hxxps://browsergo[.]com/thankyou

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://browsergo.com/thankyou
Sample260929-s69dcsxtet

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
84	4580	msedge.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	pulsebrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	pulsebrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	pulsebrowser.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	pulsebrowser.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 24 IoCs

pid	Process
5740	setup.exe
5856	updater.exe
5940	updater.exe
6100	updater.exe
5200	updater.exe
1248	pulsebrowser_installer_149.0.7827.158.exe
6056	setup.exe
4588	setup.exe
6304	setup.exe
6324	setup.exe
6464	pulsebrowser.exe
6776	pulsebrowser.exe
6788	pulsebrowser.exe
7104	pulsebrowser.exe
4724	pulsebrowser.exe
1108	pulsebrowser.exe
2564	pulsebrowser.exe
2472	pulsebrowser.exe
3884	pulsebrowser.exe
7124	pulsebrowser.exe
7160	pulsebrowser.exe
5072	pulsebrowser.exe
2848	pulsebrowser.exe
1332	pulsebrowser.exe

Loads dropped DLL 33 IoCs

pid	Process
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6776	pulsebrowser.exe
6776	pulsebrowser.exe
6788	pulsebrowser.exe
6788	pulsebrowser.exe
6776	pulsebrowser.exe
6776	pulsebrowser.exe
6776	pulsebrowser.exe
6776	pulsebrowser.exe
6776	pulsebrowser.exe
7104	pulsebrowser.exe
7104	pulsebrowser.exe
1108	pulsebrowser.exe
1108	pulsebrowser.exe
4724	pulsebrowser.exe
4724	pulsebrowser.exe
2564	pulsebrowser.exe
2564	pulsebrowser.exe
2472	pulsebrowser.exe
2472	pulsebrowser.exe
3884	pulsebrowser.exe
3884	pulsebrowser.exe
7124	pulsebrowser.exe
7124	pulsebrowser.exe
7160	pulsebrowser.exe
7160	pulsebrowser.exe
5072	pulsebrowser.exe
5072	pulsebrowser.exe
2848	pulsebrowser.exe
2848	pulsebrowser.exe
1332	pulsebrowser.exe
1332	pulsebrowser.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PulseBrowserUpdaterTaskUser135.0.7049.101 = "\"C:\\Users\\Admin\\AppData\\Local\\PulseSoftware\\PulseBrowserUpdater\\135.0.7049.101\\updater.exe\" --wake"	updater.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\setup.exe	pulsebrowser_installer_149.0.7827.158.exe
File created	C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping6464_477249045\_metadata\verified_contents.json	pulsebrowser.exe
File created	C:\Program Files\PulseSoftware5740_1763409928\UPDATER.ARCHIVE.7Z	setup.exe
File created	C:\Program Files\PulseSoftware5740_1051285986\bin\updater.exe	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\setup.exe	pulsebrowser_installer_149.0.7827.158.exe
File created	C:\Program Files\chromium_chrome_BITS_6464_200035934\decoded_xz	pulsebrowser.exe
File created	C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping6464_477249045\manifest.json	pulsebrowser.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\manifest.fingerprint	updater.exe
File created	C:\Program Files\PulseSoftware5740_1051285986\bin\uninstall.cmd	setup.exe
File created	C:\Program Files\chrome_url_fetcher_6100_147194422\pulsebrowser_installer_149.0.7827.158.crx3	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\PULSEBROWSER.ARCHIVE.7Z	pulsebrowser_installer_149.0.7827.158.exe
File opened for modification	C:\Program Files\chromium_installer.log	setup.exe
File created	C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping6464_477249045\cr_en-us_500000_index.bin	pulsebrowser.exe
File created	C:\Program Files\PulseSoftware5740_1051285986\updater.7z	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\pulsebrowser_installer_149.0.7827.158.exe	updater.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\SETUP.EX_	pulsebrowser_installer_149.0.7827.158.exe
File opened for modification	C:\Program Files\chromium_installer.log	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pulsebrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pulsebrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pulsebrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pulsebrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pulsebrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pulsebrowser_installer_149.0.7827.158.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pulsebrowser_installer_149.0.7827.158.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pulsebrowser.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6056	setup.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6788	pulsebrowser.exe
4580	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pulsebrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	pulsebrowser.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pulsebrowser.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	pulsebrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	pulsebrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	pulsebrowser.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{A9EAD16E-5D14-5C33-BF6D-B580FCDB1932}\ = "ICompleteStatusUser"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{A9EAD16E-5D14-5C33-BF6D-B580FCDB1932}	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{AE097E2A-7F4B-4248-8698-D6E515E9C638}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\PLSHTML.JXXR6RE32YYQOYGKXJOE2FL3LE\AppUserModelId = "PulseBrowser.JXXR6RE32YYQOYGKXJOE2FL3LE"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{A4971B62-FB05-52B3-AB49-2E63B3614613}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\PulseSoftware\\PulseBrowserUpdater\\135.0.7049.101\\updater.exe\\1"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{7BF946C6-0665-585B-A730-290CE250C539}\TypeLib	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{13D172EB-2BFB-4D72-AF10-7D33337B7FC6}\ = "IPolicyStatusValueUser"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{3057E1F8-2498-4C19-99B5-F7F207DA4DC7}\TypeLib	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{1816D37D-0C7D-5CD7-8212-DFB46B3947A7}\TypeLib	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{E2C00808-83C7-4CE4-8075-7E185A90AE04}\TypeLib	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{A4971B62-FB05-52B3-AB49-2E63B3614613}\TypeLib	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{F4874A57-8C88-4B1D-AAB8-4B06CF98FB29}\ = "IAppVersionWebUser"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{E2C00808-83C7-4CE4-8075-7E185A90AE04}	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{2C320333-21CF-4FC8-BF8F-4287DB3795B7}	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{847BB70C-47D0-46C2-8C97-9000A1F9AD99}\TypeLib	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\TypeLib\ = "{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{A4971B62-FB05-52B3-AB49-2E63B3614613}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{7BF946C6-0665-585B-A730-290CE250C539}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{AE097E2A-7F4B-4248-8698-D6E515E9C638}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\PulseSoftware\\PulseBrowserUpdater\\135.0.7049.101\\updater.exe\\3"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{847BB70C-47D0-46C2-8C97-9000A1F9AD99}\TypeLib\ = "{847BB70C-47D0-46C2-8C97-9000A1F9AD99}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{87DBF75E-F590-4802-93FD-F8D07800E2E9}\1.0\0\win32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\.mhtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{A9EAD16E-5D14-5C33-BF6D-B580FCDB1932}\ = "ICompleteStatusUser"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{F4874A57-8C88-4B1D-AAB8-4B06CF98FB29}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{F0A39C88-1BBD-53D5-BB8F-406D8B83F113}	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{2C320333-21CF-4FC8-BF8F-4287DB3795B7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{2C6218B9-088D-4D25-A4F8-570558124142}\TypeLib	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{9D31EA63-2E06-4D41-98C7-CB1F307DB597}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{47C8886A-A4B5-4F6C-865A-41A207074DFA}\TypeLib	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{47C8886A-A4B5-4F6C-865A-41A207074DFA}\TypeLib\ = "{47C8886A-A4B5-4F6C-865A-41A207074DFA}"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{EA08425E-054B-4564-B0A0-8BAAB76F38E9}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{EA08425E-054B-4564-B0A0-8BAAB76F38E9}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{D734C877-21F4-496E-B857-3E5B2E72E4CC}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{87DBF75E-F590-4802-93FD-F8D07800E2E9}\ = "IAppCommandWeb"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{7D908375-C9D0-44C5-BB98-206F3C24A74C}\1.0\0	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{5C674FC1-80E3-48D2-987B-79D9D286065B}	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{3B0D60EF-13AB-518C-90C1-E927736125C6}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\PulseSoftware\\PulseBrowserUpdater\\135.0.7049.101\\updater.exe\\1"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{2C6218B9-088D-4D25-A4F8-570558124142}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{5C674FC1-80E3-48D2-987B-79D9D286065B}\1.0	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{3B0D60EF-13AB-518C-90C1-E927736125C6}\1.0\0	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{AE097E2A-7F4B-4248-8698-D6E515E9C638}\TypeLib	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{E2C00808-83C7-4CE4-8075-7E185A90AE04}\1.0\0\win64	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{13D172EB-2BFB-4D72-AF10-7D33337B7FC6}\1.0	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{3B0D60EF-13AB-518C-90C1-E927736125C6}\1.0\ = "PulseBrowserUpdater TypeLib for IUpdaterCallbackUser"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{F4874A57-8C88-4B1D-AAB8-4B06CF98FB29}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{F8D4B43D-7D22-47FE-B6AD-BAC5ED8A1659}	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{13D172EB-2BFB-4D72-AF10-7D33337B7FC6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{1E8CAE0D-DBFB-5F8D-8C4C-631A96B2AE9E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{1E8CAE0D-DBFB-5F8D-8C4C-631A96B2AE9E}	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{A4971B62-FB05-52B3-AB49-2E63B3614613}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\PulseSoftware\\PulseBrowserUpdater\\135.0.7049.101\\updater.exe\\1"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{F0A39C88-1BBD-53D5-BB8F-406D8B83F113}\1.0	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{847BB70C-47D0-46C2-8C97-9000A1F9AD99}\ = "IPolicyStatus3User"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{027234BD-61BB-4F5C-9386-7FE804171C8C}\1.0\0	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{7D908375-C9D0-44C5-BB98-206F3C24A74C}\1.0\ = "PulseBrowserUpdater TypeLib for IPolicyStatus"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{5C674FC1-80E3-48D2-987B-79D9D286065B}\1.0\0\win32	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{F0A39C88-1BBD-53D5-BB8F-406D8B83F113}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{F4874A57-8C88-4B1D-AAB8-4B06CF98FB29}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\PulseSoftware\\PulseBrowserUpdater\\135.0.7049.101\\updater.exe\\3"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{13D172EB-2BFB-4D72-AF10-7D33337B7FC6}\TypeLib\ = "{13D172EB-2BFB-4D72-AF10-7D33337B7FC6}"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{87DBF75E-F590-4802-93FD-F8D07800E2E9}\1.0\0	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\PLSHTML.JXXR6RE32YYQOYGKXJOE2FL3LE\Application\ApplicationName = "Pulse Browser"	setup.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5740	setup.exe
5740	setup.exe
5856	updater.exe
5856	updater.exe
5856	updater.exe
5856	updater.exe
5856	updater.exe
5856	updater.exe
5940	updater.exe
5940	updater.exe
5940	updater.exe
5940	updater.exe
6100	updater.exe
6100	updater.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
5856	updater.exe
5856	updater.exe
4260	msedge.exe
4260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	5740	setup.exe
Token: SeIncBasePriorityPrivilege	5740	setup.exe
Token: 33	1248	pulsebrowser_installer_149.0.7827.158.exe
Token: SeIncBasePriorityPrivilege	1248	pulsebrowser_installer_149.0.7827.158.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe
Token: SeShutdownPrivilege	6464	pulsebrowser.exe
Token: SeCreatePagefilePrivilege	6464	pulsebrowser.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe
6464	pulsebrowser.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 800	3204	msedge.exe	86
PID 3204 wrote to memory of 4580	3204	msedge.exe	88
PID 3204 wrote to memory of 4212	3204	msedge.exe	89
PID 3204 wrote to memory of 2568	3204	msedge.exe	90
PID 3204 wrote to memory of 4212	3204	msedge.exe	89
PID 3204 wrote to memory of 4212	3204	msedge.exe	89
PID 3204 wrote to memory of 2568	3204	msedge.exe	90
PID 3204 wrote to memory of 416	3204	msedge.exe	91
PID 3204 wrote to memory of 416	3204	msedge.exe	91
PID 3204 wrote to memory of 416	3204	msedge.exe	91
PID 3204 wrote to memory of 4684	3204	msedge.exe	92
PID 3204 wrote to memory of 4684	3204	msedge.exe	92
PID 3204 wrote to memory of 4684	3204	msedge.exe	92
PID 3204 wrote to memory of 2136	3204	msedge.exe	93
PID 3204 wrote to memory of 2136	3204	msedge.exe	93
PID 3204 wrote to memory of 1928	3204	msedge.exe	94
PID 3204 wrote to memory of 2136	3204	msedge.exe	93
PID 3204 wrote to memory of 1928	3204	msedge.exe	94
PID 3204 wrote to memory of 1928	3204	msedge.exe	94
PID 3204 wrote to memory of 2316	3204	msedge.exe	98
PID 3204 wrote to memory of 3944	3204	msedge.exe	99
PID 3204 wrote to memory of 2316	3204	msedge.exe	98
PID 3204 wrote to memory of 3944	3204	msedge.exe	99
PID 3204 wrote to memory of 412	3204	msedge.exe	101
PID 3204 wrote to memory of 740	3204	msedge.exe	109
PID 3204 wrote to memory of 740	3204	msedge.exe	109
PID 3204 wrote to memory of 740	3204	msedge.exe	109
PID 3204 wrote to memory of 3532	3204	msedge.exe	110
PID 3204 wrote to memory of 3532	3204	msedge.exe	110
PID 3204 wrote to memory of 2896	3204	msedge.exe	112
PID 3204 wrote to memory of 876	3204	msedge.exe	113
PID 3204 wrote to memory of 2896	3204	msedge.exe	112
PID 3204 wrote to memory of 2896	3204	msedge.exe	112
PID 3204 wrote to memory of 876	3204	msedge.exe	113
PID 3204 wrote to memory of 5160	3204	msedge.exe	114
PID 5740 wrote to memory of 5856	5740	setup.exe	122
PID 3204 wrote to memory of 5340	3204	msedge.exe	129
PID 3204 wrote to memory of 5348	3204	msedge.exe	130
PID 3204 wrote to memory of 5300	3204	msedge.exe	131
PID 6100 wrote to memory of 1248	6100	updater.exe	134
PID 1248 wrote to memory of 6056	1248	pulsebrowser_installer_149.0.7827.158.exe	137
PID 6056 wrote to memory of 4588	6056	setup.exe	138
PID 6056 wrote to memory of 6304	6056	setup.exe	146
PID 6304 wrote to memory of 6324	6304	setup.exe	147
PID 6056 wrote to memory of 6464	6056	setup.exe	149
PID 6464 wrote to memory of 6776	6464	pulsebrowser.exe	150
PID 6464 wrote to memory of 6788	6464	pulsebrowser.exe	151
PID 3204 wrote to memory of 7076	3204	msedge.exe	152
PID 3204 wrote to memory of 7076	3204	msedge.exe	152
PID 6464 wrote to memory of 7104	6464	pulsebrowser.exe	153
PID 6464 wrote to memory of 4724	6464	pulsebrowser.exe	154
PID 6464 wrote to memory of 1108	6464	pulsebrowser.exe	155
PID 6464 wrote to memory of 2564	6464	pulsebrowser.exe	158
PID 3204 wrote to memory of 6248	3204	msedge.exe	159
PID 3204 wrote to memory of 6248	3204	msedge.exe	159
PID 6464 wrote to memory of 2472	6464	pulsebrowser.exe	160
PID 6464 wrote to memory of 3884	6464	pulsebrowser.exe	161
PID 6464 wrote to memory of 7124	6464	pulsebrowser.exe	162
PID 6464 wrote to memory of 7160	6464	pulsebrowser.exe	163
PID 5856 wrote to memory of 5072	5856	updater.exe	164
PID 3204 wrote to memory of 6888	3204	msedge.exe	167
PID 3204 wrote to memory of 6888	3204	msedge.exe	167
PID 3204 wrote to memory of 4260	3204	msedge.exe	169
PID 6464 wrote to memory of 2848	6464	pulsebrowser.exe	173

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://browsergo.com/thankyou
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff84c3dc188,0x7ff84c3dc194,0x7ff84c3dc1a0
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,7331654799820283660,4727593118939144200,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,5089332485795452902,4919365790404795419,262144 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,7410723581019340534,18197687307152441845,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,15498501125483561362,5554196728240076227,2097152 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,10663384950991573627,1311915296545868649,2097152 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,18196871295197514489,4228335252727822310,2097152 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4108,i,8407762882010761837,14223073501197108603,2097152 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4867991929207500723,1800461240515807390,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,1546197433780193651,9771854658630426826,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,14337053031878032455,18117281800957267780,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,14337053031878032455,18117281800957267780,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6192,i,7692911083076754296,6611843235624650064,2097152 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,12719589867035604063,5859174038162945560,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6744,i,15926767452671793046,8898462952643620608,2097152 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,6240678289170284491,15945240115317090426,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,9038167456934012753,6763122947667518347,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,12726573473971214695,4873557590662129258,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,10709141215878518968,4472898586285996924,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,1294470486135803175,18010752601566155957,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,2606550491731547380,11330450460652771037,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:7076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,18119377101044397400,16364781567712816981,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:6248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,7214059099061372584,16264260778276851576,524288 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:8
  2⤵
  PID:6888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,12459811670970907304,6614571914775017785,262144 --field-trial-handle=2700,i,12723031909796778397,17360907790004295504,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5060

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5668

C:\Users\Admin\Downloads\setup.exe
"C:\Users\Admin\Downloads\setup.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Program Files\PulseSoftware5740_1051285986\bin\updater.exe
  "C:\Program Files\PulseSoftware5740_1051285986\bin\updater.exe" --install --app-id={2F4E88B4-E690-4E1F-AA9E-B7A4617F881D} --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
    "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --from-installer
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5072

C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe
"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe" --server --service=update-internal -Embedding
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5940

C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe
"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe" --server --service=update -Embedding
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6100
- C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\pulsebrowser_installer_149.0.7827.158.exe
  "C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\pulsebrowser_installer_149.0.7827.158.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\setup.exe
    "C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\setup.exe" --install-archive="C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\PULSEBROWSER.ARCHIVE.7Z"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:6056
  - - C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\setup.exe
      "C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=PulseBrowser --annotation=ver=149.0.7827.158 "--attachment=C:\Program Files\chromium_installer.log" --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff7b7c48f80,0x7ff7b7c48f8c,0x7ff7b7c48f98
      4⤵
      Executes dropped EXE
      PID:4588
  - - C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\setup.exe
      "C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:6304
    - - C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\setup.exe
        
        "C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=PulseBrowser --annotation=ver=149.0.7827.158 "--attachment=C:\Program Files\chromium_installer.log" --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff7b7c48f80,0x7ff7b7c48f8c,0x7ff7b7c48f98
        5⤵
        Executes dropped EXE
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
      "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --from-installer
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:6464
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,11991833183677040997,15358899669807565048,262144 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2016 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2160,i,3382745465429439905,10743230225257849167,524288 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2252 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Time Discovery
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2508,i,5008147451212394657,13413879680225848550,524288 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2520 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3492,i,16693449086987648220,3132036913151033848,2097152 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3496 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --instant-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3504,i,2628768330207415577,2198480149366451741,2097152 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3544 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,7081364253695115650,6282772724740509235,524288 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5176 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5144,i,960616665086805581,8470160808771709690,524288 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5292 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,15844612527628475681,4304538555863261829,524288 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5524 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,3989091357289437012,8056660303975499083,524288 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5368 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5592,i,2365987162143459356,7836130275888401971,2097152 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5300 /prefetch:2
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=692,i,2516468617593854831,3502374687331879355,524288 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=1084 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
        
        "C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=984,i,1943878202494966467,9864585706476017060,524288 --field-trial-handle=2020,i,16825075639051448151,9336218400287005442,262144 --variations-seed-version --pseudonymization-salt-handle=2072,i,17821604989338142275,15733273321898616568,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5208 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1332

C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe
"C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe" --wake
1⤵
- Executes dropped EXE
PID:5200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Program Files\PulseSoftware5740_1051285986\bin\updater.exe
Size 5.3MB
SHA256 a8ec63229a801901d83120e5e108cbf01d70c21d05c4e5288f54ff80591944c6
MD5 eba3bc65e15cef7aa7f21c7309b2fb63
SHA1 7eb8d65b44779483d341dc34f94419884fe6a926
SHA512 542e23775108d68e681fb42d897b22e22ecafc717077739efa99b9d7ad959f9b270964d6867105e303ef6f6dba7a495ee4b78b681a831b285e555b73d2ff8b1d
SSDEEP 49152:kc18dUORkVrT3b3FGqKi/8wClwnLXZtuzf1EsCBhuEmzi0wt8IAoJNe0heLr1YRJ:UbItXZ81EuEOi5q8He0Tw
TLSH
T10E464B23F29941D8E0AED6789B7A4232D9737C855B35A2DF074076251E76FE09B38B30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6100_2009075191\CR_88386.tmp\setup.exe
Size 5.6MB
SHA256 7f79979abf143a9b91ce0f77b936438cc4a04bcc7f5d871bb9643299c97e27b1
MD5 25783a28f03fac9d7a413608b901f857
SHA1 9d780b4832389fdb7744f85741f744ca270d61f0
SHA512 889d76728114787a76248669956c06f5c53fcdcf419e9f92aa7fb514481ef76fa3c5097675392f57c679c205acdf46933295299b998aea64dbe425a3fc0f287c
SSDEEP 49152:b67p/LkeyGN0Bcj0cyPsEs8X5XJD9+/7JwQ3NsAku0WPHaWsyT9x2WBGHlMMZI7x:kbSUaJZM7WeNVku0WPHamMOMu7f+5i
TLSH
T177466C53F3A501E8D06EC974CF2D95229A257C4A47B4A3EF2AD436E11A71ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping6464_477249045\manifest.json
Size 108B
SHA256 ba6fcb8964f3dd492fec803586a6cf000789745e0f6dee9a89f7eb1ab9d470be
MD5 70045b6ede48125f626e7f9971984e3d
SHA1 1354618eb0b8f463579de7a25b39f748ca06fb50
SHA512 4561e8e3b77f295187104b3a331cf4c5552bfe02e61ccc3e285c86682cc518f130e17366aabf37c1837bb5375c4484714b2a35ff65561036a64c3c0c8244fc51
TLSH
T17DB012766D00797754CA0760253563C2E7E47C0E68557D429B332492115B73A41B132C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

7fbe7ecf-52ce-4133-96cd-5daf1f21a73d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7fbe7ecf-52ce-4133-96cd-5daf1f21a73d.tmp
Size 9KB
SHA256 e5bd59a96fd4a9a49d3da16c93693546c2f96e84967aa995c588c550eb98608a
MD5 c712c5eb76e2acc0df66b0107353e89d
SHA1 6a09fe4afe4581f9685c7a1ec07ad0acb486d695
SHA512 7a05d663c79d12b8746ed9fd73db139f48a2f36d3e42542e874b4ecfce759a9f16090f6cb1166b40665b6d38c9b472314b6d2573dcd518595376a349d43cd668
SSDEEP 192:sxZURQnS/fnsO2IdpCDHW6+WNx9B/YRPEItIgrJ:sxZUUS/fnsO3cHbB/md9
TLSH
T18522B8526E38A57B8CC7D20DBB65BF53E6FA503291D11E58AAFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 34bcc3bfb68358074463223547a107af00b260d0a5a36fc3c3d775e191f1b5dc
MD5 a1cdbda24517c8ba2825c31ffced3581
SHA1 cfd042df6d87ec28404b5362045a22d7835c7edc
SHA512 446a4b62b7cbbd7e0561fef591a565a6bc5ba5e23a811855e6c52440b037734ff0888f51f8a408717499114c61fa6029957f310cf054c397f6b77d6c68b6b9ab
TLSH
T120E0809C05C5D25DD155F4C746BC9B5CC1903F0BD7CC6A452B048C5D714254466D1765
MD5 SHA1 SHA512 TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 6.4MB
SHA256 540080fea97d88ed902c5e4f9a026b4fcd32ab263706c520e00728f1a29578b8
MD5 d65c7b544a97b0c3f2773b5fcc57d30e
SHA1 1615e07ac069ca08f9cdddd99a3e4a533f574e02
SHA512 d1ca47a6d6199cee3a9427506230ca38170181acd0d41e9225eca3c05f67c3a164b356291cc4cc7d114fd7091a0fc919b428dfd6631d87acf970f7c9bc8e24ba
SSDEEP 49152:b/rA+NRAiZECLgrZ9cyzMikQ1GlX0kZ7xk2H174sydWnStq9YY5s2VaLtpTdQQeh:b0+83gy2VksyTtmQAFR/+a59Xpx
TLSH
T149669D03F2D941D9E0BAD678DB7643329AB27C859B34A2DF074076151E76EE09B3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 df308eb9a7fc4dbad5af9cdfdce0589103c3ac847c0b77aaf67fca2f8fed5b5c
MD5 2edfb6b402a75f80dca18f54d5a45c70
SHA1 d143c57541ffad6dad59c630d1ed0fd113146520
SHA512 99da099bcfd551d08a7d5e191d83501cfd74303065cdc3389b5b47ac2a0262efa82cf155bb4f93095c52fcf52d1449b637a0a76c574033d51562a57c0e4d64b9
TLSH
T1F861C74CC5808274FF6808B385D221E33D34B68A46F7AFE60799FABAEB36354535801C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fe7f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fe7f.TMP
Size 3KB
SHA256 f263a3b1c6805574084b2fe484422ed940a2e7b2183c3cc9dc8da245d2919fbb
MD5 d3d6ed2687beb8c48273954edab5f244
SHA1 821395c216394eef41b8f0186e52a058bed5cb35
SHA512 e593316c2d0fa8a8a6260c36d6a8c27a7727ba6aac6a9a5218ee84f144a48964f858b725ae3c45dfea47c26e4b9bd269764d9d550a9b6dcb6751fc5ef2c7337b
TLSH
T1C761A64DC5954274FF68047381D221E33D35B68A46F7AFE207A9F9BADB3A364539801C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 61207a9beb359cc0988fb4c09976d9501caadbb5add4e3bc532f517efe108357
MD5 4e5602b6619bcac9a40db242e70c8751
SHA1 1d4542a2ba8e7e0ec2b634f0543e6833defcf5dc
SHA512 a3e3e9157a289507ab06f999b477a84936803259ddc12dc85043ebaa646d7d5552e02a59ba32334d09f7d45842f209594f980ac6a59e9be2d6f61639899a1051
TLSH
T1A6516DF787E9956EC81116F15624BE1BCE1D152582183E1AC8D4FF8B9BE3072E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2b8a03db9d866899a4950a4a84f0a5a701772e8d59822d174532620da037c644
MD5 66ef0caf07a471153ef784552ab0ea95
SHA1 e654a5261bebf7ca06bd9240fc8ebfd32869072d
SHA512 e9ce84ac31a2af7f963b756f7f4e7d6836e1b6fa26edf7fb479574e6aa07479462b30d3faa274eb6b1f1b709252da326ac19870a5a48a483670f5d0d46f21461
SSDEEP 192:sxZURQnS/fnsw2IdpCDHW6+WNx9B/YRPEItIg5qJ:sxZUUS/fnsw3cHbB/mdM
TLSH
T18622B852AE38A57B8CCBD21DBB55BF53E6FA503191D11E48AAFC861C05E77CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1c49af11a63b37b6671ca06a142050ce068b3fff545fe920b2866ff6496ccd08
MD5 4490da3698b0a6cabb9c593ffcfb8457
SHA1 38f5a01c61d2416137711af282749bffabecdaf9
SHA512 d7dc8c440fce515cf69866821d6777ec7084fd89d6030d5398fe74b9cfca386f4f66296401ac99ff6c8f77647382f50decf5a9ce05b8f83ec228643089e52497
SSDEEP 192:sxZURQ5S/fnst2IdpCDHW6+WNx9B/YRPwItIg5AJ:sxZU6S/fnst3cHbB/mBG
TLSH
T1D122A852AE28697B8CC7E21DBA65BF53E6F9503251D11E48AAFC861C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 04879f7dad9dd8991d74b40729bbeee3effb97d7e7679eed05702969973d0dd8
MD5 0138affd9808d6e8133c637dedb45924
SHA1 24ce0c28d1b93945333cac4af7d478680bf65dd5
SHA512 ac6c5b37b572522533b6479d2cd632444c10fd16d4662bbe0c3e6684375b865acc3a996859feb14bc48534818d96f8e6db9ff9e2cfffdeccf0764daf2e89e256
SSDEEP 192:sxZURQ5S/fnst2IdpEDHW6+WNx9B/YRPwItIg5AJ:sxZU6S/fnst3qHbB/mhG
TLSH
T12022B852AE28697B8CC7E21DBA65BF53E6F9503251D11E48AAFC861C05E77CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f4048ec9125b9c409e50549c0394396b26712ed15ca56ed2026ef8b2bf1f2822
MD5 ecd99aef1e007177acd41ac972f0e807
SHA1 c0688d3c0aa7e961a70b19edb5afad270c69f40c
SHA512 70aab70c7f44e3a4c992dfe78a94f122d535911ae22ba9b281317870222d613ae1af8fd8d4256c6d069273bb8c61b18ee1ba2e974b14e1b0ea61f5acc4846d41
SSDEEP 768:9tK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3hrow+UD:9tK9uzYWvcQWsu1ja0HL7Q3aw+UD
TLSH
T19BC2F93F640DCB7E4FC01A9DDC5A6F973E9802D7A6588D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5976ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5976ad.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4ea99388cd0a6f3a9aeb03a4a77881f8fe848994d8c8c492272daed55591045c
MD5 229c751f9381e51b606a34ba748fc9d3
SHA1 849654638622b5bf955a78e202f5aa661408bb72
SHA512 ad1cc5767e1bb18f6a935241814dcf5714e5eff029ca3797f650b7190995377dc2718d29925f2ec61ae0237c257d2b6834aa0e17d4f2c84325cf3ab609711cf2
SSDEEP 192:SONF6ygpQmiUyvctOCTVgVHDR0pqzPoAU6:SONF6lHdtOCTVKjGWdU6
TLSH
T13E02E735BC686CBB9DF3AE06F48B36175FE4117BDA512B84D9E81A1C00D765C2306D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b604461e6d8e68c47fcd3a6d497d7659852eb6ec2622821746e26e90ca45bcd5
MD5 37ffa432866ed78689a01fdebd3b1b51
SHA1 49d8bc892a7108a5a77b768addd1c92c99101b3d
SHA512 4de31da6cf799ed922fe429ef14bcb98f87450b67b9d44852b30776467773ad46a2470c5b3bd44c9bfea37dc87682c252bf61fefc0afe7f10289e8ab7b6cda3d
SSDEEP 384:uZcIhsNoTwiCekOjTVKjGYm/OMtgOIwZOywGoM:MhJfnJ/TXssz
TLSH
T124828E329C785CBA6CF7E145F58B32039FB88067D6856F8494ED5B1D01EB6AC130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 dfa957a1655fd702faa1ed8a1b6631884b5ba6f46d9ac949e5e4492e957bc026
MD5 a4c1cd0b4d421c60907ea40e644b7790
SHA1 0dfb1ff879fbb3c0a92199c418ea68fd952817a6
SHA512 7b81b41002017de3dc9e8cbbbabb178e5c807c6640e9d3dd7f56c07c1af781880777f7d634e25b6682b4ee9e2dd40b9d70a901e23c807671b235db1faf4436ad
SSDEEP 384:uZcIYsNoTwi9ekOjTVKjGYm/OMtgOIwZOywGoM:MYCfnJ/TXssz
TLSH
T1FE828E329C785CBA6CF7E105F58B32039FB89067D6856F8494ED5B1D01E76AC130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a3c2c6feebfc3337d59af4aee374f0f50e51ee5ad05b2f22d5935428d94b9e8f
MD5 63d6f1c19df6c7e1e95db6bd613c424e
SHA1 f79c14ff78907be6d1df77402cd950f8129e29c9
SHA512 ba65cd524c2109222077495d126a08cfa2edaca5ca31a59388d6ea7f0feab69df144c91756be6af3e6ad7b31e68112660a6649e9fabbcbb31d0a75eb85203be2
SSDEEP 384:mZcI8sNoCwizekOjTVKjGYmYOMtgOIwZOywGoM:08TfnJYTXssz
TLSH
T15C828E329C785CBA6CF7E145F58B32039FB890A7D6856F8095ED1B1D01DB69C130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1041866859be244278ec6afcddaf1acc2be22b7ab3c026417cb5ce4ef637f345
MD5 5542f577f09af35e3b2a4d129a01c173
SHA1 23e1b312dff266c6e7828a2d342226d59db3c819
SHA512 2b5a445f95740223e576fda7cceeb7ccb22942904ff03b28263a3d0c367e7a0fca4cf2f2b65907e3617f571467cc2139a053f5d5d17d4224f3dc282bfc5dbf9a
SSDEEP 384:eiFaZcIiWsNY8TUNTUlIlCwizRkOjTVKjGYm6OMtgOIwZOywGoM:1FYb5wgqfnJ6TXssz
TLSH
T175C22AF248E7487ADCAE9747A77D2D029EBCC067F5856A40B3981A1DCC961BFC30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 688faafafc28919f080c843ae938385813641c12aef0a2144a32b06516285a99
MD5 2eb3f0864f13c88648a5e34f20c69717
SHA1 711cb67047ea24edf6ea948fe6638bc3edea81c3
SHA512 3727063310c377aa4bcfe9deb8ac1757784ba49afe32b83e6cd71cf72638a4cca074482e6248a6f98de133199d2bf47f9fe0531623f7bf24bf10604a22dd6ea5
SSDEEP 192:SONB6ygQmiUyPckOCTVgVHDR0p+L9ERE3UOiqsU6:SONB6nbkOCTVKjGYmbOMU6
TLSH
T149121931B8686C7B5DE3A545F4C732139FE4926BDA496F80D5EC1E1C01EB6AC230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

218493ff-f903-4a47-9959-821e9af0350b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\218493ff-f903-4a47-9959-821e9af0350b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 df91201700b573ab3451cd8e53e52399e9f5b03a404547e546f1d517903f57ea
MD5 5eafb90335e3a44ba2b29025a0e78d0d
SHA1 0f5c73f974e371f33a243f61208bc7d9c1d82f6f
SHA512 08540d9a0a8dcfba0f62180c0c47c6b92a6648ccfb89cc34869344055d064f89898754a8bee16488fa3d74832bc05141e66277a812f3501a8323af97c7f2ff32
TLSH
T183412A98B6F91148B3B7BE56AFF6996E947B78732E07D45E10010E4F0962A04C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\prefs.json
Size 19B
SHA256 e03e9d262ca3b7d19e37c3a69c7d8b46bd3f5542aa555a17d864071c28257b2c
MD5 aa2d0c0c72bb528cf4168ea91c1c9a56
SHA1 67be5a0c29b13b92dd86ba935f605c4ba7eea2cc
SHA512 6bdb9a72b73f11f7627e6fca0ee1d417201b038cb255d445dd29e5f27de08e99a6c4729c4c893ffe97e4bc1835532879c47cceaa051f07b3cdad06ad17b2d5e7
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
Size 51B
SHA256 69ebb26b173552549f4a236eed8303ec3220a621c7d9354b121303966c7c00a8
MD5 b88e39442770716d5db8a76c9ed87f36
SHA1 cc660d75528d77c71114862d39f1958803e0e009
SHA512 f8d2c731795fbdd6bc29cd71799f14a85a8c3e9cd4d1ec182f0deaf32825e4b553f1e986e7017abd7a6ae8c9c5ec8b83eb912c859308d14da47c4126fa188921
TLSH
T1CC90040101317071547C470D07071F74435470747017015710FD14514FD0CD41030017
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
Size 216B
SHA256 24a9983bbbe88929259f8665150f5a441a3ebacaaf56333432962ae7c19439a5
MD5 743146e47b3f3033e9495f92d401fb9e
SHA1 914128a7535c2d3e5fb57303f58544c62081284e
SHA512 153e83d599dfef34d971d69fb651e33bb3359089b771790d8a1e8e8765be09182a1f36b9f2cbc73cbc4eff843ed633f0e2c069dfd91990df92abb78168072144
TLSH
T104D022041E3294E3ED184A0B410A8BAC87D234A99125214380EC089D0CD9C8CE91B02F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
Size 639B
SHA256 082f06ae99083ca427dcfa38056a2104699cc9ae2b93a7b3a17ca9a487b60a21
MD5 3269de52a35f72e168c54a605a3e98a0
SHA1 382b0c425a3b206507a1d547629973defcedf0b7
SHA512 0d080460d0a622b643f833aa54533c829be6a5d2897e2bb957cca261495bda7a51c05cc57953b4e94baa6d541f0952bfdc704ea2a351ddbe5d2705fb2359b160
TLSH
T1B1F04C186A37B6ABB8A14A5BC14B622682917474921E3D59C8E41C5E1CDE85CAE0F81F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
Size 464B
SHA256 e8e400d6cca05aee44802f1fc552989abc5bdf1ed404bb7069bd9da68e737a79
MD5 c8db7f51ef342f00959571d6fa153eaf
SHA1 f791eb8b84039ef045df1ecd2023aeb47c33bd78
SHA512 addfe02305a348d74aaa42c86d1dc28abf4c8f9e68558e02494e4f293e2aa5c15df6e5140bb755ba4e7df7ce0a903a713e994c3fb877a02b31fb98d72dd7f4a9
TLSH
T15FF02B1C6A36F5BB69304606C50AB72A47E67474921F3C09C4E81D5E2CDD998DF0F41F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowserUpdater\prefs.json
Size 674B
SHA256 438b7147e5d5061a6e32ce8660249ac00e319e9ec27eae2ae1e1af84c5fb2ea5
MD5 dab9f124b63f808903f165bb2fc5d09c
SHA1 e278c456219a4b1b6cca55d58606c6e7baed3a70
SHA512 0f746d194863ed3ca7cffb82a9a636e6ab229d1883f00adad559d817283a13c59e0730ffcd55176f8ee0475d03b4078eaadc4051e221a30e581230ec4a0c95e1
TLSH
T14901A2197A37B5BBBCB14A4BC14B622682917474821E3C58C4E81C5D1CDE55CEE0F81F
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\dxcompiler.dll
Size 24.4MB
SHA256 fa57b9c5857199b5fa196bff9b5450900bccf6fa33af589db6b71fce07a9044d
MD5 2f3ffe7dd6ce382d5caec93fa311fa15
SHA1 9a63d6f91144d070dc50f97edb65ad32cad918be
SHA512 8e7e5650d687b13545abb3bb61c58c2d5de66d856a20df1f152ee9b981733aa94ccd9dad8761e36aa1ca54a713c8a53557e6cb665bf1e538cf25eb91676d9072
SSDEEP 393216:yikItha4peOJfEPTIaL3DQHDjVa2DIMd131x:yeD0N3DEa2cM5
TLSH
T1D34739122646D49DC099C879C7678B268A2C30E73FA7B9EFC0F451212B79DBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\dxil.dll
Size 1.4MB
SHA256 03eddd08e594dc7cdc0df5b5cc218e6dae1ee7e71491c77dcc625ce0a1c5e594
MD5 42c7eaf5cd67fddfe0a8e5b60f7264cf
SHA1 52377cad9cacfe7a10bfe2ea885dcad59a5b4c08
SHA512 22c8f3d2aafc7b75c1daea8b8df60e2417ad0ca3b98d01422ef9ec28f0eb25da50ea2624ae334a77a8de90fcdffb8c993decc92db342c9e7ff111a6dcfb5ef53
SSDEEP 24576:6Y+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kaw:viTMYxy0Sy66Zh7Sh/cyvS52
TLSH
T13C657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\libEGL.dll
Size 493KB
SHA256 dc45006ac2c8da0572a7439bcfd6e0cb00ea691a7e935ba4911f0d559a3d0902
MD5 74cdd5ac60daa220a4ccff6418bc280a
SHA1 789b2e28de573ebbc1ee97ceefa9c9d716fd03e2
SHA512 333ab0f59a626fe415ed3e0d5b85701a6167f899a3216b53f3cba2322331026f86b09c5663734a4a381928328dfdadf5cddae61ffa4b38066822951ca1009610
SSDEEP 6144:YlcNlxbLtDSBGAzietw/GY+l3bM0h0Lci4iiu61wGvJ+fS3xn:YOSBZ5tmWbM0GLci4Xu61wGvJ7hn
TLSH
T1CFB48D15B2D949A8D07BC138CA438507EB71B8560F65FADF02A0E2792F77BE41A7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\libGLESv2.dll
Size 7.5MB
SHA256 9880cfae7190e8e53186a03f73b6240ade84ed4d435776c56b61f7586c36ec68
MD5 461a921280257d78f889355f05bff356
SHA1 c8d0d20e66ea416a8c3bd72b065ff286841c730b
SHA512 875fe893fe6dfb3ef6ff6f3db5bca749b319311ff23c013145dc2f11c6f3f7129d1d71f55ca701a3047d62ce04c963231d2183f82cc7d641cb7ff020659b4375
SSDEEP 98304:JZjs/Gqv5/G1XliWV9e0+IovbMsb/X2wS:JJ5G0qswVlv9/
TLSH
T191867C13F69280D9C01DD2B89757A223F634B8450764B3CF2A9467163FB6FE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\locales\en-US.pak
Size 495KB
SHA256 a5b038981912ba09deca3f3e4ebe73123cb4d8106c4b25bcf52ed61028d1a106
MD5 2cf33c51f2a479739ac2d3c8642b76d3
SHA1 c7333e9e601e7e5c6c14848cb547fc1300aa7cc1
SHA512 ba2e9f24cd98d2d68c793fa52cddf47732b66c757e5a140cfc71cca2f6ab39f8d7d2fceb20524f524624225cc1c0cb7e951668d3f04635098366de987d97d5fe
SSDEEP 6144:2/rw0p293I5b413zYSHfI6OzWXJKNMf9m1xqRfaY4JqFKN/Slw/:2/UbdlfHfIFMo1xqhw/
TLSH
T1B1B44C1FF744126A069352A27F09A5A2FF32D06CA35112563CBD812C3377B66837B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pulsebrowser_100_percent.pak

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\pulsebrowser_100_percent.pak
Size 717KB
SHA256 1c6eb6485f7ba2d9332b4d104b02210f26aba3f840089d6b3bc2936168ebe030
MD5 ba134e8c59d7c3dcc482effe7b6813b8
SHA1 91f0b5a03ab3e37326c74c6db33fd6f6ed94c6bc
SHA512 aa71d19bb2a43695dcb4fdd30532ea24652ae1d2613a27eb38b9b62178b4430e974b34df8dea135653bd2216fb9830255a4645de9fd94ab9752e01811362f44e
SSDEEP 12288:YsI3H1fJwCBzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnPzm86pYJblIt6kjKQCrC:m3VBbzEEmPL8bTe+gnPzm86qbc6kGQt
TLSH
T12EF412D77774AC7DEE9B1277926501B0FC7716680A82020A179FF8B96927B48D8C93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pulsebrowser_200_percent.pak

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\pulsebrowser_200_percent.pak
Size 1.2MB
SHA256 ad398be8fdfdcab845fa0b11ad11d105b856c32bb7b6d6651eed05b7a58ad35f
MD5 9b6b40c7520cb264226411437bc5525c
SHA1 6ffb568510d93fa357975e8d62ec7949224114f5
SHA512 1340ff69ec98477af45b7fb9a4f2f096f7cc0a1e0e40f36c40af02a3de3ce8553f7283ad5894a023847e9033dc21fba14cd7f3309d849cfb481405f53ef58fb5
SSDEEP 24576:33zB09pommibkFR8+mZi5r8BWhQume1RvQt9a6SIQwuSXAkpbaUGQ74:33yomNbkFRJmQ58khQRa1QPVS8uSXAkA
TLSH
T1004512D79370DC7EDD531B77929B40F4FD7A10670AB2100A0A26BD7A39267889AC6783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pulsebrowser_elf.dll

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\pulsebrowser_elf.dll
Size 2.5MB
SHA256 44706f12f52b657393000dfe16a367c839c8344e4b9dd575ec94ab3ae0f0ac2e
MD5 d52b4a1bf95771d508897177d85f47f1
SHA1 3777f42b7fd0023c4a345624fffe2110177a83b6
SHA512 34f99fcdc30c91bc70a4910ebfdea0df2a69d3713a2c014de92042f1fc394bc4c51e5708ecbd034e3d2bc1a28912643d6985e890ea33c8ceccdb17a701fb42d9
SSDEEP 49152:AJLVpDxrK8uD215bH8uVJ3ONpNTMM/vuc7s3J1Fe5f:2pd/DoLHvZ+Jm
TLSH
T15CC56B13F6AA01E8C01DD1789B5B9232EA61BC454B35B6DF0A90B7161F7AFE4673E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\resources.pak
Size 14.8MB
SHA256 f54ea2fa6ca4ca26ddd68afabe4c57993196dd4a2f9180bac7428568a8f7784f
MD5 ad56c927cee2a65d5aa116b16bcdd04d
SHA1 9a9be360837838ccfbb3b78ca4a4a0c842299395
SHA512 4ed5d0f11531c5fd10999702e53a1943bf88fdd835d0a93eb5689c61e9091faa1e2079988467452f3d6e2400016a99e1da9441705bda3d0afe204925ccb5a695
SSDEEP 196608:kWHHcr3GgP0JtigYy1ooLA3dP6PPEYPpVurflXCXVLyffkiquS6GkrFSyzj7WZR5:98r3GcmzAx/ipVuRXCFLyfTQkrQqjx2D
TLSH
T154F60157B324C63FCE2B03764696967F3731864A3F43A3272168D32C1C667F64E99A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\149.0.7827.158\v8_context_snapshot.bin
Size 723KB
SHA256 4b9ce2ef825c0ed4765724b67b237879f34a5653cd76336d68e56231e1faf115
MD5 206b1cc5a20a932da1ca57df70377348
SHA1 ea143176e373c9c9543f161573c60439b30c5124
SHA512 65c3699054d8b4ff6dd4d2ebdd3107bf8f964f9527c85e5dc6c93d179adf5112d3218cc868634fd7d8590c175b285afbd7f7b8dd7ad14ebd3ff9e3582c0b02c4
SSDEEP 6144:LAYpk755xLOt+HPpk7u6LHQie2N6mtgBMgGRrPjKiVm1CMtQZMuV9u:L5qL5682N6OxVqga
TLSH
T1DDF4B772FB0ACB27C865377DCDE68B463934B18D8E86DA077051577C78B93984E1E20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pulsebrowser.exe

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe
Size 3.9MB
SHA256 fe53e6c26f56e89c96828e28ff064267aa74e45a0f75508c60e66c4d864bd121
MD5 c78ad5ec1b1d29f1345cf35d21229e6b
SHA1 ae439bca5906094746cd7b0f7327531d161a34ec
SHA512 a51ac210f7a5ff6c9251c5611e408c064597befe7e712a0bd3f8c567d0d24da545671541fc7ca77a179e3b57f5f13b881a2048e2a51315a5cba80a6158c1552e
SSDEEP 49152:1ra93f+chgw1DdJyVupLJRlGth4KLCvy7kpAKJVAjz0AVqDMHziC4XntgOisIf:pWpMh4Wx6VGLmnisI
TLSH
T145164A13F69E00D9C059D0F44FC69232A976BCC9D72C76DF06B276112AB6AD09FBA311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_MASCULINE.pak

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\Temp\source6056_1591081540\pulsebrowser-bin\149.0.7827.158\Locales\am_MASCULINE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Crashpad\settings.dat
Size 40B
SHA256 ea8066b1687eb6df33abd04e0a2bb477c5031db7444fbd9b1d1f7aa94fef8f4e
MD5 ee86dc9e275340ec7351383f1cbf4e25
SHA1 ba2b5ca700c500982efb3d400a0283b102af52d2
SHA512 58db2368a69c2a34dd2aa0f09058c0a2a337d414eea30597e2b8bdcf0cc151e00d67cbe90beb6cc8513ee4ecb467383e671088b4769a4414172ab22d9b2514fe
MD5 SHA1 SHA512

Submit Download

DefaultConfig

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\DefaultConfig
Size 41B
SHA256 1bcdef2cf575a7565568a4959b7aa7b3c8da88e12d7719e40b1e1a57029b7bd9
MD5 17197109f456d8f7557b6353ba6e8bf3
SHA1 8af89f4c1dda33102ebaa39d8562b1bd455ac2bf
SHA512 59d9328abe4f91a5379cd5d0220010f27e5f0c038c977298be34888c429faa272fd3ebdb45149a93ed61fb715e925c776b97fa3d22774ad91e0c55dc2177dbce
MD5 SHA1 SHA512

Submit Download

11173d36-f496-4898-a8c4-36155aab92a3.tmp

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\11173d36-f496-4898-a8c4-36155aab92a3.tmp
Size 175KB
SHA256 92840ba8edb07741ab94d3ef86858a2814d1fab1a683ab99690a4cf3a7e308c0
MD5 d04eca8aef2d5218f6321acbce7ff7ef
SHA1 310036b6f4abce783184b2d3b4b0f0d26846acb3
SHA512 6424045862ce6ed4f78bacc0c93b3642ae159b2b6b440be6b07e7e53d4bb490416752094299af68793bad93aed8cc32a30b92e91a4f857615250c279664bd766
SSDEEP 1536:o+MTQ7GZ/qtof9//0bwLI1Sfi9+bpS9x60EVu4b/TlFwzhB2KQ7RRiq6HXuYl5rx:o+MTEGNqQ/gzXtRGlLyzS21
TLSH
T1A00495968F1E40CFD1E665F02FD5D042457FBAEEDB8E321201FB62A8A4ED684C8D7581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Extensions\ddomlcjnbfakinihjhdnabiodnikomhm\2.6_0\background.js
Size 10KB
SHA256 84a409a1a6d56405e0f32e26b0c464fe27ad0aa75a39e896201503e6b0b944b3
MD5 d0fe1ce44bdd1e5f7f1e882f9466a656
SHA1 e58de282d8d375af2a01cc70ca1f9c418985363c
SHA512 4fbccb5a9dc3e46d2d136e1201fd012cfa28611a16a282ac4e37f36ef5c4018450ccd7e63dab94748d36f50ea5aed6d85bc0a012a51c97f643f68e834f3573d5
SSDEEP 192:/CdirSdfTk0gsT/PrCcBj7g+JKIUbvrf2mNgZIl3Z9RoGVmXLAvEmj2MgIC9bPMO:/C2aLk0gK/PrlBj7g+kIUjrufG1Z3wX7
TLSH
T1A7324E556D430ACA9A66C2FF141FB0C78E6FA544D009DCB3A922E756CCAA7D381D31F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo_48.png

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Extensions\ddomlcjnbfakinihjhdnabiodnikomhm\2.6_0\logo_48.png
Size 2KB
SHA256 9089cc13d35a4b04abaae2ab915f3a507e27e6290b46043af2c0f38835013e48
MD5 40eb46a9efc7f53cf5ed3ceaa8a0fddc
SHA1 44f7737128b0cff811dc5815c3d9a31438f9f8d1
SHA512 e869d6ae5c9bfe2f53fd86322f1c6100efc4861a3cb0e63d6e24ae3fe289ace10de48319ea2083730ca42841502928576b4af4af118d5749a01a51e9f5521dd7
TLSH
T1CB517D93E05429235435307B1B4C14216CBC2CD4E5DD1DDC46CB6FAB1EBD1683E463C4
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1921c35a423aebd54011b4419369ad4088592748e1e66461b4ab7bdb1ec718c9
MD5 8201bc8fe1583a364dc106a77469e40e
SHA1 e628702a23a110a22fcf14ac1e718e0956c8ef8c
SHA512 f9fbc26fea984fce6a9d2b1443d06965e79c15b9b646c6f8298411879874d390eaf3624ee9dcb0907502d3778bb7584df028b43f4342535a347b5bd9ddfffc73
TLSH
T1C031DFF7C3E8856E895152F4AB153E1BCE2A1928431C3C5AC8D8AF5FA7E3871D10058F
MD5 SHA1 SHA512 TLSH

Submit Download

d4362f24-a662-4891-b194-d6e43c8a4e16.tmp

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Network\d4362f24-a662-4891-b194-d6e43c8a4e16.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Preferences
Size 10KB
SHA256 06f958c564547e59884499b09f23ae0048ff1dba1c4bd23602e17398dfbed8b1
MD5 e8be8128b93bf28dcc8cdc0bce160f0f
SHA1 32f17bc831b2a2322e3c732c9c07c556bcbf0124
SHA512 c1f8e4f9e188aa9866ec509841d6a65f3f74008fc45d25bc764509ae809d1155b9d4c8ea415a78e3c222acb864ae0e607c600c1cef4e9ef1d939edecf415766f
SSDEEP 192:zR3RjIv7wpg9mHcb+WNOsw58CloyIsn2agACC:zR3RYB8gS7OA/
TLSH
T1D122B42EAA11657F9CC7D21DFA25BB52E7F5203129902D48EBFC892C15E7ECC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Preferences
Size 10KB
SHA256 f619ca782d99e209f9c717067e15eee8ca0e1b856a1525be5a12fe07f1b887b8
MD5 e377150b85256d2ea0efe0c0067ba1c7
SHA1 a6a6cfb9426550522c6558d91e5341924ed883c7
SHA512 aef3872e3bc92571aa4a8259da0aff877d4f7554af27583baa7b023c0d5da29a466d77936fabce6b20760043115209c8cdd47351c7459207700603d91144c68d
SSDEEP 192:zR3RjIv7wNg9mHcb+WNOsw512loyIsn2agACC:zR3RYL8gSQOA/
TLSH
T15422C52EAA21A57F6CC7D21DFA25B742E7F5102135902D48EBFC892C15E7ECC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50a30e89-859b-4540-bd66-9970e93ab7b3.tmp

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\50a30e89-859b-4540-bd66-9970e93ab7b3.tmp
Size 72B
SHA256 924846f681740b5ceabd5acf5d487189757259839fd4ed5a15290f4c915edcb5
MD5 6f083d4fd9866016d67a7231343ebcc8
SHA1 a71589083c42774f22ebe798a37043670fc702b8
SHA512 4b7014a9ca0384c4ad6feda84ff40334a852832808efe0f3443a0ef6610d2572687518bf7a275cffe49500a78ec2ec08ab3b7fd5d21f1ff3b52908eed48a1f92
TLSH
T1AAA0021106518290C20142F12852C3889300BA798200072776D40357AE614504951149
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 11d63af7e935438125cf3a634d23a10b28e227ab8bc5c6a6ecff4844b077511f
MD5 79eb3f7c8a2013fc783e82ad4e530746
SHA1 f8068b82c7cf987da7eac85a05d76e180f1d79bf
SHA512 9f253a0a3c0255916dea58f6f0c29aca197e8f92097670d8d8d531c7e56f2d8c807364004a1cbc0d74df34a9e374d8bd06d3ca6ca2f9d9a012b00c04b760a784
TLSH
T161A00225018412D1D01102B2388571846392A9355A1127B1829102A9EC902507115440
MD5 SHA1 SHA512 TLSH

Submit Download

c91c7c19-4acb-4177-b9ce-37b7105fef02.tmp

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Default\c91c7c19-4acb-4177-b9ce-37b7105fef02.tmp
Size 9KB
SHA256 d7500da3803da950a4437a4990a232100b47f26596b9c6b29a62145b48bfadc2
MD5 f9f993a8671647a99086235932852d41
SHA1 8de682ab83c3e424edaa521c3eefcdcdc70b38c0
SHA512 85acf1177e6913e3bc58ed239c786b194359d337fc41731adef67c26961a4d7f7770b61151306abda8e02db268e21edf60a9b9a7a9f13e1efd300bc1c9490ddd
SSDEEP 192:zRKRjOv7wNg9mHcb+WNOsw5uLloyIsn2agAEC:zRKR+L8gSiOAt
TLSH
T14322B42EAA21A57F5CC7D22DFA25B752E7F6102135942D48EBFC882C15E7ECC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Local State
Size 3KB
SHA256 9a06866d6f487f334781a1141e6932ec0decca57ee5e6763be281f9ba096e2af
MD5 596d1c7312117ccc44e81cec0b6fa562
SHA1 48322df99e07f631a28b0abfef5075f022baac58
SHA512 5dcf45a8be58be4803e7886d942a14496e3c7ae4ac240f062c2a14d51a58e1681790835534c4107dcd00c6402e10d4b66c8ba7e9e41af401d180222bc83167bd
TLSH
T13361C971B85999B75C73C189F4027D43DB681066A651BE88E5ED4B1C01F79FC1303923
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\Local State
Size 6KB
SHA256 71f65db2bd236bf80a5d75978a858be7e2bfcd3384de4dba8daeb1845d4d9e11
MD5 a06c9c4999c8c784a826f9a6df762e24
SHA1 f886415b3dfba36b0a8b6a7b35c98b03bc978aec
SHA512 5ada991099255eed0617a213b6214822ce2f9ca540e866a3d2cc0e1cead86ac551114b1fa74c2fa045abb050fc53867cee601e54aa48479bf1821cd03ee8ca03
SSDEEP 96:su0bJ6JnRfCPtwe3R2otop5O89DpB6jpGgdvssmcRKwJ+fdCQ2izjduFCd+U4a:s3tBt7h2U2JvFgysPRKwJ+z2iXdzdh
TLSH
T1C6D1A5FEF566CEA7DEE6C3956301B587EA0632544144DAC44CD54D4C80EBAFC350382E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\PlCache\data_0
Size 194B
SHA256 cca6727df086fd60c6475abb959f7261d0a0700ccf735724e17d34fadb25d4a7
MD5 feb65eee7b6738642e68c07da3cf2ec4
SHA1 9e38b5bab723482a921fa5014d89950caa7e2112
SHA512 2c5cbc26efc285c2e1b44861ca70c069871e433cb82a4d02c44ace9cfb873243877d25e599e21264ebcea310578bfb7d95da77d155fb686d7f6da73486765edf
TLSH
T1CDC022B91212064188812229D27A0A686687471C84B230DED205221ED350EEA1406C99
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\PlCache\data_0
Size 194B
SHA256 b334dc3fa83d839aec4b6511cccf94e9f177f28643b6c9f598939aacad6bb610
MD5 f15bd6826cbae701e5e88bea417352ca
SHA1 3777905e36e763aa08b18b5944a8a75041a394f0
SHA512 2b9a4d6497e3c9e138af9de7a0e20464b98077dc868cb160fa08aba0dafd6604816a2f869f9f47226751e92e571c0f71ef9512aa659fe30f3f1710eec87f9e54
TLSH
T18FC0220000340E8A9E2F8A04C489AC2EDA622AEE01AE98C075A2300C29CB6106432DEA
MD5 SHA1 SHA512 TLSH

Submit Download

ae15ff42-df91-4c43-b7a0-c34c73e7d404.tmp

Path C:\Users\Admin\AppData\Local\PulseSoftware\PulseBrowser\User Data\ae15ff42-df91-4c43-b7a0-c34c73e7d404.tmp
Size 1KB
SHA256 19ce733bf82e2223237aaddd642681e9f7b4817f59c687da029584ade794daa5
MD5 0beff65733820cbe17ded71012a00e5b
SHA1 8b878920b61a6f8d2634d995258d5a0671abb590
SHA512 05fd3f3ea3be387346b182baddaf7428406a4e6c7d4a73037b1b3d9494cd8c265f84407d4d9978aab7bd7991b62e24edcb6621b0ac296482123b0d5e3771e0e9
TLSH
T1E71182F3E80866B28C50D69DB051A8835E24203283692B48A6CE062841F79B88F03C35
MD5 SHA1 SHA512 TLSH

Submit Download

logo_48.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6464_1797330131\CRX_INSTALL\logo_48.png
Size 1KB
SHA256 b1aabc9cfa8f04287b6133dddc0a5a1571bd5e0f5e79cbc03a34b62dd00e2b79
MD5 adb079893903d9999655330053594acf
SHA1 c805827dff810aec9b664e042aed02ca437349b0
SHA512 f2375fcf1956f8c5521d481e6439fef86d06924a3fa4b1b9964ceb566f2a9c5c2eb31bb6e733399ec77d35cd61620f2a2059190f50b4f1f60a652287af1b7a53
TLSH
T1AB1186CFE770646D928F0232F0A8C4BEB1B92187122B0CB513D796786037644AAB1F09
MD5 SHA1 SHA512 TLSH

Submit Download

ddomlcjnbfakinihjhdnabiodnikomhm.crx

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6464_1797330131\ddomlcjnbfakinihjhdnabiodnikomhm.crx
Size 726KB
SHA256 82ed295c5c16ec59b02859e52ec1fb7649019ec98a18653665ea9817001fa4b7
MD5 da5c9f295950a823a75982dc583ee287
SHA1 c4e9fbad9acdad0746b09f3e06ce02fecd72fd91
SHA512 74c71475b4b17a2752c014e75a10b6863ad1705191ff20703dd9c2213d2f8621cdcf95bdc0291d1e329eb6324fd33f677d4c3dd37ac9f1f286d3614490354f3c
SSDEEP 12288:HpjWUYbtsLDTAl6SNBWO8QuaiAS72qluFhkicCOx8Epu/Ft5oV4THUoO:NqbtsU5NBWO8O3SqFnTcCOx8eKtOqLU1
TLSH
T1B3F42391D0860CB5E458E9FB7B78B306D77863DD06D2353D817BB668AC32B88C651BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6776-1328-0x0000016181ED0000-0x000001618265E000-memory.dmp

Download

memory/6776-1389-0x0000016181ED0000-0x000001618265E000-memory.dmp

Download

memory/7104-918-0x00007FF85A830000-0x00007FF85A831000-memory.dmp

Download

memory/7104-919-0x00007FF85A550000-0x00007FF85A551000-memory.dmp

Download