hxxp://browsergo[.]com

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://browsergo.com
Sample260910-s9xtqsdn9v

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
84	1640	msedge.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	pulsebrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	pulsebrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	pulsebrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	pulsebrowser.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 23 IoCs

pid	Process
1804	setup.exe
4348	updater.exe
4352	updater.exe
5148	updater.exe
5164	updater.exe
6028	pulsebrowser_installer_149.0.7827.158.exe
6100	setup.exe
6128	setup.exe
4624	setup.exe
5568	setup.exe
5692	pulsebrowser.exe
2696	pulsebrowser.exe
3140	pulsebrowser.exe
3132	pulsebrowser.exe
2468	pulsebrowser.exe
3368	pulsebrowser.exe
3896	pulsebrowser.exe
4436	pulsebrowser.exe
5888	pulsebrowser.exe
6368	pulsebrowser.exe
6624	pulsebrowser.exe
6852	pulsebrowser.exe
6248	pulsebrowser.exe

Loads dropped DLL 31 IoCs

pid	Process
5692	pulsebrowser.exe
5692	pulsebrowser.exe
2696	pulsebrowser.exe
3140	pulsebrowser.exe
2696	pulsebrowser.exe
3140	pulsebrowser.exe
3140	pulsebrowser.exe
3140	pulsebrowser.exe
3140	pulsebrowser.exe
3140	pulsebrowser.exe
3140	pulsebrowser.exe
3132	pulsebrowser.exe
3132	pulsebrowser.exe
2468	pulsebrowser.exe
2468	pulsebrowser.exe
3368	pulsebrowser.exe
3368	pulsebrowser.exe
3896	pulsebrowser.exe
3896	pulsebrowser.exe
4436	pulsebrowser.exe
4436	pulsebrowser.exe
5888	pulsebrowser.exe
5888	pulsebrowser.exe
6368	pulsebrowser.exe
6368	pulsebrowser.exe
6624	pulsebrowser.exe
6624	pulsebrowser.exe
6852	pulsebrowser.exe
6852	pulsebrowser.exe
6248	pulsebrowser.exe
6248	pulsebrowser.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PulseBrowserUpdaterTaskUser135.0.7049.101 = "\"C:\\Users\\Admin\\AppData\\Local\\PulseSoftware\\PulseBrowserUpdater\\135.0.7049.101\\updater.exe\" --wake"	updater.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\manifest.fingerprint	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\SETUP.EX_	pulsebrowser_installer_149.0.7827.158.exe
File created	C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping5692_510808198\_metadata\verified_contents.json	pulsebrowser.exe
File created	C:\Program Files\chrome_url_fetcher_5164_444085096\pulsebrowser_installer_149.0.7827.158.crx3	updater.exe
File opened for modification	C:\Program Files\chromium_installer.log	setup.exe
File opened for modification	C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\setup.exe	pulsebrowser_installer_149.0.7827.158.exe
File created	C:\Program Files\PulseSoftware1804_626959025\UPDATER.ARCHIVE.7Z	setup.exe
File created	C:\Program Files\PulseSoftware1804_1151904690\bin\updater.exe	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\PULSEBROWSER.ARCHIVE.7Z	pulsebrowser_installer_149.0.7827.158.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\pulsebrowser_installer_149.0.7827.158.exe	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\setup.exe	pulsebrowser_installer_149.0.7827.158.exe
File opened for modification	C:\Program Files\chromium_installer.log	setup.exe
File created	C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping5692_510808198\preloaded_data.pb	pulsebrowser.exe
File created	C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping5692_510808198\manifest.json	pulsebrowser.exe
File created	C:\Program Files\PulseSoftware1804_1151904690\updater.7z	setup.exe
File created	C:\Program Files\PulseSoftware1804_1151904690\bin\uninstall.cmd	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6100	setup.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1640	msedge.exe
2696	pulsebrowser.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pulsebrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pulsebrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	pulsebrowser.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	pulsebrowser.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	pulsebrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	pulsebrowser.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335290129911403"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	pulsebrowser.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{3B0D60EF-13AB-518C-90C1-E927736125C6}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{847BB70C-47D0-46C2-8C97-9000A1F9AD99}	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{3C0435E1-B19F-4B7A-8481-D7EBAEBFAF47}\ = "IPolicyStatus4User"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{47C8886A-A4B5-4F6C-865A-41A207074DFA}\1.0\0\win64	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{7D908375-C9D0-44C5-BB98-206F3C24A74C}\1.0\0	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{47C8886A-A4B5-4F6C-865A-41A207074DFA}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{FCFC0CEE-EE7D-5BE8-8DDD-CE4D9ACF9790}\TypeLib\ = "{FCFC0CEE-EE7D-5BE8-8DDD-CE4D9ACF9790}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{A9EAD16E-5D14-5C33-BF6D-B580FCDB1932}	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{2C320333-21CF-4FC8-BF8F-4287DB3795B7}\1.0\0	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{F8D4B43D-7D22-47FE-B6AD-BAC5ED8A1659}	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{F8D4B43D-7D22-47FE-B6AD-BAC5ED8A1659}\1.0\0\win64	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{027234BD-61BB-4F5C-9386-7FE804171C8C}\1.0\0\win64	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{9D31EA63-2E06-4D41-98C7-CB1F307DB597}\1.0\0\win64	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{1816D37D-0C7D-5CD7-8212-DFB46B3947A7}	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{EA08425E-054B-4564-B0A0-8BAAB76F38E9}\TypeLib\ = "{EA08425E-054B-4564-B0A0-8BAAB76F38E9}"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{2C320333-21CF-4FC8-BF8F-4287DB3795B7}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\PulseSoftware\\PulseBrowserUpdater\\135.0.7049.101\\updater.exe\\3"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.shtml\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{A4971B62-FB05-52B3-AB49-2E63B3614613}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{A4971B62-FB05-52B3-AB49-2E63B3614613}\1.0\0\win64	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{F8D4B43D-7D22-47FE-B6AD-BAC5ED8A1659}	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{847BB70C-47D0-46C2-8C97-9000A1F9AD99}\TypeLib	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{D734C877-21F4-496E-B857-3E5B2E72E4CC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{027234BD-61BB-4F5C-9386-7FE804171C8C}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{9D31EA63-2E06-4D41-98C7-CB1F307DB597}\1.0\0	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{19309C09-C93C-45DA-8C02-9A8B8198A5E0}\TypeLib	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{19309C09-C93C-45DA-8C02-9A8B8198A5E0}\1.0\0\win64	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{1163C9E6-6391-46E2-96AB-2BCB8907D669}	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{13D172EB-2BFB-4D72-AF10-7D33337B7FC6}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{3057E1F8-2498-4C19-99B5-F7F207DA4DC7}\1.0\0\win64	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{47C8886A-A4B5-4F6C-865A-41A207074DFA}\1.0\0	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\PLSPDF.E2L7F5BWAB35XAVZJIODIZBPYE\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{F4F9F399-D63B-5AC7-89F4-7DB385E0BCB8}\ = "IUpdaterInternalCallbackUser"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{1816D37D-0C7D-5CD7-8212-DFB46B3947A7}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{F0A39C88-1BBD-53D5-BB8F-406D8B83F113}\ = "IUpdaterAppStateUser"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{F4874A57-8C88-4B1D-AAB8-4B06CF98FB29}\1.0\ = "PulseBrowserUpdater TypeLib for IAppVersionWebUser"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{3C0435E1-B19F-4B7A-8481-D7EBAEBFAF47}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{47C8886A-A4B5-4F6C-865A-41A207074DFA}\TypeLib	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{FCFC0CEE-EE7D-5BE8-8DDD-CE4D9ACF9790}\ = "IUpdaterUser"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{3B0D60EF-13AB-518C-90C1-E927736125C6}	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{2C6218B9-088D-4D25-A4F8-570558124142}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{3057E1F8-2498-4C19-99B5-F7F207DA4DC7}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{C461FEE4-6003-5401-A5DA-7A19F496ADEA}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{AE097E2A-7F4B-4248-8698-D6E515E9C638}\TypeLib\ = "{AE097E2A-7F4B-4248-8698-D6E515E9C638}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{2C320333-21CF-4FC8-BF8F-4287DB3795B7}	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{19309C09-C93C-45DA-8C02-9A8B8198A5E0}\1.0\0\win32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{3C0435E1-B19F-4B7A-8481-D7EBAEBFAF47}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{3C0435E1-B19F-4B7A-8481-D7EBAEBFAF47}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{3C0435E1-B19F-4B7A-8481-D7EBAEBFAF47}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{F0A39C88-1BBD-53D5-BB8F-406D8B83F113}	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{F8D4B43D-7D22-47FE-B6AD-BAC5ED8A1659}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{1163C9E6-6391-46E2-96AB-2BCB8907D669}	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{D734C877-21F4-496E-B857-3E5B2E72E4CC}\1.0	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{5C674FC1-80E3-48D2-987B-79D9D286065B}\1.0	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\PulseBrowser\shell\open	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{1816D37D-0C7D-5CD7-8212-DFB46B3947A7}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{847BB70C-47D0-46C2-8C97-9000A1F9AD99}	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\PLSPDF.E2L7F5BWAB35XAVZJIODIZBPYE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\PulseSoftware\\PulseBrowser\\Application\\pulsebrowser.exe,11"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{F0A39C88-1BBD-53D5-BB8F-406D8B83F113}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\TypeLib\{F8D4B43D-7D22-47FE-B6AD-BAC5ED8A1659}	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Interface\{847BB70C-47D0-46C2-8C97-9000A1F9AD99}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\Interface\{13D172EB-2BFB-4D72-AF10-7D33337B7FC6}\TypeLib\ = "{13D172EB-2BFB-4D72-AF10-7D33337B7FC6}"	updater.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1804	setup.exe
1804	setup.exe
4348	updater.exe
4348	updater.exe
4348	updater.exe
4348	updater.exe
4348	updater.exe
4348	updater.exe
4352	updater.exe
4352	updater.exe
4352	updater.exe
4352	updater.exe
5164	updater.exe
5164	updater.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
4348	updater.exe
4348	updater.exe
1296	msedge.exe
1296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1804	setup.exe
Token: SeIncBasePriorityPrivilege	1804	setup.exe
Token: 33	6028	pulsebrowser_installer_149.0.7827.158.exe
Token: SeIncBasePriorityPrivilege	6028	pulsebrowser_installer_149.0.7827.158.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe
Token: SeShutdownPrivilege	5692	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	5692	pulsebrowser.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe
5692	pulsebrowser.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2308	4460	msedge.exe	87
PID 4460 wrote to memory of 1640	4460	msedge.exe	88
PID 4460 wrote to memory of 1560	4460	msedge.exe	89
PID 4460 wrote to memory of 4108	4460	msedge.exe	90
PID 4460 wrote to memory of 1560	4460	msedge.exe	89
PID 4460 wrote to memory of 1560	4460	msedge.exe	89
PID 4460 wrote to memory of 4108	4460	msedge.exe	90
PID 4460 wrote to memory of 2440	4460	msedge.exe	91
PID 4460 wrote to memory of 2440	4460	msedge.exe	91
PID 4460 wrote to memory of 2440	4460	msedge.exe	91
PID 4460 wrote to memory of 4684	4460	msedge.exe	92
PID 4460 wrote to memory of 4684	4460	msedge.exe	92
PID 4460 wrote to memory of 4684	4460	msedge.exe	92
PID 4460 wrote to memory of 3444	4460	msedge.exe	94
PID 4460 wrote to memory of 3444	4460	msedge.exe	94
PID 4460 wrote to memory of 3444	4460	msedge.exe	94
PID 4460 wrote to memory of 1272	4460	msedge.exe	95
PID 4460 wrote to memory of 1272	4460	msedge.exe	95
PID 4460 wrote to memory of 1272	4460	msedge.exe	95
PID 4460 wrote to memory of 2292	4460	msedge.exe	97
PID 4460 wrote to memory of 2292	4460	msedge.exe	97
PID 4460 wrote to memory of 2292	4460	msedge.exe	97
PID 4460 wrote to memory of 2008	4460	msedge.exe	99
PID 4460 wrote to memory of 2008	4460	msedge.exe	99
PID 4460 wrote to memory of 684	4460	msedge.exe	100
PID 4460 wrote to memory of 684	4460	msedge.exe	100
PID 4460 wrote to memory of 3600	4460	msedge.exe	102
PID 4460 wrote to memory of 2204	4460	msedge.exe	105
PID 4460 wrote to memory of 2204	4460	msedge.exe	105
PID 4460 wrote to memory of 2204	4460	msedge.exe	105
PID 4460 wrote to memory of 1996	4460	msedge.exe	106
PID 4460 wrote to memory of 1996	4460	msedge.exe	106
PID 4460 wrote to memory of 1476	4460	msedge.exe	109
PID 4460 wrote to memory of 1476	4460	msedge.exe	109
PID 4460 wrote to memory of 1476	4460	msedge.exe	109
PID 4460 wrote to memory of 212	4460	msedge.exe	108
PID 4460 wrote to memory of 212	4460	msedge.exe	108
PID 4460 wrote to memory of 4544	4460	msedge.exe	110
PID 4460 wrote to memory of 1804	4460	msedge.exe	115
PID 1804 wrote to memory of 4348	1804	setup.exe	117
PID 4460 wrote to memory of 5664	4460	msedge.exe	126
PID 4460 wrote to memory of 5672	4460	msedge.exe	127
PID 4460 wrote to memory of 5680	4460	msedge.exe	128
PID 5164 wrote to memory of 6028	5164	updater.exe	130
PID 6028 wrote to memory of 6100	6028	pulsebrowser_installer_149.0.7827.158.exe	131
PID 6100 wrote to memory of 6128	6100	setup.exe	132
PID 4460 wrote to memory of 5756	4460	msedge.exe	133
PID 4460 wrote to memory of 5756	4460	msedge.exe	133
PID 6100 wrote to memory of 4624	6100	setup.exe	134
PID 4624 wrote to memory of 5568	4624	setup.exe	135
PID 6100 wrote to memory of 5692	6100	setup.exe	137
PID 5692 wrote to memory of 2696	5692	pulsebrowser.exe	138
PID 5692 wrote to memory of 3140	5692	pulsebrowser.exe	139
PID 5692 wrote to memory of 3132	5692	pulsebrowser.exe	140
PID 5692 wrote to memory of 2468	5692	pulsebrowser.exe	142
PID 5692 wrote to memory of 3368	5692	pulsebrowser.exe	143
PID 5692 wrote to memory of 3896	5692	pulsebrowser.exe	144
PID 5692 wrote to memory of 4436	5692	pulsebrowser.exe	145
PID 5692 wrote to memory of 5888	5692	pulsebrowser.exe	146
PID 5692 wrote to memory of 6368	5692	pulsebrowser.exe	147
PID 5692 wrote to memory of 6624	5692	pulsebrowser.exe	148
PID 4348 wrote to memory of 6852	4348	updater.exe	149
PID 4460 wrote to memory of 1296	4460	msedge.exe	150
PID 5692 wrote to memory of 6248	5692	pulsebrowser.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://browsergo.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe4559c188,0x7ffe4559c194,0x7ffe4559c1a0
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,2119160012755215787,6934779978911093744,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,6806481273219584237,5998012241693463756,262144 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,6311184593303785292,8930059535488858440,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,15667408448439756932,11603540040109707482,2097152 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,14651148114444911980,262024349353465304,2097152 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,11626519791142594913,10262478709480826769,2097152 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,6544271576821668450,6233466806663164216,2097152 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:2
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5024,i,16735086419653841108,7136423471924711014,2097152 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,5335343030820164202,12963387082426253560,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,6408134711034646954,17131008906368549510,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,11055837980849975915,15219180850725561242,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,11055837980849975915,15219180850725561242,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6248,i,3790602553983432113,4148355347777147885,2097152 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,1918564508223183217,2114086608440716363,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,16364249790430496094,17070720883735334514,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6656,i,17894251022016751290,6956510733053113828,2097152 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,1996230085024945237,15162410194123508694,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:8
  2⤵
  PID:4544
- C:\Users\Admin\Downloads\setup.exe
  "C:\Users\Admin\Downloads\setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Program Files\PulseSoftware1804_1151904690\bin\updater.exe
    "C:\Program Files\PulseSoftware1804_1151904690\bin\updater.exe" --install --app-id={2F4E88B4-E690-4E1F-AA9E-B7A4617F881D} --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
      "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --from-installer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,11784033191139323411,3525928389775264015,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,4057851596878385383,8461269432862040797,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,5536144321757019907,827968480007418611,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,6993119055490219868,15001672976451575048,524288 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5308,i,11565770973226683010,7726135151475992937,262144 --field-trial-handle=2380,i,9874446696805105642,16893328197072754730,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1476

C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe
"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe" --server --service=update-internal -Embedding
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4352

C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe
"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe" --wake
1⤵
- Executes dropped EXE
PID:5148

C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe
"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe" --server --service=update -Embedding
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\pulsebrowser_installer_149.0.7827.158.exe
  "C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\pulsebrowser_installer_149.0.7827.158.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\setup.exe
    "C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\setup.exe" --install-archive="C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\PULSEBROWSER.ARCHIVE.7Z"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:6100
  - - C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\setup.exe
      "C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=PulseBrowser --annotation=ver=149.0.7827.158 "--attachment=C:\Program Files\chromium_installer.log" --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff7b3238f80,0x7ff7b3238f8c,0x7ff7b3238f98
      4⤵
      Executes dropped EXE
      PID:6128
  - - C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\setup.exe
      "C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:4624
    - - C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\setup.exe
        
        "C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=PulseBrowser --annotation=ver=149.0.7827.158 "--attachment=C:\Program Files\chromium_installer.log" --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff7b3238f80,0x7ff7b3238f8c,0x7ff7b3238f98
        5⤵
        Executes dropped EXE
        
        PID:5568
  - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
      "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --from-installer
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5692
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=1960,i,9278083188059681365,15583873816673661018,524288 --field-trial-handle=1988,i,7192781658617355152,15715244601965692762,262144 --variations-seed-version --pseudonymization-salt-handle=1992,i,14951155884869583498,9611217210170823100,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2040 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,1941402490683589032,9770628538969188442,262144 --field-trial-handle=1988,i,7192781658617355152,15715244601965692762,262144 --variations-seed-version --pseudonymization-salt-handle=1992,i,14951155884869583498,9611217210170823100,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1984 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2472,i,11426330317302807625,6897982857675728898,524288 --field-trial-handle=1988,i,7192781658617355152,15715244601965692762,262144 --variations-seed-version --pseudonymization-salt-handle=1992,i,14951155884869583498,9611217210170823100,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2484 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3444,i,17045418938090795808,6548363058252444451,2097152 --field-trial-handle=1988,i,7192781658617355152,15715244601965692762,262144 --variations-seed-version --pseudonymization-salt-handle=1992,i,14951155884869583498,9611217210170823100,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3476 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --instant-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3452,i,12163348750311904328,10537655309516447445,2097152 --field-trial-handle=1988,i,7192781658617355152,15715244601965692762,262144 --variations-seed-version --pseudonymization-salt-handle=1992,i,14951155884869583498,9611217210170823100,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3504 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5152,i,11791691196928267746,5488483549404914331,524288 --field-trial-handle=1988,i,7192781658617355152,15715244601965692762,262144 --variations-seed-version --pseudonymization-salt-handle=1992,i,14951155884869583498,9611217210170823100,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5160 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,6948047065796208856,997020604107918161,524288 --field-trial-handle=1988,i,7192781658617355152,15715244601965692762,262144 --variations-seed-version --pseudonymization-salt-handle=1992,i,14951155884869583498,9611217210170823100,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5256 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,10629815022904976430,10368447711746558477,524288 --field-trial-handle=1988,i,7192781658617355152,15715244601965692762,262144 --variations-seed-version --pseudonymization-salt-handle=1992,i,14951155884869583498,9611217210170823100,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5524 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5280,i,8631803717502183460,4403448334113253050,524288 --field-trial-handle=1988,i,7192781658617355152,15715244601965692762,262144 --variations-seed-version --pseudonymization-salt-handle=1992,i,14951155884869583498,9611217210170823100,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5236 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,16509609230454275346,8440679905317654886,2097152 --field-trial-handle=1988,i,7192781658617355152,15715244601965692762,262144 --variations-seed-version --pseudonymization-salt-handle=1992,i,14951155884869583498,9611217210170823100,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5280 /prefetch:2
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,10702416584001863518,10264805356245245706,524288 --field-trial-handle=1988,i,7192781658617355152,15715244601965692762,262144 --variations-seed-version --pseudonymization-salt-handle=1992,i,14951155884869583498,9611217210170823100,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5616 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Program Files\PulseSoftware1804_1151904690\bin\updater.exe
Size 5.3MB
SHA256 a8ec63229a801901d83120e5e108cbf01d70c21d05c4e5288f54ff80591944c6
MD5 eba3bc65e15cef7aa7f21c7309b2fb63
SHA1 7eb8d65b44779483d341dc34f94419884fe6a926
SHA512 542e23775108d68e681fb42d897b22e22ecafc717077739efa99b9d7ad959f9b270964d6867105e303ef6f6dba7a495ee4b78b681a831b285e555b73d2ff8b1d
SSDEEP 49152:kc18dUORkVrT3b3FGqKi/8wClwnLXZtuzf1EsCBhuEmzi0wt8IAoJNe0heLr1YRJ:UbItXZ81EuEOi5q8He0Tw
TLSH
T10E464B23F29941D8E0AED6789B7A4232D9737C855B35A2DF074076251E76FE09B38B30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5164_1042517402\CR_4150B.tmp\setup.exe
Size 5.6MB
SHA256 7f79979abf143a9b91ce0f77b936438cc4a04bcc7f5d871bb9643299c97e27b1
MD5 25783a28f03fac9d7a413608b901f857
SHA1 9d780b4832389fdb7744f85741f744ca270d61f0
SHA512 889d76728114787a76248669956c06f5c53fcdcf419e9f92aa7fb514481ef76fa3c5097675392f57c679c205acdf46933295299b998aea64dbe425a3fc0f287c
SSDEEP 49152:b67p/LkeyGN0Bcj0cyPsEs8X5XJD9+/7JwQ3NsAku0WPHaWsyT9x2WBGHlMMZI7x:kbSUaJZM7WeNVku0WPHamMOMu7f+5i
TLSH
T177466C53F3A501E8D06EC974CF2D95229A257C4A47B4A3EF2AD436E11A71ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping5692_510808198\manifest.json
Size 202B
SHA256 8bd59f33a6e286c7e7352dfaebc9b03cea4e0e959a8ebb2f04b69bd92e107dc1
MD5 837451b9bf5675593e66a3b58787a0a5
SHA1 0d8c4631e5308fcc2abe2f1b9ce29921717d2bb1
SHA512 3a746580453761bd2fd27ff6087193189e51845c8c4282247b0946ab5da91e60c134c1a75e66d271a0455704aa2f861e35f2b54356191704c343f748f47b741d
TLSH
T1ABD012E33D41D4F701985BA86922E10A67B92F0F5C47B41A07925049D4D9EB7347872E
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e2fca8f6adae2c222b3f881fdf6a9715d78537fc0da901dbf7874331deac3345
MD5 c3e2e930381a7b1aa6188eedf61a4c12
SHA1 5cec53a18201a5151ff7079af588a8d940383eed
SHA512 1e71d343c0040a2621bca725fd91a367a8f4186e2b10817dfc45e91fb3f3b3c0fcbe427bf7761c4e643a6a83c6749a9baf4466eb1e904535e76cca0c59d1fb27
TLSH
T177714C3A32DD9EE8E75103B13DD2D208F1B186D9FC879BA67294C4B31916B11835ED64
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e76d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e76d.TMP
Size 3KB
SHA256 603e00131c78ef74d86bcb2f04af17a6cdcec748f9f489d94143f65f201b90a8
MD5 0332c64c6fc38eb2481fb007645a4a12
SHA1 957ed470d78c4a70f30952dc7d0ac21b2a544f82
SHA512 2eed20d17775ebe916e954ac50fe5385b89ea5b89465d61f1eeae9851fe1f523e9e6ac3eb248a0310832a0fee28d44a86ba289941a0175d3d45dc384b426e8b2
TLSH
T193714C3B36DC9EE8D36103B13DD2C208F1B182D9FC979BAA7294C4B31915B12835EDA4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 27b7d005bcda1d79a573d9fa64c39af2f684294a1f3d87815b08368180185a95
MD5 db2767fe0f90dddaaa10b825a35bd5e1
SHA1 a88a1044f8c7a49c24edf50b6ccb58b5f062ba4a
SHA512 fc82bf1dc317fab557b68c121d3c966c79596539c9852d7336d9ba8350dc87c13f1fc4e8c944ea8ae1e1bfd57efeb88e86d5d4d4cfc68261e6c254398858c45d
TLSH
T117516CB7C7E9966EC81116F16A24BE1BCE1D162583183D16C8D4BF87EBE3072D14164F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e1baf3b958a9231aecb4704518b4775f74cf8066372c8a8a0838400bea054f52
MD5 a7ff7c0ae26ba3401c4624901820563d
SHA1 58d903eb7a66a563c0c2587241a2e15950172eb0
SHA512 477a51c1729260c21adeb6c5da49dadf0107476b08d53e4a37249f52d84d5cb8a7e6c91aede1a6e32213bba46aafa1a775277a21b87714832dc6dcb70f281a9d
SSDEEP 192:sxZwRPyM/jK1Ml8MWV/fescAvIdpC4HW6+WNxiZ/YCCEdYbIgrJ:sxZwFuV/fescAA/Hb2/p89
TLSH
T14F42E711AA349977CCDBD20DF955BF53D6F9447292940E48A9FC8E1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 03b167a4369b15444a9c6da48e42e1ad993b9b19bd5055ae3d8607c9a7ea7fd2
MD5 764f1262833c0e608d543ec350da031c
SHA1 9e79901cabf504346acdab82c871473fcc0d16d9
SHA512 f33e6e4978fd8d1231fe2fff28ceaf2407fdf47285cd2fac344bccae254686e7a7e6c4e16b3de451f54ba1e73188f5229811e6abf732a351f81d177f1058ac57
SSDEEP 192:sxZwRPyM/jK1Ml8UQYnV/fesepvIdpE4HW6+WNxiZ/YCP1yYbIg5lJ:sxZwFqWV/fesepAZHb2/A85
TLSH
T15F52E712AA345977CCDBD20DF955BF93D6F9447292940E44AAFC8E1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e3a809117214468f21542d5507c4d46cc1bd9aa088f609f5334451fe421ae219
MD5 fb5594c8969847bb2f354414594c718f
SHA1 e607d71ce73808ac99d89c53f3b419c3c891e534
SHA512 ad523b22d335e743295ca3725e4b35ea949a82288f29ea218bdeb5976fbe235a02d61e091b4bbecbfa064c9afdff06a1eabf2a440cc110677835a8d785cc35a9
SSDEEP 192:sxZwRPyM/jK1Ml8MnV/feseAvIdpC4HW6+WNxiZ/YCCEdYbIg5XJ:sxZwFvV/feseAA/Hb2/p8H
TLSH
T14F42D611AA34A977CCDBD20DF955BF53D6F9447292940E44A9FC8E1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 80cc85bcd01875cfdc814aee9bf097b1397383838faf12976a38106a0a633cef
MD5 49737fdabb8054d716fc4d732e6863b7
SHA1 d5070efdd306f5ba89706c13febd714e2a283883
SHA512 e98070ebb17de3e435321f2c9b232be54fc8d54b2953f434a310dee8da07214d0a8c4353dd9bf3020f781f7ad51a91dc8497deed83edcba7c7b0058a5396747d
SSDEEP 768:Ul8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVzrom:Ul8bqn+WvSCt6u1jaCZLbWVAm
TLSH
T15DD20B3B280CCB7E4F805E5DDD266F966ED801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 541fcd62b5da683f5d847ef48b59b9b459e9bd66175d9224c54dd21074fb80bb
MD5 89fcc027affbcdfb4ef7cee4c143be98
SHA1 9070c95866cedfeebdbd81bdd792cf83f6b4454d
SHA512 4504631747d910d32393f9ccd0d9e20897076e476beeff20b6c2df3acf3295844ddb64ba97d95ebe04d3ec45da1c8021e705e03f1fd45137370faf4daf36f801
SSDEEP 48:K8UI7KNyc/yFHIRKc4sUjIVKIUo3yZWInKnqgA:K8UgKNyWOHaKc4TjOKIUSqWkKnq7
TLSH
T1C8C1E6233277024128BE250C93E9A6779E5272737814E96F7FB850E60E66E216CFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 11d515ff0fe904e08f4318e84cec2e346e2d4ad56cec8867863ab552be702027
MD5 586bae0d45509d9e4384ad8646274863
SHA1 fdec4453668e4564de4cdc1736fa2a0fc55714ab
SHA512 00cec402ebfa5d3bfe9235eb06141566b867eb84d954631b4c2104f097dc92c9ff7d5f52a9c37047fab3210d6fec14b8a0a5199b84b37cf4ef90cb922ef2f6c5
SSDEEP 192:vONp6Db6QmiUyO+HBa+jXOm+tmUJARg78mxU6:vONp6u6HBa+zOhzJpxU6
TLSH
T1F202D93569786C779EB2AE49F48737279F94207BD9562F84D6D81F0C00D765C230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 74de2da0206fff4a455265a61bb54dcbcaaa79ea7d9237767ee538c555e4d650
MD5 bfadc34dc7ebe566b0c282792d838a80
SHA1 1bc16803123e96ef3c83f299ebd2f482afb29525
SHA512 b35cc9aee7851482d27033ca13c1774fb6c8c9b3de4145fcfdf82a086aba3822ea384fb78b6ae35836af54e28f63b0049330cc263170a07c8c3c248362085102
SSDEEP 192:WONh6Db5QmiUyJ+6Ba+jXOm+tmUJ/kNzRqiU6:WONh6/b6Ba+zOhzlkXU6
TLSH
T17D122B36797C9C775DD2A584F48736139EE48167DA4A7B90D5DC1F1C00EB65C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f39e865cc3d96b272267247294f25a6879befaf8ad3806019ef7ad9f91b993e1
MD5 5989eb86d706d045413fa657cb9d904b
SHA1 f250a5b37c71ab146dd285c8bf01cfd11f51d5c8
SHA512 6d10a90dd28769a8520c282fd3da570526e1678dad69ddf1cee2b8800cf88d65459bb4d21e0fdc40d7531588383710f404f5bd2bd17137c871db15a76cb2db48
SSDEEP 384:vZcIAsN4q3Zx+Ea+zOhzlqXxuvzxV+Mhdpjot:nAgda+OfqX4184pjO
TLSH
T16F827E316D7C6CB75CE69185F84736178EF8D0679ACC6B90D5DDAF1D00EB268130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9068fe998ba8e169b0a36bf2a3f1a17a8eb082710439a681d227cd81829b6a95
MD5 31f1cbc8a9946e8e57ff9a3ec3c31a1d
SHA1 a87be70e2d21059b5e1d4becf44ab05da20faee0
SHA512 8593ee6dc60be2fd1463c1343c52a9ca0684c5af0f6d137249d41266a6ef6314a75615f0cc45631eea965302fbab292defc56cfdd7244b290119c633bdbc1f62
SSDEEP 384:vZcIhsN4q3Ax+Ea+zOhzlqXxuvzxV+Mhdpjot:nhdda+OfqX4184pjO
TLSH
T13A828E326D7C5CB75DE69185F84B36178EF8D0679ACC6A90D5DCAF1D00EB268130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c4aec0fa424cc6a027aa935f1344d88f33ea727710a2dd524793166680e3c0fe
MD5 d4a5c3ae35cc907b2decb126c7c3277f
SHA1 9d7096d5756756a3c87f2fcc9d3f68f192cbf145
SHA512 b8dfecd4337521907a59db2f9d440bb6ceb00544bd4beb86eafdda3965e07d98d1828b55ca890e65eb0572105c592831386c3038cf657776c48ac245e318a960
SSDEEP 384:3iFiZcIjsNo8TUNTUlIlX3Zj+Ea+zOhzlBXxuvzxV+Mhdpjot:yFQjxwgTda+OfBX4184pjO
TLSH
T161C207F258DB8876D9AE8747EB7D2D138EBCC063B584A650B3885E0DCC9617FC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5f1ab7ab7be8658cce901fc2698940691ed2b93e23ece266041e479b28177974
MD5 1af42ad3ea047dd2da848dc6a5ae82b2
SHA1 9e8e4e407d93356cdcd3613d9cb3b05a030080f6
SHA512 553760b292a37bf45a0ff3c79f2e013227fadc95f613858682fd6e81d6f3de91a41c8145c7986944580b61d4ce9c236b101f8580df5def5429372720c226dfeb
SSDEEP 384:tZcIAsN4X3Zx+Ea+zOhzlqXxuvzxV+Mhdpjot:1Arda+OfqX4184pjO
TLSH
T106827E316D7C5CB75CE69185F84736178EF8D0679ACC6B90D5DCAF1D00E7668130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf8ee06f-2020-429e-95b9-dd53236b64cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bf8ee06f-2020-429e-95b9-dd53236b64cd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cb3b9dc9acd1cd4b8d4324d929e689512ead2ad489f1bf8c141657606b212aad
MD5 ff287a86f3f6748839666a3d364b73f5
SHA1 3c3a724fea882dccad626e84e232568a4e6375dc
SHA512 4c72f43354a3ca774c9199cb531a08036760be17f2833c2d40b0def3a916560a4e15304d2124db85e87bb94b68f09520326ae93b9705d0cc5ef4251c1b3eb609
TLSH
T184410958AAF91548B3B76F56AFF2A86D487BBC372E56D45E00110E4F0A23A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\prefs.json
Size 19B
SHA256 e03e9d262ca3b7d19e37c3a69c7d8b46bd3f5542aa555a17d864071c28257b2c
MD5 aa2d0c0c72bb528cf4168ea91c1c9a56
SHA1 67be5a0c29b13b92dd86ba935f605c4ba7eea2cc
SHA512 6bdb9a72b73f11f7627e6fca0ee1d417201b038cb255d445dd29e5f27de08e99a6c4729c4c893ffe97e4bc1835532879c47cceaa051f07b3cdad06ad17b2d5e7
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
Size 639B
SHA256 0534a10c1d7570f766ccd97719312c18ae71879a6eb4423affd71d51b4619e87
MD5 4ac4f3eeaffed374f311000600ef7285
SHA1 74d6c57b916978aa73f3f8a79cdc82ce826e4919
SHA512 73a8e9e63df7b28e7a5a72d5079abc4d5cf2788f3f560961b1462ac3b652c6fc829b13cad2202b65317e56402aa4eeb3fd2b93a942ccdc997a3778e22dff845a
TLSH
T17BF042186A37756BA8A14947C14B632A82917474521E3D54C4E41C5E1CDE89D9F0F41F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
Size 51B
SHA256 69ebb26b173552549f4a236eed8303ec3220a621c7d9354b121303966c7c00a8
MD5 b88e39442770716d5db8a76c9ed87f36
SHA1 cc660d75528d77c71114862d39f1958803e0e009
SHA512 f8d2c731795fbdd6bc29cd71799f14a85a8c3e9cd4d1ec182f0deaf32825e4b553f1e986e7017abd7a6ae8c9c5ec8b83eb912c859308d14da47c4126fa188921
TLSH
T1CC90040101317071547C470D07071F74435470747017015710FD14514FD0CD41030017
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
Size 216B
SHA256 24a9983bbbe88929259f8665150f5a441a3ebacaaf56333432962ae7c19439a5
MD5 743146e47b3f3033e9495f92d401fb9e
SHA1 914128a7535c2d3e5fb57303f58544c62081284e
SHA512 153e83d599dfef34d971d69fb651e33bb3359089b771790d8a1e8e8765be09182a1f36b9f2cbc73cbc4eff843ed633f0e2c069dfd91990df92abb78168072144
TLSH
T104D022041E3294E3ED184A0B410A8BAC87D234A99125214380EC089D0CD9C8CE91B02F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
Size 464B
SHA256 cfa57f34a6cfdffd95789104d495f6b0a925d8ee8d8f189cc47bc1e6f4d66338
MD5 420151a054f73e7070e4d19ffea6202b
SHA1 61eb3e2c609ca4268a74f4f27183a5fef47e0af2
SHA512 fc9fa4699463d327be392985cd7893649828129c4b43116a3514c4f2d20a27fbf2cea5c0681dbba9c90cc781aa8b6179b32cafa4ca01ce6b5328af80bd105f69
TLSH
T179F055286A36B4AB69704606C00A672A42E27470921E3C04C4E81C4E2CDE88A9F0F41F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
Size 674B
SHA256 a6e0c0928a21bf9a901a2d4cec383463384c83945d8571ec6bff350479a6e921
MD5 43a347b2165bb2e0563c63953b997374
SHA1 bb517210363a42e7fdb9f67c3ccc138cee32f2ef
SHA512 10e79f47c2d22faf5abe5b576a3ee714049efc158cca6f1a427799b04fbe857031a42017c552c5561e3f351286b000a123a7b54e06c791a42f36cd5adade176b
TLSH
T18501A2286A37B56BA8F24947C14B632A82917470831E3D54C4E80C5E1CDF99DEF0F41F
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\dxil.dll
Size 1.4MB
SHA256 03eddd08e594dc7cdc0df5b5cc218e6dae1ee7e71491c77dcc625ce0a1c5e594
MD5 42c7eaf5cd67fddfe0a8e5b60f7264cf
SHA1 52377cad9cacfe7a10bfe2ea885dcad59a5b4c08
SHA512 22c8f3d2aafc7b75c1daea8b8df60e2417ad0ca3b98d01422ef9ec28f0eb25da50ea2624ae334a77a8de90fcdffb8c993decc92db342c9e7ff111a6dcfb5ef53
SSDEEP 24576:6Y+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kaw:viTMYxy0Sy66Zh7Sh/cyvS52
TLSH
T13C657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\libEGL.dll
Size 493KB
SHA256 dc45006ac2c8da0572a7439bcfd6e0cb00ea691a7e935ba4911f0d559a3d0902
MD5 74cdd5ac60daa220a4ccff6418bc280a
SHA1 789b2e28de573ebbc1ee97ceefa9c9d716fd03e2
SHA512 333ab0f59a626fe415ed3e0d5b85701a6167f899a3216b53f3cba2322331026f86b09c5663734a4a381928328dfdadf5cddae61ffa4b38066822951ca1009610
SSDEEP 6144:YlcNlxbLtDSBGAzietw/GY+l3bM0h0Lci4iiu61wGvJ+fS3xn:YOSBZ5tmWbM0GLci4Xu61wGvJ7hn
TLSH
T1CFB48D15B2D949A8D07BC138CA438507EB71B8560F65FADF02A0E2792F77BE41A7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\libGLESv2.dll
Size 7.5MB
SHA256 9880cfae7190e8e53186a03f73b6240ade84ed4d435776c56b61f7586c36ec68
MD5 461a921280257d78f889355f05bff356
SHA1 c8d0d20e66ea416a8c3bd72b065ff286841c730b
SHA512 875fe893fe6dfb3ef6ff6f3db5bca749b319311ff23c013145dc2f11c6f3f7129d1d71f55ca701a3047d62ce04c963231d2183f82cc7d641cb7ff020659b4375
SSDEEP 98304:JZjs/Gqv5/G1XliWV9e0+IovbMsb/X2wS:JJ5G0qswVlv9/
TLSH
T191867C13F69280D9C01DD2B89757A223F634B8450764B3CF2A9467163FB6FE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\locales\en-US.pak
Size 495KB
SHA256 a5b038981912ba09deca3f3e4ebe73123cb4d8106c4b25bcf52ed61028d1a106
MD5 2cf33c51f2a479739ac2d3c8642b76d3
SHA1 c7333e9e601e7e5c6c14848cb547fc1300aa7cc1
SHA512 ba2e9f24cd98d2d68c793fa52cddf47732b66c757e5a140cfc71cca2f6ab39f8d7d2fceb20524f524624225cc1c0cb7e951668d3f04635098366de987d97d5fe
SSDEEP 6144:2/rw0p293I5b413zYSHfI6OzWXJKNMf9m1xqRfaY4JqFKN/Slw/:2/UbdlfHfIFMo1xqhw/
TLSH
T1B1B44C1FF744126A069352A27F09A5A2FF32D06CA35112563CBD812C3377B66837B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pulsebrowser_100_percent.pak

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\pulsebrowser_100_percent.pak
Size 717KB
SHA256 1c6eb6485f7ba2d9332b4d104b02210f26aba3f840089d6b3bc2936168ebe030
MD5 ba134e8c59d7c3dcc482effe7b6813b8
SHA1 91f0b5a03ab3e37326c74c6db33fd6f6ed94c6bc
SHA512 aa71d19bb2a43695dcb4fdd30532ea24652ae1d2613a27eb38b9b62178b4430e974b34df8dea135653bd2216fb9830255a4645de9fd94ab9752e01811362f44e
SSDEEP 12288:YsI3H1fJwCBzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnPzm86pYJblIt6kjKQCrC:m3VBbzEEmPL8bTe+gnPzm86qbc6kGQt
TLSH
T12EF412D77774AC7DEE9B1277926501B0FC7716680A82020A179FF8B96927B48D8C93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pulsebrowser_200_percent.pak

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\pulsebrowser_200_percent.pak
Size 1.2MB
SHA256 ad398be8fdfdcab845fa0b11ad11d105b856c32bb7b6d6651eed05b7a58ad35f
MD5 9b6b40c7520cb264226411437bc5525c
SHA1 6ffb568510d93fa357975e8d62ec7949224114f5
SHA512 1340ff69ec98477af45b7fb9a4f2f096f7cc0a1e0e40f36c40af02a3de3ce8553f7283ad5894a023847e9033dc21fba14cd7f3309d849cfb481405f53ef58fb5
SSDEEP 24576:33zB09pommibkFR8+mZi5r8BWhQume1RvQt9a6SIQwuSXAkpbaUGQ74:33yomNbkFRJmQ58khQRa1QPVS8uSXAkA
TLSH
T1004512D79370DC7EDD531B77929B40F4FD7A10670AB2100A0A26BD7A39267889AC6783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pulsebrowser_elf.dll

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\pulsebrowser_elf.dll
Size 2.5MB
SHA256 44706f12f52b657393000dfe16a367c839c8344e4b9dd575ec94ab3ae0f0ac2e
MD5 d52b4a1bf95771d508897177d85f47f1
SHA1 3777f42b7fd0023c4a345624fffe2110177a83b6
SHA512 34f99fcdc30c91bc70a4910ebfdea0df2a69d3713a2c014de92042f1fc394bc4c51e5708ecbd034e3d2bc1a28912643d6985e890ea33c8ceccdb17a701fb42d9
SSDEEP 49152:AJLVpDxrK8uD215bH8uVJ3ONpNTMM/vuc7s3J1Fe5f:2pd/DoLHvZ+Jm
TLSH
T15CC56B13F6AA01E8C01DD1789B5B9232EA61BC454B35B6DF0A90B7161F7AFE4673E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\resources.pak
Size 14.8MB
SHA256 f54ea2fa6ca4ca26ddd68afabe4c57993196dd4a2f9180bac7428568a8f7784f
MD5 ad56c927cee2a65d5aa116b16bcdd04d
SHA1 9a9be360837838ccfbb3b78ca4a4a0c842299395
SHA512 4ed5d0f11531c5fd10999702e53a1943bf88fdd835d0a93eb5689c61e9091faa1e2079988467452f3d6e2400016a99e1da9441705bda3d0afe204925ccb5a695
SSDEEP 196608:kWHHcr3GgP0JtigYy1ooLA3dP6PPEYPpVurflXCXVLyffkiquS6GkrFSyzj7WZR5:98r3GcmzAx/ipVuRXCFLyfTQkrQqjx2D
TLSH
T154F60157B324C63FCE2B03764696967F3731864A3F43A3272168D32C1C667F64E99A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\v8_context_snapshot.bin
Size 723KB
SHA256 4b9ce2ef825c0ed4765724b67b237879f34a5653cd76336d68e56231e1faf115
MD5 206b1cc5a20a932da1ca57df70377348
SHA1 ea143176e373c9c9543f161573c60439b30c5124
SHA512 65c3699054d8b4ff6dd4d2ebdd3107bf8f964f9527c85e5dc6c93d179adf5112d3218cc868634fd7d8590c175b285afbd7f7b8dd7ad14ebd3ff9e3582c0b02c4
SSDEEP 6144:LAYpk755xLOt+HPpk7u6LHQie2N6mtgBMgGRrPjKiVm1CMtQZMuV9u:L5qL5682N6OxVqga
TLSH
T1DDF4B772FB0ACB27C865377DCDE68B463934B18D8E86DA077051577C78B93984E1E20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pulsebrowser.exe

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
Size 3.9MB
SHA256 fe53e6c26f56e89c96828e28ff064267aa74e45a0f75508c60e66c4d864bd121
MD5 c78ad5ec1b1d29f1345cf35d21229e6b
SHA1 ae439bca5906094746cd7b0f7327531d161a34ec
SHA512 a51ac210f7a5ff6c9251c5611e408c064597befe7e712a0bd3f8c567d0d24da545671541fc7ca77a179e3b57f5f13b881a2048e2a51315a5cba80a6158c1552e
SSDEEP 49152:1ra93f+chgw1DdJyVupLJRlGth4KLCvy7kpAKJVAjz0AVqDMHziC4XntgOisIf:pWpMh4Wx6VGLmnisI
TLSH
T145164A13F69E00D9C059D0F44FC69232A976BCC9D72C76DF06B276112AB6AD09FBA311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_MASCULINE.pak

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Temp\source6100_194172236\pulsebrowser-bin\149.0.7827.158\Locales\am_MASCULINE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Crashpad\settings.dat
Size 40B
SHA256 e7f5c544bf4bc8907bcc94b41750c4e6c9b2d49bef011695b1928e926cdaf272
MD5 a17586c8673045caf1fc76f417e6202a
SHA1 c3542b9dac6153f73d3892264b4520bcbc6aca12
SHA512 38ebf9c22ac972dcbe947f2b982c99b44c3cde2513bcff37499a3dcf5516223c38deabe686ab484a916c06541b0fd88991ae145602e9e189b5e4a07093b7698c
MD5 SHA1 SHA512

Submit Download

DefaultConfig

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\DefaultConfig
Size 41B
SHA256 846ffce1f6f14103c91aba2553d142873ecc21a4d31990cb473f79becd8d2bbe
MD5 218fdc39f2e85409dea11b7a6f6f2c6d
SHA1 26446a3fdaf51210f6f4713879783c88088a9f3a
SHA512 12dba33e518cb0ba7e9961f2b26f449b80d9b3dc24a188e6684c8a516e0975c12a5cd9ce691010ea9708242e446b32d6176ed668254e1c220527736f7bf6c03a
MD5 SHA1 SHA512

Submit Download

79403264-5f58-4f4e-b4a1-6a7b2a65ee9a.tmp

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\79403264-5f58-4f4e-b4a1-6a7b2a65ee9a.tmp
Size 175KB
SHA256 92840ba8edb07741ab94d3ef86858a2814d1fab1a683ab99690a4cf3a7e308c0
MD5 d04eca8aef2d5218f6321acbce7ff7ef
SHA1 310036b6f4abce783184b2d3b4b0f0d26846acb3
SHA512 6424045862ce6ed4f78bacc0c93b3642ae159b2b6b440be6b07e7e53d4bb490416752094299af68793bad93aed8cc32a30b92e91a4f857615250c279664bd766
SSDEEP 1536:o+MTQ7GZ/qtof9//0bwLI1Sfi9+bpS9x60EVu4b/TlFwzhB2KQ7RRiq6HXuYl5rx:o+MTEGNqQ/gzXtRGlLyzS21
TLSH
T1A00495968F1E40CFD1E665F02FD5D042457FBAEEDB8E321201FB62A8A4ED684C8D7581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\DawnGraphiteCache\index
Size 256KB
SHA256 f963c6cceccfbafee08152a572d24b2c4e7e67e57f6c2c7cab379d38a4bc603f
MD5 b0353874139b79bebd6dd3f91f8c1c59
SHA1 878c837721955d974918048b8cc8c8cfd2986583
SHA512 46f7e77c7b0a0e36754595aed8c0dc9fa71d337c9c0c75fcc7f05032c5390525ae20e62f23324a405a8fbcb08c6f1dea87052358baa1d9b647dfaca483f88608
SSDEEP 3:LstlNllkll/lIdo:LsX3lEtIdo
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\DawnGraphiteCache\index
Size 256KB
SHA256 8664139777051c4f86bf9ba4b9d71d74c1c4a7a8d7b9cfa126a5e4d5621491af
MD5 8e19365d8a952980c7576d0670f99ce5
SHA1 2a59fcabb80dbb098dcce6638728f0746de791fe
SHA512 6c81f259ae5252d2ab630372d32e2710da72790189be7e7b79053d302d409af911b68177a964d036a308c5b67704bfec9eacba1f8539435f99e11a8759e1f47c
SSDEEP 3:LsOllllkll/lIdo:LsUlEtIdo
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Extensions\ddomlcjnbfakinihjhdnabiodnikomhm\2.6_0\background.js
Size 10KB
SHA256 84a409a1a6d56405e0f32e26b0c464fe27ad0aa75a39e896201503e6b0b944b3
MD5 d0fe1ce44bdd1e5f7f1e882f9466a656
SHA1 e58de282d8d375af2a01cc70ca1f9c418985363c
SHA512 4fbccb5a9dc3e46d2d136e1201fd012cfa28611a16a282ac4e37f36ef5c4018450ccd7e63dab94748d36f50ea5aed6d85bc0a012a51c97f643f68e834f3573d5
SSDEEP 192:/CdirSdfTk0gsT/PrCcBj7g+JKIUbvrf2mNgZIl3Z9RoGVmXLAvEmj2MgIC9bPMO:/C2aLk0gK/PrlBj7g+kIUjrufG1Z3wX7
TLSH
T1A7324E556D430ACA9A66C2FF141FB0C78E6FA544D009DCB3A922E756CCAA7D381D31F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo_48.png

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Extensions\ddomlcjnbfakinihjhdnabiodnikomhm\2.6_0\logo_48.png
Size 2KB
SHA256 9089cc13d35a4b04abaae2ab915f3a507e27e6290b46043af2c0f38835013e48
MD5 40eb46a9efc7f53cf5ed3ceaa8a0fddc
SHA1 44f7737128b0cff811dc5815c3d9a31438f9f8d1
SHA512 e869d6ae5c9bfe2f53fd86322f1c6100efc4861a3cb0e63d6e24ae3fe289ace10de48319ea2083730ca42841502928576b4af4af118d5749a01a51e9f5521dd7
TLSH
T1CB517D93E05429235435307B1B4C14216CBC2CD4E5DD1DDC46CB6FAB1EBD1683E463C4
MD5 SHA1 SHA512 TLSH

Submit Download

6929fa4c-1add-4ff7-b51d-27bfab9ab4f6.tmp

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Network\6929fa4c-1add-4ff7-b51d-27bfab9ab4f6.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8859839103544464d8475492663f2650a6b390600519852004d21cb50791bc19
MD5 9635aedc081672e0b680226636790259
SHA1 4f6af2dcb37488f591b51b270b0257a2fa3c31b7
SHA512 d9dcd0ed6403f11930e49d8e4515addc2f1d2a1f5036d0dfb210a861ea278bf25412019e4a0ee04aeda78d9b6a67c3d9556452ee2170abbc5ed99946f8d175a3
TLSH
T1E631A0F7C3E8863D8A5551F4AB153E1BCE290914432C3C56C8E8EF5BA7E2570D25058F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Preferences
Size 10KB
SHA256 462af3fc011ab77540981312472a534f7eb04165e9c738d46caf7b3553ede491
MD5 928b9ef4b61c344c86a1a33ba79b0ea6
SHA1 36cbac9a016c34cb325e2774d3b15101423f9661
SHA512 1262976a12caeb485c371252f2ece687309b53bd50fae8d298997fa5783ebfbb058ff20457256c3c26237fca2897f238ba7fd7a99e39ebee3b19d82f71503c49
SSDEEP 192:zRn59D5v70zZGn9LHcb+WNOsb51HoyIsn2agAC+e:zRn59t/JgrqAze
TLSH
T12222A32EB920A93B5CC7D319F9297B52E7F2503135942D48E6FC8D2D25E7ACD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f6e56c2-e4a7-4ae8-9be5-8ce0ec0853e7.tmp

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\2f6e56c2-e4a7-4ae8-9be5-8ce0ec0853e7.tmp
Size 72B
SHA256 548df721018d87875cc8c588755ff30ba4b827785f3db3626d49ff60e406fa16
MD5 7932a551322037f6355fcb41cd3ce291
SHA1 f56dcb0355f7d4f0eb9b416d16fa80051c329f5d
SHA512 c9ff26077bd846e43433f462adee0f8a0b154da98f6e4759a6f97bd0e737ca4a3b191e83edd8b578566fa9189d4fb3d6310d5c3d7177785b1d5cac3b770c0db6
TLSH
T1FEA00261024291A1D34002BA285583896600F979C0000213B7D0438E8C71450CA12544
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 23dcc3fa543c34c1ae39311c91f02128b551ebdfa7424d31398e85013dfdb9fd
MD5 0192ddaf5ad3a2b1980f92c85400406f
SHA1 51fd14c493e00d65527d502f454e937cc9da82ea
SHA512 5d2ed8c7a67a203ae23500105e748514e73e2cb4f161b329c02b6680fc3d3f2100bcbb96e252a534dd814d1e3b0192f3ef41320e8fbf346f6e9e74cd174ba6d3
TLSH
T183A0021311550562C11542F3185922CC239269359D0357C2F29586A59C512604519440
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

bc43afd4-92ab-4bca-839b-e1f466902e08.tmp

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\bc43afd4-92ab-4bca-839b-e1f466902e08.tmp
Size 10KB
SHA256 c6251acbac89889da8124dbbff425032e7c17508d0b71b361b0024a9c542ccce
MD5 eee2af17719c8dc924ae351277b780e5
SHA1 319bd8fcbe1719e57c3b3aae24e14e15aecde90c
SHA512 6a4c9e37f87692b062de5024146ebad9314267a1386eaa657bf9b2ddb8833ce60efb30ceac894b49df9ec6b2cab1a851aa1b553b8aaf1b37537df1cf837c59e5
SSDEEP 192:zRn59DVv70zZNn9LHcb+WNOsb5r5oyIsn2agAC+e:zRn59pwJgrOAze
TLSH
T10822A52EBA20A93B5CC7D319F9297B52E7F2502131942D44E7FC8D2D25E7ACD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Local State
Size 3KB
SHA256 f8ac9e85d13d2badba520a2700d650571479c4f2e2558358ed51e4ec323f26c7
MD5 a85ac2a06f3ea3f024dc3f703661f7c7
SHA1 15676f116ccec8148d8ef19b7294059c7524542e
SHA512 d69af6a50cad7c9ae60524443d6dd23083e2dc7971b4f93e411e43abced013dde47084b87815ae9436a630d5dd1d3003b993e1e06a3dcbd9c5cdbccf80f60dea
TLSH
T1AF61A53578A8CEB358B3C185F5463E13DBA890A6A261BFD4D6ED4F0C01E75E81717103
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Local State
Size 6KB
SHA256 cb2a9415c8112f91c66498b5de7e46281ae09848f8013d68b4ea066af88e86e4
MD5 a09258d0d17652b198ba9716febee37c
SHA1 87e5bce6d672647e546140f0dc3e1e902d34443b
SHA512 32e6aeb2db85797e8fb42fdcb1306b28ffddbfa36afea31cfe1750dcadaf1c30e92eca688e3ced967d88e004d15bdeca3e90edc33c433343e2753190e25b0728
SSDEEP 96:DbJ6Ysf1OKXvR2otop5ydRD4B6wGgdve9zugPqlBkH3RASXges1hQU4a:DtPKp2U2aMMgUN3iohFgz1hL
TLSH
T16FD1A43AF586CB27ECE78A855205FD86EB5802561A805AD68CD98E8C50DF5FC373680A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

preloaded_data.pb

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\MEIPreload\1.1.0.3\preloaded_data.pb
Size 8KB
SHA256 9b32ba9222d44bebc479ffa9704d2a9abccae153982838a3b9a79846b80877a3
MD5 a01c788456b7771739d0c770da676ea8
SHA1 23b67e6618949c08a0a214d920fbc9779bf89377
SHA512 9846efd14ec46154b7b80b89e08b30bc8f82ca1b11bfaf19ebd4f1f32b3f44fbac8ea8c33203070c4414cbab9d727d2ccc4f1f733b64cbea880c0b516a16a8a1
SSDEEP 192:/8bnweeDe4NkGNXDsyEsR6R6Oh/CU3y5M1ZJ8jmmOd:/8bnsa46GN1eRv/RR7J8jmmOd
TLSH
T1EA029F068E4B3E4F0D1A964D49863F56373B216751C54C8CFF9B992A4069761B0AC89D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\PlCache\data_0
Size 194B
SHA256 fe5a9749e5ed72659ca78b1753b30b7836dd0e1b0e03a8475b497684253c5db2
MD5 3c311d60580c3e140a005affbfb434d9
SHA1 ccffb1e546fab57a06c3e926f228d7702e2407db
SHA512 70eb700eeb977c50e601e1d5f9cc9e493ca042f77470b0146eb7f9ada6bfce034d461fc1660bffb5df7edeb1c6431f5f9e825a9330e69a84af6b5c0a938508e4
TLSH
T1B6C022980152322CD91F8EAC2CB780A801AA64B293316A85451238CB968C5121DAA89C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\PlCache\data_0
Size 194B
SHA256 9806b399a3c14f2008e22f65f3d1ed06d972e0058a0dd44b26870b1a8e0a1b1e
MD5 382914c10aeb78c50c2d8d48d43d3d50
SHA1 edd4d20c7fb720250f102defb8610291ba26de6a
SHA512 d41b290b210d2032e75665917f2b0ef040bde261203de869ebb8b21bac57015ac65cf2b1446560528e8eb7029a5489a8a667bfd7affec5282779b0b6735f0a68
TLSH
T1A2C0C0F47B1C2AC2EC00D5375762C88C9EE9C4481A010F780E9306B3F740CC1E44E8A3
MD5 SHA1 SHA512 TLSH

Submit Download

fa0e90ac-e289-4441-aed8-4187f26f8d4a.tmp

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\fa0e90ac-e289-4441-aed8-4187f26f8d4a.tmp
Size 1KB
SHA256 6e02bcf552c9ab5cae131c1162a5c723104958e4f6de3a9034b697b109e709fe
MD5 72208389c44bad4db3cc211fd93d4426
SHA1 a58dde9c5f66221a02ecd2f2ad1a20fc20a1de68
SHA512 d90ce3820860cc303c9339d441134a2defaa569e4e31483c628f9f5d19ab526bf561d461cc9514fac75516217908c442f56b259f62f0556d9427ffb9fc908f20
TLSH
T12911B5B3B888DFB1DCC1008AB2925D131DA0A13083146B4093CD5E1E45E72E88F3F437
MD5 SHA1 SHA512 TLSH

Submit Download

logo_48.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5692_761152189\CRX_INSTALL\logo_48.png
Size 1KB
SHA256 b1aabc9cfa8f04287b6133dddc0a5a1571bd5e0f5e79cbc03a34b62dd00e2b79
MD5 adb079893903d9999655330053594acf
SHA1 c805827dff810aec9b664e042aed02ca437349b0
SHA512 f2375fcf1956f8c5521d481e6439fef86d06924a3fa4b1b9964ceb566f2a9c5c2eb31bb6e733399ec77d35cd61620f2a2059190f50b4f1f60a652287af1b7a53
TLSH
T1AB1186CFE770646D928F0232F0A8C4BEB1B92187122B0CB513D796786037644AAB1F09
MD5 SHA1 SHA512 TLSH

Submit Download

ddomlcjnbfakinihjhdnabiodnikomhm.crx

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5692_761152189\ddomlcjnbfakinihjhdnabiodnikomhm.crx
Size 726KB
SHA256 82ed295c5c16ec59b02859e52ec1fb7649019ec98a18653665ea9817001fa4b7
MD5 da5c9f295950a823a75982dc583ee287
SHA1 c4e9fbad9acdad0746b09f3e06ce02fecd72fd91
SHA512 74c71475b4b17a2752c014e75a10b6863ad1705191ff20703dd9c2213d2f8621cdcf95bdc0291d1e329eb6324fd33f677d4c3dd37ac9f1f286d3614490354f3c
SSDEEP 12288:HpjWUYbtsLDTAl6SNBWO8QuaiAS72qluFhkicCOx8Epu/Ft5oV4THUoO:NqbtsU5NBWO8O3SqFnTcCOx8eKtOqLU1
TLSH
T1B3F42391D0860CB5E458E9FB7B78B306D77863DD06D2353D817BB668AC32B88C651BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\Downloads\setup.exe
Size 6.4MB
SHA256 540080fea97d88ed902c5e4f9a026b4fcd32ab263706c520e00728f1a29578b8
MD5 d65c7b544a97b0c3f2773b5fcc57d30e
SHA1 1615e07ac069ca08f9cdddd99a3e4a533f574e02
SHA512 d1ca47a6d6199cee3a9427506230ca38170181acd0d41e9225eca3c05f67c3a164b356291cc4cc7d114fd7091a0fc919b428dfd6631d87acf970f7c9bc8e24ba
SSDEEP 49152:b/rA+NRAiZECLgrZ9cyzMikQ1GlX0kZ7xk2H174sydWnStq9YY5s2VaLtpTdQQeh:b0+83gy2VksyTtmQAFR/+a59Xpx
TLSH
T149669D03F2D941D9E0BAD678DB7643329AB27C859B34A2DF074076151E76EE09B3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3132-923-0x00007FFE607E0000-0x00007FFE607E1000-memory.dmp

Download

memory/3132-924-0x00007FFE5F840000-0x00007FFE5F841000-memory.dmp

Download

memory/3140-1371-0x000002079E060000-0x000002079F8D9000-memory.dmp

Download

memory/3140-1415-0x000002079E060000-0x000002079F8D9000-memory.dmp

Download