a9af8b7f30369172fbc68daab97ecac167917a4b77d2286872b7cad80623041d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pulse.exe
Size 40.1MB
Sample260908-dazrqabq21
SHA256 a9af8b7f30369172fbc68daab97ecac167917a4b77d2286872b7cad80623041d
MD5 1040e60ea38f02453c2211a313fb5bce
SHA1 59e2972a9fd525f0bbb273ae9e5eea69e1f5b720
SHA512 4e0c82d121bdd4372847bf56c7d22c45b6977587c3237c15b42f25c63d2ca5961f8423be4b24fbc3285145019372365916d0d6817cd85baf8a89a901273001f8
SSDEEP 393216:xyx6XT7IImutHmCtlbNelBxeQR8vfhphg+qxsHqgEX:sx6XT7IImmHmCfspYphrqZ
TLSH
T1A59729117A6B987DD586C8B0C34B8A735F2130DB0A36B9BF448442393F79BF46B29719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pulse.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3588	powercfg.exe
4580	powercfg.exe
2964	powercfg.exe
5408	powercfg.exe
1756	powercfg.exe
3856	powercfg.exe
1120	powercfg.exe
2752	powercfg.exe
364	powercfg.exe
2112	powercfg.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5896	tasklist.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_1991177661\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_1991177661\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_828604984\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_1991177661\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_1991177661\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_1991177661\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_828604984\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_828604984\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_1991177661\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_1991177661\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_1991177661\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_1991177661\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-cu.hyb	msedgewebview2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5644	powershell.exe
3064	powershell.exe
2820	powershell.exe
4324	powershell.exe
5316	powershell.exe
4256	powershell.exe
1252	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4316	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4112	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry key 1 TTPs 11 IoCs

Modify Registry

T1112

pid	Process
1968	reg.exe
2664	reg.exe
912	reg.exe
4164	reg.exe
3476	reg.exe
1120	reg.exe
3116	reg.exe
4328	reg.exe
3464	reg.exe
4992	reg.exe
944	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4768	wmic.exe
4768	wmic.exe
4768	wmic.exe
4768	wmic.exe
3272	wmic.exe
3272	wmic.exe
3272	wmic.exe
3272	wmic.exe
1896	wmic.exe
1896	wmic.exe
1896	wmic.exe
1896	wmic.exe
4112	wmic.exe
4112	wmic.exe
4112	wmic.exe
4112	wmic.exe
2916	wmic.exe
2916	wmic.exe
2916	wmic.exe
2916	wmic.exe
832	wmic.exe
832	wmic.exe
832	wmic.exe
832	wmic.exe
2268	pulse.exe
2268	pulse.exe
3416	wmic.exe
3416	wmic.exe
3416	wmic.exe
3416	wmic.exe
4288	wmic.exe
4288	wmic.exe
4288	wmic.exe
4288	wmic.exe
2740	wmic.exe
2740	wmic.exe
2740	wmic.exe
2740	wmic.exe
4256	powershell.exe
4256	powershell.exe
4256	powershell.exe
2468	wmic.exe
2468	wmic.exe
2468	wmic.exe
2468	wmic.exe
1252	powershell.exe
1252	powershell.exe
2268	pulse.exe
1252	powershell.exe
4244	wmic.exe
4244	wmic.exe
4244	wmic.exe
4244	wmic.exe
5884	wmic.exe
5884	wmic.exe
5884	wmic.exe
5884	wmic.exe
2208	wmic.exe
2208	wmic.exe
2208	wmic.exe
2208	wmic.exe
3084	wmic.exe
3084	wmic.exe
3084	wmic.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1904	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4768	wmic.exe
Token: SeSecurityPrivilege	4768	wmic.exe
Token: SeTakeOwnershipPrivilege	4768	wmic.exe
Token: SeLoadDriverPrivilege	4768	wmic.exe
Token: SeSystemProfilePrivilege	4768	wmic.exe
Token: SeSystemtimePrivilege	4768	wmic.exe
Token: SeProfSingleProcessPrivilege	4768	wmic.exe
Token: SeIncBasePriorityPrivilege	4768	wmic.exe
Token: SeCreatePagefilePrivilege	4768	wmic.exe
Token: SeBackupPrivilege	4768	wmic.exe
Token: SeRestorePrivilege	4768	wmic.exe
Token: SeShutdownPrivilege	4768	wmic.exe
Token: SeDebugPrivilege	4768	wmic.exe
Token: SeSystemEnvironmentPrivilege	4768	wmic.exe
Token: SeRemoteShutdownPrivilege	4768	wmic.exe
Token: SeUndockPrivilege	4768	wmic.exe
Token: SeManageVolumePrivilege	4768	wmic.exe
Token: 33	4768	wmic.exe
Token: 34	4768	wmic.exe
Token: 35	4768	wmic.exe
Token: 36	4768	wmic.exe
Token: SeIncreaseQuotaPrivilege	4768	wmic.exe
Token: SeSecurityPrivilege	4768	wmic.exe
Token: SeTakeOwnershipPrivilege	4768	wmic.exe
Token: SeLoadDriverPrivilege	4768	wmic.exe
Token: SeSystemProfilePrivilege	4768	wmic.exe
Token: SeSystemtimePrivilege	4768	wmic.exe
Token: SeProfSingleProcessPrivilege	4768	wmic.exe
Token: SeIncBasePriorityPrivilege	4768	wmic.exe
Token: SeCreatePagefilePrivilege	4768	wmic.exe
Token: SeBackupPrivilege	4768	wmic.exe
Token: SeRestorePrivilege	4768	wmic.exe
Token: SeShutdownPrivilege	4768	wmic.exe
Token: SeDebugPrivilege	4768	wmic.exe
Token: SeSystemEnvironmentPrivilege	4768	wmic.exe
Token: SeRemoteShutdownPrivilege	4768	wmic.exe
Token: SeUndockPrivilege	4768	wmic.exe
Token: SeManageVolumePrivilege	4768	wmic.exe
Token: 33	4768	wmic.exe
Token: 34	4768	wmic.exe
Token: 35	4768	wmic.exe
Token: 36	4768	wmic.exe
Token: SeShutdownPrivilege	1756	powercfg.exe
Token: SeCreatePagefilePrivilege	1756	powercfg.exe
Token: SeShutdownPrivilege	2752	powercfg.exe
Token: SeCreatePagefilePrivilege	2752	powercfg.exe
Token: SeShutdownPrivilege	364	powercfg.exe
Token: SeCreatePagefilePrivilege	364	powercfg.exe
Token: SeShutdownPrivilege	3856	powercfg.exe
Token: SeCreatePagefilePrivilege	3856	powercfg.exe
Token: SeShutdownPrivilege	2112	powercfg.exe
Token: SeCreatePagefilePrivilege	2112	powercfg.exe
Token: SeShutdownPrivilege	3588	powercfg.exe
Token: SeCreatePagefilePrivilege	3588	powercfg.exe
Token: SeShutdownPrivilege	4580	powercfg.exe
Token: SeCreatePagefilePrivilege	4580	powercfg.exe
Token: SeShutdownPrivilege	2964	powercfg.exe
Token: SeCreatePagefilePrivilege	2964	powercfg.exe
Token: SeDebugPrivilege	5896	tasklist.exe
Token: SeShutdownPrivilege	1120	powercfg.exe
Token: SeCreatePagefilePrivilege	1120	powercfg.exe
Token: SeIncBasePriorityPrivilege	2268	pulse.exe
Token: SeIncreaseQuotaPrivilege	3272	wmic.exe
Token: SeSecurityPrivilege	3272	wmic.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2268	pulse.exe
2268	pulse.exe
2268	pulse.exe
2268	pulse.exe
2268	pulse.exe
2268	pulse.exe
2268	pulse.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2268	pulse.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4768	2268	pulse.exe	89
PID 2268 wrote to memory of 1968	2268	pulse.exe	92
PID 2268 wrote to memory of 1104	2268	pulse.exe	94
PID 2268 wrote to memory of 2264	2268	pulse.exe	96
PID 2268 wrote to memory of 5652	2268	pulse.exe	98
PID 2268 wrote to memory of 3380	2268	pulse.exe	100
PID 2268 wrote to memory of 2664	2268	pulse.exe	102
PID 2268 wrote to memory of 912	2268	pulse.exe	104
PID 2268 wrote to memory of 4164	2268	pulse.exe	106
PID 2268 wrote to memory of 1756	2268	pulse.exe	108
PID 2268 wrote to memory of 2752	2268	pulse.exe	110
PID 2268 wrote to memory of 364	2268	pulse.exe	112
PID 2268 wrote to memory of 3856	2268	pulse.exe	114
PID 2268 wrote to memory of 2112	2268	pulse.exe	116
PID 2268 wrote to memory of 3588	2268	pulse.exe	118
PID 2268 wrote to memory of 4580	2268	pulse.exe	120
PID 2268 wrote to memory of 2964	2268	pulse.exe	122
PID 2268 wrote to memory of 5896	2268	pulse.exe	124
PID 2268 wrote to memory of 1120	2268	pulse.exe	127
PID 2268 wrote to memory of 1904	2268	pulse.exe	129
PID 1904 wrote to memory of 3864	1904	msedgewebview2.exe	130
PID 1904 wrote to memory of 3804	1904	msedgewebview2.exe	131
PID 1904 wrote to memory of 3804	1904	msedgewebview2.exe	131
PID 1904 wrote to memory of 3804	1904	msedgewebview2.exe	131
PID 1904 wrote to memory of 3804	1904	msedgewebview2.exe	131
PID 1904 wrote to memory of 4512	1904	msedgewebview2.exe	132
PID 1904 wrote to memory of 2652	1904	msedgewebview2.exe	133
PID 1904 wrote to memory of 2652	1904	msedgewebview2.exe	133
PID 1904 wrote to memory of 2652	1904	msedgewebview2.exe	133
PID 1904 wrote to memory of 4436	1904	msedgewebview2.exe	134
PID 1904 wrote to memory of 4436	1904	msedgewebview2.exe	134
PID 1904 wrote to memory of 4436	1904	msedgewebview2.exe	134
PID 1904 wrote to memory of 4436	1904	msedgewebview2.exe	134
PID 1904 wrote to memory of 4436	1904	msedgewebview2.exe	134
PID 2268 wrote to memory of 3272	2268	pulse.exe	135
PID 2268 wrote to memory of 1896	2268	pulse.exe	136
PID 2268 wrote to memory of 3476	2268	pulse.exe	241
PID 2268 wrote to memory of 4112	2268	pulse.exe	141
PID 2268 wrote to memory of 5408	2268	pulse.exe	231
PID 2268 wrote to memory of 1120	2268	pulse.exe	145
PID 2268 wrote to memory of 2916	2268	pulse.exe	147
PID 2268 wrote to memory of 832	2268	pulse.exe	149
PID 2268 wrote to memory of 3416	2268	pulse.exe	151
PID 2268 wrote to memory of 4288	2268	pulse.exe	153
PID 2268 wrote to memory of 2740	2268	pulse.exe	155
PID 2268 wrote to memory of 4256	2268	pulse.exe	158
PID 2268 wrote to memory of 2468	2268	pulse.exe	162
PID 2268 wrote to memory of 1252	2268	pulse.exe	164
PID 2268 wrote to memory of 4328	2268	pulse.exe	166
PID 2268 wrote to memory of 4572	2268	pulse.exe	168
PID 2268 wrote to memory of 3116	2268	pulse.exe	170
PID 2268 wrote to memory of 4540	2268	pulse.exe	172
PID 2268 wrote to memory of 3656	2268	pulse.exe	174
PID 2268 wrote to memory of 4244	2268	pulse.exe	176
PID 2268 wrote to memory of 4648	2268	pulse.exe	208
PID 2268 wrote to memory of 2648	2268	pulse.exe	180
PID 2268 wrote to memory of 5884	2268	pulse.exe	182
PID 2268 wrote to memory of 5556	2268	pulse.exe	184
PID 2268 wrote to memory of 2208	2268	pulse.exe	185
PID 2268 wrote to memory of 3340	2268	pulse.exe	188
PID 2268 wrote to memory of 3084	2268	pulse.exe	190
PID 2268 wrote to memory of 2848	2268	pulse.exe	191
PID 2268 wrote to memory of 5644	2268	pulse.exe	194
PID 2268 wrote to memory of 4800	2268	pulse.exe	195

C:\Users\Admin\AppData\Local\Temp\pulse.exe
"C:\Users\Admin\AppData\Local\Temp\pulse.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get name /value
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1968
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v DisableAutoExclusions /t REG_DWORD /d 0 /f
  2⤵
  PID:1104
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Temp /t REG_DWORD /d 0 /f
  2⤵
  PID:2264
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Temp\pulse.exe /t REG_DWORD /d 0 /f
  2⤵
  PID:5652
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\D3DSCache /t REG_DWORD /d 0 /f
  2⤵
  PID:3380
- C:\Windows\system32\reg.exe
  "reg" query HKCU\System\GameConfigStore /v GameDVR_FSEBehaviorMode
  2⤵
  - Modifies registry key
  PID:2664
- C:\Windows\system32\reg.exe
  "reg" query HKCU\System\GameConfigStore /v GameDVR_FSEBehaviorMode
  2⤵
  - Modifies registry key
  PID:912
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\TCPIP\Parameters /v DisableTaskOffload
  2⤵
  - Modifies registry key
  PID:4164
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 be337238-0d82-4146-a960-4f3749d470c7 -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1756
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 893dee8e-2bef-41e0-89c6-b55d0929964c -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 bc5038f7-23e0-4960-96da-33abaf5935ec -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:364
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 36687f9e-e3a5-4dbf-b1dc-15eb381c6863 -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3856
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 0cc5b647-c1df-4637-891a-dec35c318583 -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2112
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 45bcc044-d885-43e2-8605-ee0ec6e96b59 -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3588
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 465e1f50-b610-473a-ab58-00d1077dc418 -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 93b8b6dc-0698-4d1c-9ee4-0644e900c85d -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq PULSE.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5896
- C:\Windows\system32\powercfg.exe
  "powercfg" /list
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-dev-tools --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2268.1200.11977609108497456355 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView /prefetch:4 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8143f5fd8,0x7ff8143f5fe4,0x7ff8143f5ff0
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1804 --field-trial-handle=1808,i,13106991191764088001,841669510811726291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:3804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1808,i,13106991191764088001,841669510811726291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2420 --field-trial-handle=1808,i,13106991191764088001,841669510811726291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3548 --field-trial-handle=1808,i,13106991191764088001,841669510811726291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1948 --field-trial-handle=1808,i,13106991191764088001,841669510811726291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1808,i,13106991191764088001,841669510811726291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4692 --field-trial-handle=1808,i,13106991191764088001,841669510811726291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4672 --field-trial-handle=1808,i,13106991191764088001,841669510811726291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:1812
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" memorychip get SMBIOSMemoryType,Speed /format:csv
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get name /value
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3476
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_videocontroller get name /format:csv
  2⤵
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Windows\system32\powercfg.exe
  "powercfg" /q SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 45bcc044-d885-43e2-8605-ee0ec6e96b59
  2⤵
  - Power Settings
  PID:5408
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\PULSE /v InstallerLanguage
  2⤵
  - Modifies registry key
  PID:1120
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path Win32_NetworkAdapter where "NetEnabled=TRUE AND PhysicalAdapter=TRUE" get AdapterTypeId,NetConnectionID,InterfaceIndex /format:csv
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get Name,Manufacturer,NumberOfCores /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:832
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path Win32_NetworkAdapterConfiguration where IPEnabled=TRUE get DefaultIPGateway,InterfaceIndex /format:csv
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path Win32_PerfFormattedData_PerfDisk_LogicalDisk where Name='C:' get DiskReadBytesPerSec,DiskWriteBytesPerSec /format:csv
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4288
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "path win32_videocontroller" get Name /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance win32_videocontroller | ForEach-Object { Write-Output ('Name={0}' -f $_.Name); Write-Output '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4256
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" baseboard get Manufacturer,Product /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance Win32_BaseBoard | ForEach-Object { Write-Output ('Manufacturer={0}' -f $_.Manufacturer); Write-Output ('Product={0}' -f $_.Product); Write-Output '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games /s
  2⤵
  - Modifies registry key
  PID:4328
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Electronic Arts" /s
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Electronic Arts" /s
  2⤵
  PID:3116
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallPath
  2⤵
  PID:4540
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallLocation
  2⤵
  PID:3656
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get Name,Manufacturer,NumberOfCores /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v GamePath
  2⤵
  PID:4648
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallPath
  2⤵
  PID:2648
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" memorychip get SMBIOSMemoryType,ConfiguredClockSpeed,Capacity /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5884
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallLocation
  2⤵
  PID:5556
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "path win32_videocontroller" get Name /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v GamePath
  2⤵
  PID:3340
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get Caption /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallPath
  2⤵
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance win32_videocontroller | ForEach-Object { Write-Output ('Name={0}' -f $_.Name); Write-Output '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5644
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallLocation
  2⤵
  PID:4800
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v GamePath
  2⤵
  PID:4368
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallPath
  2⤵
  PID:4608
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallLocation
  2⤵
  PID:4756
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v GamePath
  2⤵
  PID:5864
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallPath
  2⤵
  PID:5204
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallLocation
  2⤵
  PID:4648
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v GamePath
  2⤵
  PID:2820
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallPath
  2⤵
  PID:4680
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" baseboard get Manufacturer,Product /format:list
  2⤵
  PID:2604
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallLocation
  2⤵
  PID:1060
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v GamePath
  2⤵
  PID:3296
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallPath
  2⤵
  PID:1756
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallLocation
  2⤵
  PID:4856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance Win32_BaseBoard | ForEach-Object { Write-Output ('Manufacturer={0}' -f $_.Manufacturer); Write-Output ('Product={0}' -f $_.Product); Write-Output '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3064
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v GamePath
  2⤵
  PID:2876
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallPath
  2⤵
  PID:2728
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallLocation
  2⤵
  PID:4772
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5408
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v GamePath
  2⤵
  PID:1496
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4368
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" memorychip get SMBIOSMemoryType,ConfiguredClockSpeed,Capacity /format:list
  2⤵
  PID:1216
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get Caption /format:list
  2⤵
  PID:4312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "Get-CimInstance MSAcpi_ThermalZoneTemperature -Namespace root/wmi 2>$null | Select-Object -First 1 -ExpandProperty CurrentTemperature"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2820
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games /s
  2⤵
  - Modifies registry key
  PID:3464
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Electronic Arts" /s
  2⤵
  PID:2376
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Electronic Arts" /s
  2⤵
  PID:6064
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallPath
  2⤵
  PID:1788
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallLocation
  2⤵
  PID:1644
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v GamePath
  2⤵
  PID:4536
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallPath
  2⤵
  PID:5820
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallLocation
  2⤵
  PID:4252
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v GamePath
  2⤵
  PID:248
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallPath
  2⤵
  PID:2508
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallLocation
  2⤵
  PID:1144
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v GamePath
  2⤵
  PID:5352
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallPath
  2⤵
  PID:4312
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallLocation
  2⤵
  PID:4156
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v GamePath
  2⤵
  PID:5012
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallPath
  2⤵
  PID:1332
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallLocation
  2⤵
  PID:1184
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v GamePath
  2⤵
  PID:3980
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallPath
  2⤵
  PID:4444
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallLocation
  2⤵
  PID:2332
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v GamePath
  2⤵
  PID:5816
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallPath
  2⤵
  PID:5828
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallLocation
  2⤵
  PID:5412
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v GamePath
  2⤵
  PID:2728
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallPath
  2⤵
  PID:3756
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallLocation
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v GamePath
  2⤵
  PID:3472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "Get-CimInstance MSAcpi_ThermalZoneTemperature -Namespace root/wmi 2>$null | Select-Object -First 1 -ExpandProperty CurrentTemperature"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4324
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v DriverDesc
  2⤵
  - Modifies registry key
  PID:4992
- C:\Windows\system32\reg.exe
  "reg" query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString
  2⤵
  - Checks processor information in registry
  - Modifies registry key
  PID:3116
- C:\Windows\system32\cmd.exe
  "cmd" /C ver
  2⤵
  - Executes a command shell one-liner
  PID:4316
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games /s
  2⤵
  - Modifies registry key
  PID:944
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Electronic Arts" /s
  2⤵
  PID:1352
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Electronic Arts" /s
  2⤵
  PID:4628
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallPath
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallLocation
  2⤵
  PID:5424
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v GamePath
  2⤵
  PID:1308
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallPath
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallLocation
  2⤵
  PID:4776
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v GamePath
  2⤵
  PID:1404
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallPath
  2⤵
  PID:3236
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallLocation
  2⤵
  PID:5640
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v GamePath
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallPath
  2⤵
  PID:1804
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallLocation
  2⤵
  PID:364
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v GamePath
  2⤵
  PID:2100
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallPath
  2⤵
  PID:5652
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallLocation
  2⤵
  PID:2352
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v GamePath
  2⤵
  PID:3460
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallPath
  2⤵
  PID:1856
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallLocation
  2⤵
  PID:2084
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v GamePath
  2⤵
  PID:3776
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallPath
  2⤵
  PID:2996
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallLocation
  2⤵
  PID:2440
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v GamePath
  2⤵
  PID:1620
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallPath
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallLocation
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v GamePath
  2⤵
  PID:6076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "Get-CimInstance MSAcpi_ThermalZoneTemperature -Namespace root/wmi 2>$null | Select-Object -First 1 -ExpandProperty CurrentTemperature"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5316

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1060

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3476

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4968

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 60a30a1521e850477d3b70e39a97ceb1dda2ca14d15fdcf4eb78d1d7d6666ad5
MD5 b64e1500ffec9443f531fd73954f36cb
SHA1 9dbd4e75222245513267c03789d817c23b08c3bc
SHA512 e5e98f1abf48bc6bf88df5e46830eab28f1e7ca0c354e4866b9c7a5a46f838ddaca70eb92236a545baef79e79cd4d57353c77e5dfb3ea6e2085136474f6a17cb
TLSH
T171217633B3DC8614C8AA013A10DDAC1036B687DB40DECF9B6B85E159A42F298DFA0160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54906a57c7cf27ddd1c9e844b734d9109475a0734aefd46c42572e886e808926
MD5 7604ae72e87fbc9f55eea257bc42ab5c
SHA1 0c52c6396f3715f857c6efdf9ac921eee3ada859
SHA512 4eadae2747118d02473e00f5d0d6d8852e1a73b823906280e8e0d3f98f6750c550ebd74aea77e4a36165b6680d34671e6c1bf064ca744897b42f426ac0a58af8
TLSH
T126219837F3DC8214C8AA003A10DDAD0036B6CBDB40DECF5B6BC1E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1104eec9f0b104ed48aee04a6bf5be771ecbca9612905a22a20a14bc6898f9de
MD5 8fa303ff4cbd2d2b5df2dec876ca5e37
SHA1 ceff6a9208202c77782f57787a8261070400cfec
SHA512 5365681e78515bb7606cef3889dd9d7fdf988b4c727607ec0464d563a959728763387604c13f5a717ffd820774dc83640e35524b8aae89d4a3371aee6ce18b83
TLSH
T1F6217633F3DC8224C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DFA0160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 94d46bf6480771ff90c7dca5f3e32270a686b65728f0cd22130ea97516bbdda1
MD5 1f19e2f9dded3c8e62c5d8b6200fcaf7
SHA1 d9232aac68676c051d0ec1f861a856518643d8b6
SHA512 6f0d054cdaaab5db919756aa1d7cee8aee02d5a3038f4078bafe3004b6adfa2799d2219c62dc04c8fc48603b7558aad0457577e3c2fb2b76cf34fb7d6172897a
TLSH
T1AB219837F3DC8214CCA9003A10DDAD0036B6C7CB40DECF5B6B85E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tgsyq4e5.cei.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tgsyq4e5.cei.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 713547db1b9e8a5d0b833eecf5a87360e0d87da25c1559ecd3ee02456efaacf2
MD5 44346a59d2af7daf06036f3595993d8a
SHA1 e7df8de7d74b7ebda88612bcf58289ec3dbb4911
SHA512 5890281e13d50887428fd7982206107795d145862c75f4427095a0904212ee8f1bc010bae5e7810e6743f2f57afbd57cf8c21be81ba096faaf3ce118ae4fd87f
TLSH
T146D004107741100CD41010711015C5D00D0C4574C4151F1500141D150CC44150141050
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 32a95244aa30449ec32ba21d8681bbfe7a798a4db434479590b8d3f1df0866fd
MD5 9054d22a3b56758ebb91a28af297cd11
SHA1 dd4d30d86444411c309010b1c4afb026598759af
SHA512 febd29b4a187aeaa5002770cd3c5ebcbd48ee4498f09fe90ee47cc18af9c25e778bd0cf575420764ff21ae59d3f51d990625afe1b9da27b7e8ed0338f95018f5
TLSH
T14BD012123742013CC42020731003A5880C04C22FC0094505542C9E2E1E884640A02491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 ad9ebcaa2358a316f5b5201333aedde29810c9ad182787b32614b1ec822f2a07
MD5 8924bcb784aa1319573096437cb40ace
SHA1 dd69b696780e00f2c18d3c304cd3d7e7e8baa489
SHA512 a7fe67ba999ca408447d7e85e60f8451a6b62278a0a09c3ae2d66e3c28b545a16afe7c65c1072069385e89d15a9da9c36d2b8520f2d039413aea4afe2f22b3e2
TLSH
T11AE02ED318A0622BC738033278D820073AB6C02708AF0D56C086D17EBCEB30B4CB2E34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5964bb.TMP

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5964bb.TMP
Size 48B
SHA256 f8554a00f4a2c7909c849ed31b3b53be05b9f3b6f404b62855a98bef36d259f7
MD5 889daa49e6f4ac8db0eb3562bc73b89f
SHA1 418bc0a98b17b0750f3436cc96ec2c93a8b36c07
SHA512 0a53f8ce3cf045d114c424b6022ff2919715328cd141ff0abbe983ec3dc96a612a28ec5cb52d93d327b34649bef742ad35c1e4068b61bc5322520c7c3ab25df5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

86442d21-cd74-45c3-a6f8-da15407a6591.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\86442d21-cd74-45c3-a6f8-da15407a6591.tmp
Size 856B
SHA256 c09915e30e244a3a977324e1f713650d099d95afbb9cb010b0cc57a05a41c57f
MD5 a200a77f3ce3187f2cec15de48f4d3d7
SHA1 9627b6637c9bd93cdb81e4f0c3d30602359f679a
SHA512 73df23448b29165c3b98d1ac4f681ff763ea0fbb483584459a9af95955feb9dfd90a8ab3018733aba4809004dc2b050392b714e1720a7d43f8896e125857b57d
TLSH
T14511AF53467BA82B506D493B2D197C210D79F0374581B8F4EEA7423D7888CFB4303162
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 a150efa80915d20cc2324e38ddb77fe75a02a93c7c3fee71d54162e2c439247f
MD5 6f432ccccd1a00e39710843e42ab9f79
SHA1 b1ff67d87751180d023ded0620dcd8b85c0d8814
SHA512 4bd409826c823eeda8cd083ae807d5b6294c3a7ba0bf2128f9da1cbe1b4b80f244e27a81a7a3aed32e23a687cb3e49d5e6b23d021e8b554a03ebd1bfbacc17fe
TLSH
T1A741A392C3D4C76DC65167E46B34391BC83D051C92143D2B8EDBEFEA6BD2471D11220A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a281b.TMP

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\Network Persistent State~RFe5a281b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 8d9a59e8843528b2820af876658287bf441d7cc3c716b1bbd74a8c66888426ee
MD5 c97ee3c500b66e53cfbb60f6e8822b84
SHA1 0ac1632476a0fa7075c358f0833ad02affa4066b
SHA512 b9211c6f1fabf1af5bb66679165d1c4a1738fba7bfd9f960a303f564b037b400da3203f34f47cc8464f9b56db1a04662302b086b571743d5c640b32c0b1a04b6
TLSH
T111118C1346BAA4770079083F2D197C325DBAB436118264F4CE93423C78408B71603226
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 1b03853cefb0a2cfbb13ea808cf60f671c181d3c834130e5ecdb60e799e45bfa
MD5 8591f16c4a8504ba0d1d61ca530114c4
SHA1 9db799e614a4550730dc553373b87e66bb32bdf0
SHA512 500c7d963ef9b6b93b84bf3611772b1b9637b80bbab3ab68b6a527c9a162d1ecac4174ac88b4d0be16102b7eaa7a75438f91ca209418da3e7899eb313790bcf9
TLSH
T102118C53467BA47A203E487E6E097C310DBAB93A4592A4F4CEE7827C78948B74203122
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 73fb516030697670fea88769b2974c5f3c4ed9eb75e214957bc232367a39fe8a
MD5 1f92b880cfad5df1aed154114cb6ea1e
SHA1 bc1f2718de6bbe6eca5baccecae33fbc491c6c57
SHA512 a23e761b170f951f650994404fe017d88f9679d9b3b39d7eca013ca7c229db39b3d227fe196d818bb3a7f44f6f9c22012cd2103c89015d102c1ac2b725fa039b
TLSH
T182114853467BA47B503E487A2E0A7C654EBAB43E459274F5DEE3827C7884CBB4303922
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59b27d.TMP

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\TransportSecurity~RFe59b27d.TMP
Size 856B
SHA256 7022cc97eb90318ff32affd3726beb4438303143413327c1d267705ef7b908c0
MD5 0702f5f1e9d877ab531e87454a860c44
SHA1 f4908545a40cf4b570c078d34873bc83d0661112
SHA512 704f73ea3c7ff23ac519929c366f6a25a336819ba452835b5adbfd31b80e7b84dbc0c32db937db0392de570e3d1063080bcdb6b9c89d3191462bbeefb597b506
TLSH
T151116B53467AE93B112D483F6D0A7C654EBAF53646C178F4DEA7827C78809A75303122
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Preferences
Size 6KB
SHA256 a474f25f33bcee193df2931ab1283c4cbc1bdd8acf5fe4211f6f67940a4b160a
MD5 cb26b608d4f557b9115d2ec1635e38e3
SHA1 0211152a2751edd4d61b4aff6fd38d923b8acdd9
SHA512 401f19d33b9f44249a506d48b741e8a85ca1b1392f26705b92a0d1f8bbfe72d9978dc27952bb350c6dc86d627b3f8a2abf3dcd16446cc26e60bde4ed03e67a15
SSDEEP 96:stYx/dM+l6NSbGMb9WkpZo5h16Z05s7/x+6MhmuecJET1ejecK+gJm28XM1C7K:stYlOY6ZmZon5sV+FdETQjcuG6K
TLSH
T156D195025E24797B4CD7E618BE297A27E2F9607271D51E58E7F84A2C04DA6CC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cbfc3aec-50b6-4517-96ec-014b3f939a65.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\cbfc3aec-50b6-4517-96ec-014b3f939a65.tmp
Size 6KB
SHA256 ae9d31d80755b1477a5eb53afc125c4222473f6da7094e44ebe29ea1d1342247
MD5 6a92f082e0f75d72504b045bc20e37ab
SHA1 261e7a9847d250ecab8f8dc4bf6fa6a383918f05
SHA512 67582bcc8583a0e0f3e11dd5a7f9035c66d047e5fcf79115c86f673521d41f00efefda977010250888fa11bfd92aec0415b1381bedb913a4bece37f31409ee0e
SSDEEP 96:stYx/dM+l6NSUMb9WkpZo5h16Z05s7/x+6MhmuecJET1ejecK+gg28XM1C7K:stYlOY6LmZon5sV+FdETQjceG6K
TLSH
T13FD195015E28797B4CC7E619BE29BA27E2F9607271D51E58E7F84A2C04DA6CC7307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Local State
Size 15KB
SHA256 535f33b7ad83cde6f7b53711a676c26b93302cbef56d2b8558d232034b9170b2
MD5 c446e6fe31f2459c1ee2eb16f00654f7
SHA1 93a8d0379ef882d9b798a111fb46203b72a56c79
SHA512 1057511a0db6af080a846a789f581e3c31e32170f527ca4ff58f0ddabbb9ef4f59b2c31ff53e8800de4fdb8e79e0586c1610e76ba5d3a6a6dc4bde7d5e4779f4
SSDEEP 384:k+aQikB+z/xvxjg/qhEmNBSNmk4LlW59zD:D/UxvxjgC+mJ5iFD
TLSH
T19972AE2B95797E2396B3F604794D1B5FDBB894B281C17EB84AAD1F0D06D73981306C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Local State
Size 2KB
SHA256 c6297f619735d994b81e783a6719d301d526220e011f79a2df8267c23da159e5
MD5 d1447df88c5e4d55efad4ecc2f782359
SHA1 35a4dca40929f122c1258071767aeb1b5bd6e0e2
SHA512 bead6059be373affe1ede40df18330d76d8ce808305117ddaaac12beac7ec7dd69f4e7f4b1b633e002d0661221685e6bd25f8f2b0b3bd0980e41b9ee67f2c394
TLSH
T1FC5192736820AA7399B25708BD8A3F27AE35A0A2DA522F54D6ED0B1800D725C134AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Local State
Size 3KB
SHA256 55664f0fb1d6c2dba46e61cefeb583dc744b99e4b5449ec164d9f4ce1612542b
MD5 bff2548cc6438e62f9e09f996aad91f7
SHA1 ef86021d6c52f42d12862b9df2198394ff8f4c95
SHA512 f520062b56f1db32606645dc104a0d4923a003224dc90d9c16b5dac28e3f1cf03ab1181007a8febf949b58911ce20d15c35147a693c9a97c93b0bcfda4a153cc
TLSH
T1626184776970A9375EB29A04BCCA3B16BB655033E5853F98C6EC0F1D01D73981342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe591013.TMP

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Local State~RFe591013.TMP
Size 1KB
SHA256 6c6b69ee0adcc19ddc9fde26af6beae36d4f173a2ada5efaaedb1c05c6b08a59
MD5 91650ca149d5b477284530937c0793fd
SHA1 56b5c154cd954482d1aa419ecffd2c2d442ead1f
SHA512 91ef29e34a16bbb70a286d7eee418256fd3cc83778e8e6c0a8b226ef7b3d7f5288a6815fc885b118c273cb2ab51a1335ec11237f05041cff9132752971638f14
TLSH
T1332140F7E8705B73AC62620A758A7A1B6E3010B6C3019E0891DE062A01E625CD65EC33
MD5 SHA1 SHA512 TLSH

Submit Download

pulse.log

Path C:\Users\Admin\AppData\Local\com.pulse.app\pulse.log
Size 2KB
SHA256 fb7d2809f17f20fe559752c6de85c7cc229b6c23ddff99eb6840c564b1531799
MD5 1643077c0e21f5ee00c6f06737bf9807
SHA1 7820e7dbb05dcc47917347615ff6522c22223f53
SHA512 436d87df2565d2c5ac11c18e61c883092ca96f24789473d15c84dc300457bc5fbdb77a7be83d0f09aaef26ee445116cd060a6238395e4f68a6c2fd7f77f8b72e
TLSH
T17851EB2133FE31677738A59BA463672BCAC1BB1611409F11A678186E242FC2C3A3D82C
MD5 SHA1 SHA512 TLSH

Submit Download

pulse.log

Path C:\Users\Admin\AppData\Local\com.pulse.app\pulse.log
Size 1KB
SHA256 dd1b74122bbb0908f22f1096989eb869b0096ca3815f0a61fdf09f94fe8fdf12
MD5 984c8453e8b197b5eea29d8aea8ee596
SHA1 343ce81120fd3c3245d8a2bfd4bf948fe51dc31d
SHA512 e31f0b8d868e76bf01780fc5eda73032816c97e8662f0508cd1e09957a1780218420731721c7668416c60945d8b28c5fd58cfa4f6c5aeea43d4d3a7d10fa0cb9
TLSH
T1C021793272FE6637B7255187B893B73ED2E1BB0611444B226A782C6A102FD5C3E6981D
MD5 SHA1 SHA512 TLSH

Submit Download

pulse.log

Path C:\Users\Admin\AppData\Local\com.pulse.app\pulse.log
Size 8KB
SHA256 8311b89bb11c29003ac2415d6c60473c8f32d79463adea6ce494271c3adeae3f
MD5 a9d78350d06f821a7fa49d9f46dab330
SHA1 35d999261c82821c8f81f40c2903d15e819baade
SHA512 02968c62febabab5caf0065a5d87d51e8f5fb7af40439144d21898784a522c6f47b98fd81951510e217bbf2eacd6b22427857debc5d247443be89255a88f94ca
SSDEEP 192:deWlWlWlWBh2ggWP265lGvWlWRFMbZ5KDlt/:dq2lq265lG6U/
TLSH
T13902DD1133FD31B76635965AE533272BC6C1BB270440CF10A76818AE347FDAD296DCA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pulse.log

Path C:\Users\Admin\AppData\Local\com.pulse.app\pulse.log
Size 1KB
SHA256 0f6271cf3fa3c3cfa6a8e9cf769ed2f24284c7f975b838dda4c952911d3b79f2
MD5 b3eeaa855712fed0db0f7c5519fe563b
SHA1 c9415491b67866d747ec3502d747cc215aae5591
SHA512 07fa0c070384fdebd79a321d4d461f6a2ba214d7e7b74c909f34e7eebc9f01180ecb51c0b177d3318c6dc712c59e32dfbcb2cfb39ab361273aeec61e91639941
TLSH
T100318A2172FE712773359187A8A3B77EC2D1BB1611444B15AA341C6E207FD2C3E6882D
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1904_81924515\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-462-0x00000239FC810000-0x00000239FC8C2000-memory.dmp

Download

memory/2628-922-0x00007FF8363E0000-0x00007FF8363E1000-memory.dmp

Download

memory/2628-923-0x00007FF8363F0000-0x00007FF8363F1000-memory.dmp

Download

memory/3804-59-0x00007FF8363E0000-0x00007FF8363E1000-memory.dmp

Download

memory/3804-659-0x000001C21ED70000-0x000001C21EF09000-memory.dmp

Download

memory/4256-406-0x0000016D29D90000-0x0000016D29DB2000-memory.dmp

Download

memory/4256-413-0x0000016D42170000-0x0000016D42194000-memory.dmp

Download

memory/4256-411-0x0000016D42130000-0x0000016D4213A000-memory.dmp

Download

memory/4256-410-0x0000016D42070000-0x0000016D42122000-memory.dmp

Download

memory/4256-412-0x0000016D42170000-0x0000016D4219A000-memory.dmp

Download

memory/4256-409-0x0000016D42050000-0x0000016D4206E000-memory.dmp

Download

memory/4324-938-0x0000020D797B0000-0x0000020D79862000-memory.dmp

Download

memory/4436-135-0x00007FF8363E0000-0x00007FF8363E1000-memory.dmp

Download

memory/5644-543-0x0000022719910000-0x00000227199C2000-memory.dmp

Download

memory/5864-1055-0x0000026D68980000-0x0000026D68981000-memory.dmp

Download

memory/5864-1053-0x0000026D68980000-0x0000026D68981000-memory.dmp

Download

memory/5864-1052-0x0000026D68980000-0x0000026D68981000-memory.dmp

Download

memory/5864-1051-0x0000026D68980000-0x0000026D68981000-memory.dmp

Download

memory/5864-1054-0x0000026D68980000-0x0000026D68981000-memory.dmp

Download

memory/5864-1050-0x0000026D68980000-0x0000026D68981000-memory.dmp

Download

memory/5864-1046-0x0000026D68980000-0x0000026D68981000-memory.dmp

Download

memory/5864-1044-0x0000026D68980000-0x0000026D68981000-memory.dmp

Download