.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\tr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\clrgcexp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF77A5C6379826845D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E7C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI588F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI598A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A56.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FB7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF11978B7B5A5DECA6.TMP	msiexec.exe
File created	C:\Windows\Installer\e5b0411.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB0287207114A1D4D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC8DBE62C1EA69E9D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF088C77E5CE9108C1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13E2.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5923B494F1FD43CD.TMP	msiexec.exe
File created	C:\Windows\Installer\e5b040d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4217.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF08C56E15498AD510.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD359F24C43505313.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI54B5.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b0409.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI33C8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCA53E0F179F84793.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF35725BA6F7077773.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C4B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF5A14C900A3C511F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b0409.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI277D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3959.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39A8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD22874805817A44E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9455FC1BA60785DA.TMP	msiexec.exe
File created	C:\Windows\Installer\e5b0417.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3506E39202334030.TMP	msiexec.exe
File created	C:\Windows\Installer\e5b0408.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0478E686411A66FF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6006.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0CADB010-02E6-4833-B505-BD81F85D0915}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2859.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF267B787406E6801A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b0404.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI388D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B9CB3C69-65ED-445D-A35F-38FCC2058C35}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3780E808285DF704.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b041b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI30C9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\SystemTemp\~DF89B9A98E6BDB5312.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EDFAA9B4-1B98-43B0-95C5-6010790950B5}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF005C3A27E551C6D1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEB3B7293186129BB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF701D251321C6F8AE.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2307.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6126E10D1EBCFEB5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b0411.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI32FC.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b041b.msi	msiexec.exe
File created	C:\Windows\Installer\e5b0404.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9D5AD9F3EB81E170.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF516F730E25070E73.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1844	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296078350249403"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.72.55158_x64\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54E5CE53009F8EA46BCF9EF69B42F947	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.72.55158_x64	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	Pulsar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\Dependents	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.72.55158_x64\Dependents	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3693C0A713552476F4E3AD22D8059B9B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\ = "{35EC5E45-F900-4AE8-B6FC-E96FB9249F74}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54E5CE53009F8EA46BCF9EF69B42F947\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\ = "{b21e7fe8-9175-483b-a67f-0fd948722740}"	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\Version = "9.0.18.36217"	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.72.55158_x64\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64\Version = "72.72.55185"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\Version = "1212733302"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.18 (x64)"	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	Pulsar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	Pulsar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Pulsar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Pulsar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\PackageCode = "E65350071DC5D4947B27B36EF90204B9"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.72.55158_x64\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8ADC86493D955D5516528FD99E43D025	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\14A921B74F157796319B9A1F31F508AB\4B9AAFDE89B10B34595C06019790055B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Pulsar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{35EC5E45-F900-4AE8-B6FC-E96FB9249F74}v72.72.55158\\"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Pulsar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Pulsar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918\54E5CE53009F8EA46BCF9EF69B42F947	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96C3BC9BDE56D5443AF583CF2C50C853	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8ADC86493D955D5516528FD99E43D025\96C3BC9BDE56D5443AF583CF2C50C853	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Pulsar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64\ = "{B9CB3C69-65ED-445D-A35F-38FCC2058C35}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{B9CB3C69-65ED-445D-A35F-38FCC2058C35}v72.72.55185\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\ProductName = "Microsoft .NET Runtime - 9.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1172	explorer.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe
2884	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1448	Pulsar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSecurityPrivilege	2884	msiexec.exe
Token: SeCreateTokenPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeLockMemoryPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeMachineAccountPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeTcbPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSecurityPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeTakeOwnershipPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeLoadDriverPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSystemProfilePrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSystemtimePrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeProfSingleProcessPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeIncBasePriorityPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeCreatePagefilePrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeCreatePermanentPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeBackupPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeRestorePrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeShutdownPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeDebugPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeAuditPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeChangeNotifyPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeRemoteShutdownPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeUndockPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSyncAgentPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeEnableDelegationPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeManageVolumePrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeImpersonatePrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeCreateGlobalPrivilege	2856	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe
Token: SeRestorePrivilege	2884	msiexec.exe
Token: SeTakeOwnershipPrivilege	2884	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
1448	Pulsar.exe
1448	Pulsar.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2884	msiexec.exe
3708	MsiExec.exe
4452	MsiExec.exe
2876	MsiExec.exe
2592	MsiExec.exe
884	MsiExec.exe
1852	MsiExec.exe
976	MsiExec.exe
5124	MsiExec.exe
1172	explorer.exe
1448	Pulsar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 984	2872	msedge.exe	89
PID 2872 wrote to memory of 6112	2872	msedge.exe	90
PID 2872 wrote to memory of 1844	2872	msedge.exe	91
PID 2872 wrote to memory of 6112	2872	msedge.exe	90
PID 2872 wrote to memory of 6112	2872	msedge.exe	90
PID 2872 wrote to memory of 792	2872	msedge.exe	92
PID 2872 wrote to memory of 792	2872	msedge.exe	92
PID 2872 wrote to memory of 3432	2872	msedge.exe	94
PID 2872 wrote to memory of 3432	2872	msedge.exe	94
PID 2872 wrote to memory of 3432	2872	msedge.exe	94
PID 2872 wrote to memory of 4612	2872	msedge.exe	95
PID 2872 wrote to memory of 4612	2872	msedge.exe	95
PID 2872 wrote to memory of 4612	2872	msedge.exe	95
PID 2872 wrote to memory of 3396	2872	msedge.exe	96
PID 2872 wrote to memory of 3396	2872	msedge.exe	96
PID 2872 wrote to memory of 3396	2872	msedge.exe	96
PID 2872 wrote to memory of 5736	2872	msedge.exe	97
PID 2872 wrote to memory of 5736	2872	msedge.exe	97
PID 2872 wrote to memory of 5736	2872	msedge.exe	97
PID 2872 wrote to memory of 3528	2872	msedge.exe	99
PID 2872 wrote to memory of 3528	2872	msedge.exe	99
PID 2872 wrote to memory of 544	2872	msedge.exe	100
PID 2872 wrote to memory of 544	2872	msedge.exe	100
PID 2872 wrote to memory of 1332	2872	msedge.exe	102
PID 2872 wrote to memory of 2300	2872	msedge.exe	105
PID 2872 wrote to memory of 2300	2872	msedge.exe	105
PID 2872 wrote to memory of 5720	2872	msedge.exe	106
PID 2872 wrote to memory of 5720	2872	msedge.exe	106
PID 2872 wrote to memory of 5720	2872	msedge.exe	106
PID 2872 wrote to memory of 2840	2872	msedge.exe	108
PID 2872 wrote to memory of 2072	2872	msedge.exe	109
PID 2872 wrote to memory of 2364	2872	msedge.exe	110
PID 2872 wrote to memory of 5032	2872	msedge.exe	113
PID 2872 wrote to memory of 2292	2872	msedge.exe	114
PID 2872 wrote to memory of 2292	2872	msedge.exe	114
PID 5488 wrote to memory of 3472	5488	Pulsar.exe	118
PID 2872 wrote to memory of 2400	2872	msedge.exe	119
PID 2872 wrote to memory of 2400	2872	msedge.exe	119
PID 2872 wrote to memory of 2400	2872	msedge.exe	119
PID 2872 wrote to memory of 940	2872	msedge.exe	120
PID 2872 wrote to memory of 940	2872	msedge.exe	120
PID 2872 wrote to memory of 940	2872	msedge.exe	120
PID 2872 wrote to memory of 3904	2872	msedge.exe	121
PID 2872 wrote to memory of 3904	2872	msedge.exe	121
PID 2872 wrote to memory of 3904	2872	msedge.exe	121
PID 2872 wrote to memory of 3392	2872	msedge.exe	122
PID 2872 wrote to memory of 476	2872	msedge.exe	123
PID 476 wrote to memory of 1864	476	windowsdesktop-runtime-9.0.18-win-x64.exe	124
PID 1864 wrote to memory of 2856	1864	windowsdesktop-runtime-9.0.18-win-x64.exe	125
PID 2684 wrote to memory of 2600	2684	windowsdesktop-runtime-9.0.18-win-x64.exe	129
PID 2600 wrote to memory of 1644	2600	windowsdesktop-runtime-9.0.18-win-x64.exe	130
PID 2884 wrote to memory of 3708	2884	msiexec.exe	131
PID 2872 wrote to memory of 2204	2872	msedge.exe	132
PID 1644 wrote to memory of 2360	1644	windowsdesktop-runtime-9.0.18-win-x64.exe	133
PID 2884 wrote to memory of 4452	2884	msiexec.exe	134
PID 2884 wrote to memory of 2876	2884	msiexec.exe	135
PID 2884 wrote to memory of 2592	2884	msiexec.exe	136
PID 2884 wrote to memory of 884	2884	msiexec.exe	137
PID 2884 wrote to memory of 1852	2884	msiexec.exe	138
PID 2884 wrote to memory of 976	2884	msiexec.exe	139
PID 2884 wrote to memory of 5124	2884	msiexec.exe	140
PID 1448 wrote to memory of 4388	1448	Pulsar.exe	142
PID 2872 wrote to memory of 5124	2872	msedge.exe	144
PID 2872 wrote to memory of 5124	2872	msedge.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/BruceLi20110501/Pulsar_RAT/tree/main/Pulsar.Client
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7fffb57ec188,0x7fffb57ec194,0x7fffb57ec1a0
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,13591393951645176018,746846275652673801,262144 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,8421461224725713296,10369879704074276652,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,12400492351646152873,2586977940194944531,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,14867307083818579049,13925079572949456810,2097152 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,12092064855418541423,3656821468422626813,2097152 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3412,i,1165585005736620667,17879684781788604009,2097152 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,8935931453936924585,14865583736791334642,2097152 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:9
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,2687881706475205525,11698951811324223141,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,13830683217081755298,13560580447761052991,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,3197718423245319979,7683409952400659543,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,3197718423245319979,7683409952400659543,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,13168377588942816465,2429976682355686519,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5008,i,16367800998009277626,13411102695561952977,2097152 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,1630314169633235100,15311646479330771802,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,16775134522182674507,16834969952505486257,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,17591069242613976832,13312536809782270181,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,6961742780215508421,16010590641666332565,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,15966056036710337007,18429518344044828454,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=2156,i,1714928720589817959,15389842573442099998,2097152 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5544,i,3776829052781004041,5132993009563010964,2097152 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3524,i,9873209158741544564,6552004730617215539,2097152 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,7214253952908968289,11597639636178215357,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
  2⤵
  PID:3392
- C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe
  "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:476
- - C:\Windows\Temp\{87697357-759E-48BF-A346-A47EFBFEDB91}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe
    "C:\Windows\Temp\{87697357-759E-48BF-A346-A47EFBFEDB91}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=756
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\Temp\{CCC39C9E-BCF1-4655-8BE1-607CBC5B14E0}\.be\windowsdesktop-runtime-9.0.18-win-x64.exe
      "C:\Windows\Temp\{CCC39C9E-BCF1-4655-8BE1-607CBC5B14E0}\.be\windowsdesktop-runtime-9.0.18-win-x64.exe" -q -burn.elevated BurnPipe.{8C3D8F18-08CA-4D6D-9FBB-2E66F77F91F8} {4577496D-1C5E-4235-853C-0AEF338CB945} 1864
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7216,i,16516489337327825531,3761357450717145930,262144 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,5971109244425781215,6802730151054368882,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,2191703267769125475,10253357032623806767,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7488,i,14643880985019092480,3610898413274647063,524288 --field-trial-handle=2488,i,2326052622397256229,12179061633275165503,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:14
  2⤵
  PID:1912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5540

C:\Users\Admin\Downloads\Pulsar_2026-07-06\Pulsar.exe
"C:\Users\Admin\Downloads\Pulsar_2026-07-06\Pulsar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  PID:3472

C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
"C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684
- C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
  "C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260727023859.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
    "C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260727023859.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
      "C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -q -burn.elevated BurnPipe.{4ADC19AD-968E-454D-86FF-F4DA4C71CD36} {951E5CA0-61CB-472B-A26A-FA7E3C1E5DDA} 1644
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2360

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 64C1C6029D3BCFAAABF17356B4E411F7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3708
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8275CC1D54F2344FC99463A3D2F7671E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4452
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 46074D58F9955535915665E11645366D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2876
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D8A9690736D60F7305C6682AA0B58973
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A0549D3391FAC1B80B17D64AB6C764A8
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 24B1B897240954C79FB5BD2173C8D78A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1852
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BFC3E1389105391F85665C7286BD27D6
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EC8D405E2BCC1AB1AF4489F89C4B8977
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5124

C:\Users\Admin\Downloads\Pulsar_2026-07-06\Pulsar.exe
"C:\Users\Admin\Downloads\Pulsar_2026-07-06\Pulsar.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\explorer.exe
  "explorer.exe" /select, "C:\Users\Admin\Downloads\Pulsar_2026-07-06\PulsarStuff\Pulsar.p12"
  2⤵
  PID:4388

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b0407.rbs

Path C:\Config.Msi\e5b0407.rbs
Size 48KB
SHA256 d6280dafa557fe12817c0b43a315d7a357db63a23583a781a0f33835442a0d77
MD5 ffedb128dbe82be3ec4e86ccfb335b87
SHA1 0286f39b6e2e45aa8b6ed850e7c75d03ae73f6f6
SHA512 3727c3f047afb1280018918dd52519ff54fe2a2728447837c5c1c3eb1965c0237e93675e428b86145a6f771597c2689a2c41e3ae31883a802b43fe0e6bdcc56c
SSDEEP 1536:plV+cORT3I/4tktvfftgMQ4dskJhTaOTagmDxjHxW9nXzYnj2NE43H+lPSc6ScT9:WV4
TLSH
T13F230F94DF00C4D2F233BBB6A374E90437588EA93F14944D67CED145C79AE89EAF9182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b040c.rbs

Path C:\Config.Msi\e5b040c.rbs
Size 9KB
SHA256 958780b6501187d3d19b23fa6cb9d519871cd56a334553aaee6ffc7da535e86f
MD5 f7d90d7aa0c3d599515ab5a0e62632d6
SHA1 2296493e5bea75fa111a2f27262b215691ab4ba4
SHA512 c08ba6930e06b9109ac937da03703b054ca8226e9851b8640d10bf33cfff937706438c2448a44c46ef7b8266d5e0e91912a2f4761153f8e011c033c2170526a9
SSDEEP 96:4m7Du5DZiQLvrLDC7CDXvuU2eD2mon8CsTl7U2eD2mon8C6jCFS2YD+TlGYDCVEU:tW7iwjoCbBdonTIedonTjEEJWdhLvpF
TLSH
T1C61242097B1186F3E8561F35C747272437BBD3CAE700A24B06DF92289F9774C1AA858E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0410.rbs

Path C:\Config.Msi\e5b0410.rbs
Size 3KB
SHA256 263af43b24994d5a3d2797d97558c89bd89517016bc0b34a380361264a9fb32d
MD5 496aedaeab750f516759173bba83d76b
SHA1 cde684169b2e9f60582c317c0afc31c3eda94e1a
SHA512 a789ed51157bcf6c1aae571a10ad06975570d02119ca764280617b87c61825ba3295742ffacc5de7f0ec2dc0d442e45ed55c6e20ac3682a34990cba58daa1b43
TLSH
T1E3714F42DB00D683ECA31F31CD27071237BBD7DA9B15434B058D92705E4BB85AEF9649
MD5 SHA1 SHA512 TLSH

Submit Download

e5b0414.rbs

Path C:\Config.Msi\e5b0414.rbs
Size 10KB
SHA256 a0b41c73f029a4a9350f2a0df2662a8dc1c382d89bb328d887a20af79c922b40
MD5 af32ae6c14def7ed906c5ac91f57796e
SHA1 abb074e3de3a6a3937d4a8e18a275bde88b47ecc
SHA512 eb6339da662c0f4e7a6572f299063863d74a714e5dfa7f5387a53e23595c07093cdba009a3c743ae30537adbcbfea10bcfb18b858152b34437608a0331a13698
SSDEEP 192:ozuIxFV5H/bd9CkUvBbnonTIJbnonT8yKEoV99vpO:ozuIxFV5HjvU5bnonCbnonYhK
TLSH
T1A5222005AA09C5D3D9921B30C3431BB137F3D3AE4704574F69DDB2706F8B7885AB929A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b041a.rbs

Path C:\Config.Msi\e5b041a.rbs
Size 3KB
SHA256 6fd57489fd6eb13259d92d5843b9f76150db4a5e68587de709dc78793052bd52
MD5 233a0236ca572fbec6ce3cf7b428a51c
SHA1 74c7d1c0c6e8b3ac2170072b5c31a662c9c1072a
SHA512 d4ace4d67a16d41328af1bd94b875e3d3bb2bd63dd2f55809e03960087eead99c556cb9644322dee392df5e6f391253cc7061a5cd8902d66f74f7e168d7d504d
TLSH
T1CC819C03AA04D6E3ECA22F71CA571B11337BE3DBD710C387018D91745E9BB885EE558A
MD5 SHA1 SHA512 TLSH

Submit Download

e5b041e.rbs

Path C:\Config.Msi\e5b041e.rbs
Size 88KB
SHA256 379e74eb033d8051bd3142d83a7feb82066e7f380334094719ab5732c13b0069
MD5 351ca6d34658b503ec0d70bdd8b0e2aa
SHA1 ac92a683416e20f7d70fec4778bdb949a2d1ea26
SHA512 b4dae9c4eb4c1f9aec7a1260988683ab26863821934f5f52851a15bfeac9d64c98cfc936c0cec4e6bbf8b205228aa83b3240214c74e677cb0aed6b88bd09f2a6
SSDEEP 1536:dk1eK8ItgdYnfGxhM4lEiJVLFnnzcp2X/60ir+XUfxLCekwFp8NFpSoBjMQRTsSq:ZwfIs/3StbIAjKy7XGBss
TLSH
T12C93E1B96710C186DD333A8883BBEA09AE015DAF53499E7A1BC5013AD9D3E971F7C4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0422.rbs

Path C:\Config.Msi\e5b0422.rbs
Size 3KB
SHA256 2136301c2c0e046bd5669987f9eacd1dd39056731df927e1a7f19d678921c7f1
MD5 ecb8f3874b535f608d8361b96769f364
SHA1 0c2bd60260230fd207ef39f7c77308bf3763d3f8
SHA512 47a16171c86236abd3678eb960cafe41778fda35e602d8e26f91f5c444f7cc80ea97ff60a23a124a05635b17612faa6e6e74164f7184d9f5f83638212ab3968f
TLSH
T1DC717E029A08D5C3DDA21F70C9171F6133B7D7DE9724838B548DA1701E8BB99AEFA186
MD5 SHA1 SHA512 TLSH

Submit Download

e5b0425.rbs

Path C:\Config.Msi\e5b0425.rbs
Size 3KB
SHA256 87ebcf5e385da9e0c22c78ccf772cb2f571755582aab414bca3dcb8084ebc663
MD5 a9f0d50aeffd941d56f102772683a10e
SHA1 69d3ce0770f98c015934d4d691e900966a5dc155
SHA512 d0ed9f6f81aae4fe366552f6193e5086d7257c5f4b9ccf1ac6356cc0d93a3262072d851d889ea0772d1c82f7559da36e0e5bc9eb51ba21136f705cf0bbe7f73d
TLSH
T163818A439A049983EDA22F30CA6707133777D7EBC724438745CC92344E87F965EDA68A
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\state.rsm
Size 932B
SHA256 a8482ac4edbea2ffb94b21e511532326e8f176c080d52cb758ffcb6a8b8d965f
MD5 67f41a663f9a5a337f452d82bcfe4784
SHA1 1d9ae5f9e7460a56e77a28069f5112e44e2b2c72
SHA512 057db331df4c3ae137feb160ab6095d55b85e58a0c9eb631338be6e8dbac09fe2d38a12255fcea7bffba20773d1f9f5d6d9af98c2a80c984ef80eb6b20bea6ca
TLSH
T1CD119A515FFA0129E3FA6B30A9F92711643AB8120D32C16C0101318A8E32BA0C870F77
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0c945e1b4274ad393f15cd267aa11cf69a7bd45f92629c5d4d2e13b6d28fa4c4
MD5 5ab6ccb7a53a51280a0bda4bcd4d3dc2
SHA1 eee94a0722c206a010d2e47e17881cfbfc331255
SHA512 e863c2eaf19e410085293ae7a3453f2aa02a51754f3c14e3fe39fc3565a68c677825b7b06314cc18d4cc2515a55c1b12e97304e9e8771fc56584d76525c9cd15
SSDEEP 48:tZIeVDvuWQTKaASGnVgDkpsrwBHxTDEU9g1lvGEfvh:AeAK3SGnORrwBHxN8vDZ
TLSH
T15B91B680572324D1E7BEE6B56CEA996FB270897B520F6FE5D01795F44AEEBC00860C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 aab9221f6ba1914946c5c92baa6560c28bbfd7e91cc7db3d56fd9de27a3f9399
MD5 aeddfa6ab78c8c634d1be1d89c283fb9
SHA1 27878d9eca224765ba8956a12b9ae25ebb74ee15
SHA512 8d215f78c32ef3365aa9dfd1e686799090ceec23a086b96ba36a1fb279493fac4e1e45d0db8094db123eae7b7196405f90b69edf4fc6a9219dce10a3937c94df
SSDEEP 48:hIeVDiuWSTK5KkASbnVgDh21psrwBHxTDEU9gzlvLzEfTi:WenKYJSbnOprwBHxNKvUu
TLSH
T192A1FB90472364D0EBBEE6B56CEA986FB270897B110F6FE5D00785F54AEEBC00860C70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fbd4fb4302479900bc16556df67d5ccb2f8661f06ed2481173373b45af6d27a6
MD5 3cc71a2148a948e4a0fd96f3570b89c8
SHA1 62181212a9dc6ac1aaf2c65d77b9b7b2004e34c3
SHA512 43f8be0cf6bfc7c9d1b12827652c282ce04f5ea52f4bed506d2dca24e9447ab4c3bec9a90c12f2f151571cafb27b22bd6967150755ce89a199a7dbde7ee8b2d7
TLSH
T10961ACF787F5956D8A0156F0AA18BE1BCE2D0514831C3C6AC4E0BE5BE3E3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9b86f90911890123a380f23051c65676c4576ca0c5afc375497641bb74c4a720
MD5 2053c8668203346e691fc7350eab43c4
SHA1 5d1f92e9552cc2f930394d4539c09a2830829890
SHA512 ebfab7ca2c71992ab0ee8d9d3dc9b938b3b056887206ab8ed00356dbc039a807f9c98c6a722df1390ce418e2347c769bf03a4273872707ea757ffd1af72e4ea0
TLSH
T11321B1F7C6F8557D894182F467147E1BCE2D0814532C3E9AC4D4AF6F93E2871D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3ef33a076e1a707d0ebd235276e5c822bd1e69acdde9a684cc9ac0e02f6c58d7
MD5 f4875b0f562e8d08af0db816df933188
SHA1 cad6114aa30c22ad106cfc225aae33dd90ed013b
SHA512 82f4ef183ac015f3138131c7fafb348af55b82ab2ff72673e99c01720e6568466a4aa3d0d21feccee80da34a99adbda1be0d0122d5ccc897b70e6a0103ff3ead
TLSH
T157219EF7C6F8557D894182F46B147E1BCE2D0814532C3E9AC4D4AB6B93E2871D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 bd9223b3d01fffc82ad0b8632d4b61dd37c57e2c8a118843c66ee81e3e77c5b3
MD5 506e7bfd83cc67a0c84db2c3b3d0472a
SHA1 ac88d5820298af78f19a33b3d2b598d18dc5310f
SHA512 932ef5c3e2892308b9d32c23d55203d53102b82e9ab43be82b7c13f964ab4c3b6900e64c131f78c55523dd8c9f1d8c1cc2f24aaa93ec6fa2d1b951c2aac3e889
SSDEEP 96:DVOmrh3uaxJgzBmrmnK1mDmt0mO+mgGBPBwBbKfMBLB0hONAwGlwd6:DYmF3uaxJg1mrm2mDmt0mzmge5kbKf4K
TLSH
T1D6A19EF747B1956E9A1195F0AA18EE1FCF2C0515831C786989E0BE27D3E3872E10275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 35f23708103de00968c3459cf189b4747ed6455dfa97a330748cbd6d93b426f7
MD5 395380dfc2694bf32d2be39e770a92e1
SHA1 ca01ad54df3ddfcfd94abb4d92ca79dd10c7d575
SHA512 3e11d498834829bf4b844cba547e4344888fb4dc9eceda639e76c81ad7388736ad613c622837ef8e5b071e36336b3542dc54785f3220209a637bdcd7e60fdc13
SSDEEP 192:sxRORKOM/fnsQvHm2Sm7aMszoD8py5Ti/g6+WNS4SKXY32vGoIgDzJ:sxRO7M/fnsQv2Pk2/5oKXX5
TLSH
T18D52C9166D28697B9CC7E21DBA96BF53D6FA6022A1D05F48E7FC870C00E66DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 112a05de09098e7ba2fa06e087e48e57a6e6ff41e95c39592268f66d16f53bc1
MD5 c3eabaf33c0f882edc1ce2f03b9bff1a
SHA1 37b04cf487a7877b2166ac5724ba029291cbf15c
SHA512 ed535a0262af8d086299fb634eaf94cc8e085271b5276498f89fd0633b1b2a75ab263a2009c14a83e1d002c33f7d149a222324d66c63775c5293b98266de2bd6
SSDEEP 192:sxRORKOM/fnsQzHm2Sm7aMszoD8py5Ti/g6+WNS4SKXY3YLvGoIgDBJ:sxRO7M/fnsQz2Pk2/5oKX7Df
TLSH
T1BC42B8166D24A97B9CC7D21DBE96BF53D6FA2022A1D06E48E7FC860C00E66DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 188d254ba289b5de682ae599600775923f1db7009b2168e3e40a195dabd89946
MD5 a55c68e65039bd55e46cebf884930d74
SHA1 c467758bd0a15e17e62c7099695bffc2f89271dc
SHA512 e8fdb3fa9c2d62f42a29eaeb8debfe2a7d41b45f4bce1f71ff1f1444c6fe7ab3fa976376b23fb3858609d27d39d12d3c0883e28b473932030b55eb213dec9265
SSDEEP 192:sxRxRKbM/fns3zHm2Sm7aMszoD8py5Ti/g6+WNSYSC/Y37LvGoIgOJ:sxRx6M/fns3z2Pk2/5wC/gDa
TLSH
T14642B8166D28A97B9CC7D21DFE56BF53D6FA2022A1D06E48E7FC860C00E66DD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 606d22ea4351c78332a86b04390940497a3814537e21001d3c14ed48c4d2122a
MD5 ae6eb16b513c5d8711729fa0badccc20
SHA1 40f56a0f30064bba4d18c24de6828f8f96cf2e2a
SHA512 e99837c4ee00740943951458da76340063eba3228fc2b17b36316dde1ff1f4612c53d7317dea2ecf787c02f5d7045d59355497eb9efbfb8e2f64f0beea6d1e02
SSDEEP 384:GMgEbt2fCtg0+FfKsKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVKO9W+RTVroOLx:GTEbtkWg0CfKs8F1+UoAYDCx9Tuqh0Ve
TLSH
T16EB2DA3B600DCB7E9F804AADAC59AFD76D5802C79B588D4047FE990C02C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a7a6975e3a9a5e0cad0df05b847255874fb5ed8d96076cfed44e05c36572265a
MD5 6ceea61567ac03c7eec8b852224d06cb
SHA1 dcd3f32230807c46fbbf07b5bf22adbf78b61e8a
SHA512 5a9cd138da9e2d6b445730f3d5f2664c1fdff9c885557fdcff34505bc321fa99583bbccf789a0055a85573256dbd028d1977ba7f75b3fabbd980bb0249844ce8
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHwBUAyeSIWWLbgIIK4Ng6Icoob6AFH8dIC:C1i7PF/DWrwfX9mgpct1o7zsHwBUAyeP
TLSH
T123914315313B1390393DBA4C91F9942F92C270A73018F56B7BAA11AA5F26F038CFE5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a30f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a30f4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4e9ab9ed7b64354f46909f821ccc2f4fcccc65fa1512433e8fd7ecf2d6ed914a
MD5 44a0d700967b504686b66f2fcc3bfabc
SHA1 3090e30e2e73de8c887a845f67f74d47d97772d7
SHA512 ff2ab4b3d56ab1b3da9e2eb634b81a81fd77c2062ccf5e224612c9c4b42bb4184bd180312096f7c150681c31ac6f9eb3eda54e07dbd0a17a6a5c63ec83e21e17
SSDEEP 768:XW3YZJFc+wfZOZf/df6LvShCQRbYMVcLCO7w/tBuJ:XW3eFwfOfFf0vSPYHCt/tBU
TLSH
T18BF2AF74D8B199738DE5A249B6477B03BEE5A133C6CC5A44C9DD5B0C01C37AE171B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 598561b447ea28eed2072266b60ea2eba9b6130063d2e37b2d92514cbe35ca18
MD5 d77a4a3237bf7e299575a8451360f6c3
SHA1 228e60e7deeb855e85a1ddfa2c9f6cf0d0b0ef8e
SHA512 0959698409d6c88e3bc7b106731845000667787d39f7fbc4251acc42dfd8332c93eb2fdf9691fad45dedeb0d9d9788b1eff7f5660b124333f6473702cabd4204
SSDEEP 768:8y3BDhFc+wfZOZf/df6LvShCQRbYMVcLCO7w/tBuJ:8y3ZNwfOfFf0vSPYHCt/tBU
TLSH
T17DF2BF74D8B199738DE5A249B6877B03BEE5A133C6CC9A44C9DD5B0C01C36AE171B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 0e5bf18fd798d78b03a65442d6293ce5da80843a238c1789eef61d62ba755399
MD5 e25bd665726e318e675ad71e05d98c82
SHA1 63b2756fd91f2ab57ffad4fdd84ba39db96156e3
SHA512 699c24db349461d754bb227badec59cf74e094aabd1e8d49ff34f0dba550d8e4e044b8f684146a7ba8ce2eb0d6a98e24a7191d76001c2e16d5f262f8f7300bf0
SSDEEP 768:KF953swgnZRFc+wfZOZf/df6RvShCQRbYMVcLCO7w/tBuJ:O53QdwfOfFfsvSPYHCt/tBU
TLSH
T141135BF188E38536D9AD574BA77E2E02AEBDD163F5889644B7C8490CCC826BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 5ba6bd98b9f5f1a09ddeb025f3b913021670d9928c4d90309bf864b2a4278766
MD5 0e3ae37bd88b8d4ca9fd263be3be52d4
SHA1 d07798491f9d957b3817e83df1b37fc6434489e2
SHA512 d27a7689f6d0f63cccb3d48646e79fd57a07b32c177218b31b92a9f9da87987524cf80ba32e040ba172a5f53b76f1b1355d89ee8878f5666859750c49a667844
SSDEEP 768:KFH53bwgn78RXc+wfZOZf/df6FgvShCQRbYMVcLCO7w/tBuJ:W53xEwfOfFf2gvSPYHCt/tBU
TLSH
T129136CF188E38536D99D574BA77E2E02AEBDD163F5889544B7C8490CCC826BFD30B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 4eaea58f2e5b811d9de415fff0885fc0134a630a27fe938ca956c8df27b98ad0
MD5 964a08c63b5c071904d6cad91419a50c
SHA1 fe807f533929bf26e794e3cfc4cd29b5e7aa810c
SHA512 ef0a405eacc643c72bdab2a659f644309687d67010e410447ef2cfc7e76975e801884874c17ce17d5d101cb988430a607cd2b3648d8a07a0a32553e683c8896b
SSDEEP 768:KFxJ3bwgnV8RXc+wfZOZf/df6FgvShCQRbYMVcLCO7w/tBuJ:uJ3TEwfOfFf2gvSPYHCt/tBU
TLSH
T166136CF188E38536D9AD574BA77E2E02AEBDD163F5889544B7C8490CCC822BFD30B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f42c54e1dbecc3e10f76149cb2217d16d679acd57b9cdb2035c4d35108d7bce0
MD5 893f4fc90afafda0cc322cd6fe9f6def
SHA1 6e54b51ff026619e404ad8b4a26ba930e42e5b5e
SHA512 4c486137ad2e464baa4e548db83e47ccbe2ae39050970b579d9ce4c884aa202b9ca583d59a0a611b9cbf86eafca88b07d32350e7d95c34914fb55efae2e1a067
SSDEEP 768:Rrv+4UNbd43ihkc+wfZOZf/avShCQtK2bwWV:RbsbO3iIwfOfivS20wO
TLSH
T18703DF36E86499339EE782487646BB637EB861B3C9C54784CACD0B0D419369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 2b4fca99fb3bd3d67305b157c8ffd1b6fce7ed0807083c3ced0bddf96a1dbb9a
MD5 d3f3cd7a9467924cda89beb87a9de911
SHA1 73b04a91fc3ba0adafbc627485812d6a33c42464
SHA512 41797fe423e8636aba2cb815c376a5c08e7dc48706d0cee33d2622c008c942e99d80490b4742f5aa7fe5436de2577e2fd6a42874b7b1490d641c716c71a31714
SSDEEP 768:KFCh3bwgnT8RXc+wfZOZf/df6FTvShCQRbYMVcLCO7w/tBuJ:Jh3BEwfOfFf2TvSPYHCt/tBU
TLSH
T104136CF188E38536D9AD574BA77E2E02AEBDD163F5889544B7C8490CCC822BFD30B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c0f664750a2d564a75a6597e269623d99b98d034808e150766faa45cec3f3f9c
MD5 33df7235df8689f19ffe070e908e5604
SHA1 ed78cda0c329f5d2ef32ee3d4553efaaedde7f9f
SHA512 5e3d6361f6a7a129dd06765c4cdcf1183b0ccec65df2551321315d1b2514c9b81726dda6ef149903222858e31c65a2417737f0236bcbb540142f6137c06ae521
TLSH
T105E00201521040BAC03D03310453153017F1E01002E2034B841012A11C562101F30DC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0cc1a462ae8ae1659e259614bf28657378188fbfd1ac6a022b2b4d89130f0681
MD5 56087d2080db495bff72cff3c866d3df
SHA1 8da2ca3de567f6f57692d974d4ac0ba8bfdf7e50
SHA512 e73ae58328cc56a263c4233ec7cfb44d6fb49478bd2338eb37e600f45ea6ec0d47a535e9e7115db664fb8e615490e419816cb27424287f5a81a5eec7d3c3fb73
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 73d51b3f117883eec62f46b1c4f2a25991fe35999beba8b658583f07f551cca0
MD5 fbf250b05d4722b0519a1e9e907c8db2
SHA1 43a3857e7029cfe0015e62b41fc883ffe3ccbe9f
SHA512 0bbeb6892a1681ef631503443823cf1d4bc3ef58df1f8031a643108a0586b338f327ed1ea266619e854b66bad1d49b4360ce6876088f6507f7b5a0950cf5a083
TLSH
T1E0E00202D31080FEC03D03310453163017F2E02002F20B4B881012E12C572141F30EC4
MD5 SHA1 SHA512 TLSH

Submit Download

d2234031-897f-4893-be9c-24d3afd36fce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d2234031-897f-4893-be9c-24d3afd36fce.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260727023859_000_dotnet_runtime_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260727023859_000_dotnet_runtime_9.0.18_win_x64.msi.log
Size 4KB
SHA256 9e42aa809e76481e5a0bbdd5339ba9058d3161b8aa0044ac50d3bcfef9ce9614
MD5 b9ab66043465256dfa8f558660ff100c
SHA1 56c19010fe3fc06b5d30a1b117178aab72d560d4
SHA512 dea2fcc46891397e1dd514a58b43cf1c2313a556fe7aa2310f695f326c03823dc8abd03000449fb94cbe6b0dea8253d2f9f41adc049f0fa32aabff03bd2399be
SSDEEP 96:YMU+1Pd/oPdDYPdapPdfOBPdZPd0PdAePd2fwdsiYdpdsfdHvdOcdCRdAucdAcKu:5UcVAVcVqVfOBVZV0VAeVnqDeVT+AtAy
TLSH
T189812A192FE80996B2B7560B5DF3C4175B33FDC25974CF0C1385832A46ABC009878B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260727023859_001_dotnet_hostfxr_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260727023859_001_dotnet_hostfxr_9.0.18_win_x64.msi.log
Size 4KB
SHA256 2936ea4c3c748b0a3456589389dff1fb5bcf6d8cf63afde28229a6218502d020
MD5 4be789e11f580bdcd6d4184fe69ac11a
SHA1 5f731bb81f5d53e4e6afcd0d7caadf09584d017d
SHA512 e9f31b60255a4f2e797af7bebf397f223646b1aec0e2bbd43f374d01b8e80699c12b2971d8a89fbdc085c26a26e8aa1e4bfae079609cad8de3b18d8bc974291d
SSDEEP 96:YM8+TPdrOPdX+PdetagPdLOnPdLPdMPdO4PdsfwdAitatdEPd92PdxmPdEta4PdQ:586VyVuVQVLOnVLVMVO4Vh2EVMVAVOVQ
TLSH
T1AC8116192FD50946B2B7970B9DF380264A33BCC258749F1D23C5471D47ABD06A878BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260727023859_002_dotnet_host_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260727023859_002_dotnet_host_9.0.18_win_x64.msi.log
Size 2KB
SHA256 aa0597c7210f5ec288af8ff4f07955b3b963d5c18b895439691f17eb7acb83b0
MD5 faa3e83f5c5de65361af07ef5407e297
SHA1 0ca2cb2a9476c15e9066109d1d99075700c822d6
SHA512 8c7b43a8145d68fb5b3f8804d100c3dd6cbf913bc54ac2fae575c10c2f677a2731841e8a3d8b8e2017238a71e874a634f49f9564641b7c3846852485f99a0b4a
TLSH
T16C4146182EE50916B2B7978B9DF3C016AB33FCD26874DF0C13859319466BC046C68BBE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260727023859_003_windowsdesktop_runtime_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260727023859_003_windowsdesktop_runtime_9.0.18_win_x64.msi.log
Size 2KB
SHA256 cb8b55a3df9b0579655ae815561de3b9abefdd4e7d6e22f6ce33ab50096df10d
MD5 2111d4c4ef46245a04ec3645d8812836
SHA1 af2e819f0d51419301c83fb4b3e6f998b54ba1c3
SHA512 3bdbc7d9343151b8a25c2e1e6fcc33cd9eb660ccb6a6fd115295a3393beba03efa52f711ad6558d6be4cabe697003287efcb3696b4b2eb07a973ab9431ecb70a
TLSH
T1E34124682FE80955F1B397479AF3C0135A33FCD26974DF0C23849319466BD0568ADBBA
MD5 SHA1 SHA512 TLSH

Submit Download

Default.json

Path C:\Users\Admin\Downloads\Pulsar_2026-07-06\PulsarStuff\Default.json
Size 901B
SHA256 b77dab98460ce76cba637fa4763dc40d6f43dff495700a114f9a23eb6ff15902
MD5 59413bccdf442b40f96397375570cc1f
SHA1 8bc5ef73f848a30edb259d669048c07540724916
SHA512 68e75151b32b83348740579cea7ffb40d14c604fc2073e56cc4bc5906d7880dd9b3e47757cb4ecb5e96178557e8aaa12609eba2da467ed4411c28a66d40f6442
TLSH
T10B110402DC9920BF65B0924CD4A58582A3084F1A22320C5BF2FF9AAD247397633CAFD5
MD5 SHA1 SHA512 TLSH

Submit Download

Pulsar.p12

Path C:\Users\Admin\Downloads\Pulsar_2026-07-06\PulsarStuff\Pulsar.p12
Size 3KB
SHA256 4a643c33caa8bfc2e8ad2a24e55c94b6825a0804ab2eae1aa4e281335d12701b
MD5 5513b276531c4d7492519fd55e7e6e35
SHA1 f91533ea960b3254b53bd2befc25a4860abdde9f
SHA512 d6f1828178577b751c1bdd556f4ea931b4ef948d46bbb0f23f857af1d80d16b633c05ba61b4de2348d5ca2600ea76c9acde84507cddf1470f7298d509b09fcf0
TLSH
T1FF716D1544BEC8507AA9FABB2EC85A01D03CD37077D65637A03D82BFD396BC5644D227
MD5 SHA1 SHA512 TLSH

Submit Download

MSI13E2.tmp

Path C:\Windows\Installer\MSI13E2.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.18-win-x64.exe

Path C:\Windows\Temp\{87697357-759E-48BF-A346-A47EFBFEDB91}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe
Size 607KB
SHA256 78a6d3bcdd33c659ba2e04ca01276bf725f4ced3654698f14706eeb93b924d3b
MD5 1be627af972f9f81164a08b0d7d6dfd6
SHA1 4d144311e2b9fb2d6f3470f3669eb5990c2c240d
SHA512 418fcea8100c6dae3f7f6a3eba06a9e64831ff7c03575fe3474074c6cb157cc9da742e7fb59a0df7ca0ae47f22281779e0746ce04a40c0e8bb3d2537474a08b7
SSDEEP 12288:CmEsd9PZfePv3xl7ft7V+6uC+zd5qLlJF3wURiy7nlEM0Dnma:Cm39PZfePv3r7fm6t+jqpz37rzCM0x
TLSH
T1B4D48D32A5614032F7F10673B92896303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{CCC39C9E-BCF1-4655-8BE1-607CBC5B14E0}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{CCC39C9E-BCF1-4655-8BE1-607CBC5B14E0}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_9.0.18_win_x64.msi

Path C:\Windows\Temp\{CCC39C9E-BCF1-4655-8BE1-607CBC5B14E0}\dotnet_host_9.0.18_win_x64.msi
Size 704KB
SHA256 999adf7d2c62e5c3dcf84f7d37de7b7239ed181320a34333be24e711ea31ac0a
MD5 84d594d4a01a5ef833b7f128e6527b4f
SHA1 c37629ebc7c6222903a49a6cbda70f9bca084cbf
SHA512 9a0f17c1f661777035637bb1122d3b07e1b5eea66e75659157da270bf37a3b8282bcfd0de84fb084f6eeee62d36d19b312451ad118bf05d2ae8cfdd5cbd53bbf
SSDEEP 12288:VDcWJ8xeV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:pcJkXdc3/7Rin+s
TLSH
T1A3E49D237D80803AD9BA1D31953DD7B16F3EBD204A64889B5380B91DDDF11C0AF76AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_9.0.18_win_x64.msi

Path C:\Windows\Temp\{CCC39C9E-BCF1-4655-8BE1-607CBC5B14E0}\dotnet_hostfxr_9.0.18_win_x64.msi
Size 776KB
SHA256 1e32234822baf467c0eb2e2b1b498ea5f19e68a37fa74a4fb54b4b0c880d7a76
MD5 91fbf55d6cc731e4742cfed4db34fa82
SHA1 199284451a7a4c5904e63e691dd1fc8d8f4ffcc4
SHA512 fec81c0ad9bd574690c7950fb0a4a973ece04caadcba92b9b1a1a0f7ce27bd6f718fa4e75fcc50ead37d965c7d6db1dcbf947a51b727a481610bd06e472e9038
SSDEEP 12288:0flV+AtnKhJXV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:Qj+A0hJXXdc3/7Rin+s
TLSH
T108F4AE137D80803AD9BA1D719539D7B16F3DBD204A64889B63807A1DDDF11C0AF36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_9.0.18_win_x64.msi

Path C:\Windows\Temp\{CCC39C9E-BCF1-4655-8BE1-607CBC5B14E0}\dotnet_runtime_9.0.18_win_x64.msi
Size 27.5MB
SHA256 16d8a182dcb54a7d93defedea3bd23cc44f291a5d430e9a41b3379add5c9c963
MD5 59589f076158800d29bf3f83136b3c38
SHA1 2298f1a89ce7c1208274675e90861f3e0c35c61e
SHA512 74ad9447089266ecb00a3646c063fb61f84e46c903b4663a7816165adc2b37118ddfbc214fc4fb0c760051bbe6da74d3a8534a4e948e22d8ed6e72c6365617c7
SSDEEP 786432:0mwF1ZdIi7qAuVQGdtzBg88DHVT3GwXd9L2:GFqVnhg8fwX3L
TLSH
T13A573393FD82843AE17D1D3194BE97B46A3D6E111B0ACC1BA254381DFDF22D04A72ED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_9.0.18_win_x64.msi

Path C:\Windows\Temp\{CCC39C9E-BCF1-4655-8BE1-607CBC5B14E0}\windowsdesktop_runtime_9.0.18_win_x64.msi
Size 30.0MB
SHA256 87a9ba31111ed5aab4d44e31e3ece65126150e27447f5e30aade964694589517
MD5 70cf6a2e93dc90095236ba5477b2c767
SHA1 1b52740168aea04639d6c9ceba8e498a90e5ba9f
SHA512 d38565990bd8b75fc946e0d0f769b7a990982d05d585ced1f6121ead5f615b9a5561b328e4258f9cb75f2b6dd32551695d796104910a4c4ef952c1e516364bc2
SSDEEP 786432:yl9KaCo8bNp5Q5leTPY+OK/iAcWWHUto1Pe:a9KBXQXeTSWW0toQ
TLSH
T1FD6733137D53E174E89A0E75823A9B60AF3F6E241A208DE74310BA1CDDF06D05D76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{E22E3B75-7E23-496F-BB4E-7EC34A20EB20}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download