a9af8b7f30369172fbc68daab97ecac167917a4b77d2286872b7cad80623041d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pulse.exe
Size 40.1MB
Sample261017-hf1cnaythy
SHA256 a9af8b7f30369172fbc68daab97ecac167917a4b77d2286872b7cad80623041d
MD5 1040e60ea38f02453c2211a313fb5bce
SHA1 59e2972a9fd525f0bbb273ae9e5eea69e1f5b720
SHA512 4e0c82d121bdd4372847bf56c7d22c45b6977587c3237c15b42f25c63d2ca5961f8423be4b24fbc3285145019372365916d0d6817cd85baf8a89a901273001f8
SSDEEP 393216:xyx6XT7IImutHmCtlbNelBxeQR8vfhphg+qxsHqgEX:sx6XT7IImmHmCfspYphrqZ
TLSH
T1A59729117A6B987DD586C8B0C34B8A735F2130DB0A36B9BF448442393F79BF46B29719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pulse.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2364	powercfg.exe
3904	powercfg.exe
4500	powercfg.exe
3220	powercfg.exe
4888	powercfg.exe
1088	powercfg.exe
5204	powercfg.exe
4688	powercfg.exe
3396	powercfg.exe
2684	powercfg.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 6 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
5888	powershell.exe
1048	powershell.exe
3220	wmic.exe
1300	powershell.exe
4484	powershell.exe
2908	wmic.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2760	tasklist.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_645592449\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_2069547369\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_2069547369\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_645592449\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_645592449\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\english_wikipedia.txt	msedgewebview2.exe

Queries registry keys for unique system GUIDs 1 TTPs 2 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
5476	reg.exe
2172	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6068	powershell.exe
2540	powershell.exe
3548	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2100	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 36 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	pulse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	pulse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5368	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

T1112

pid	Process
4628	reg.exe
2864	reg.exe
4236	reg.exe
3504	reg.exe
3536	reg.exe
4132	reg.exe
5772	reg.exe
4732	reg.exe
1400	reg.exe
4680	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4712	wmic.exe
4712	wmic.exe
4712	wmic.exe
4712	wmic.exe
2692	wmic.exe
2692	wmic.exe
2692	wmic.exe
2692	wmic.exe
2880	wmic.exe
2880	wmic.exe
2880	wmic.exe
2880	wmic.exe
5368	wmic.exe
5368	wmic.exe
5368	wmic.exe
5368	wmic.exe
4880	wmic.exe
4880	wmic.exe
4880	wmic.exe
4880	wmic.exe
3224	wmic.exe
3224	wmic.exe
3224	wmic.exe
3224	wmic.exe
5876	pulse.exe
5876	pulse.exe
4464	wmic.exe
4464	wmic.exe
4464	wmic.exe
4464	wmic.exe
4580	wmic.exe
4580	wmic.exe
4580	wmic.exe
4580	wmic.exe
2504	wmic.exe
2504	wmic.exe
2504	wmic.exe
2504	wmic.exe
4484	powershell.exe
4484	powershell.exe
4484	powershell.exe
5876	pulse.exe
2908	wmic.exe
2908	wmic.exe
2908	wmic.exe
2908	wmic.exe
5888	powershell.exe
5888	powershell.exe
3156	wmic.exe
3156	wmic.exe
3156	wmic.exe
3156	wmic.exe
5888	powershell.exe
4764	wmic.exe
4764	wmic.exe
4764	wmic.exe
4764	wmic.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
472	wmic.exe
472	wmic.exe
472	wmic.exe
472	wmic.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1952	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4712	wmic.exe
Token: SeSecurityPrivilege	4712	wmic.exe
Token: SeTakeOwnershipPrivilege	4712	wmic.exe
Token: SeLoadDriverPrivilege	4712	wmic.exe
Token: SeSystemProfilePrivilege	4712	wmic.exe
Token: SeSystemtimePrivilege	4712	wmic.exe
Token: SeProfSingleProcessPrivilege	4712	wmic.exe
Token: SeIncBasePriorityPrivilege	4712	wmic.exe
Token: SeCreatePagefilePrivilege	4712	wmic.exe
Token: SeBackupPrivilege	4712	wmic.exe
Token: SeRestorePrivilege	4712	wmic.exe
Token: SeShutdownPrivilege	4712	wmic.exe
Token: SeDebugPrivilege	4712	wmic.exe
Token: SeSystemEnvironmentPrivilege	4712	wmic.exe
Token: SeRemoteShutdownPrivilege	4712	wmic.exe
Token: SeUndockPrivilege	4712	wmic.exe
Token: SeManageVolumePrivilege	4712	wmic.exe
Token: 33	4712	wmic.exe
Token: 34	4712	wmic.exe
Token: 35	4712	wmic.exe
Token: 36	4712	wmic.exe
Token: SeIncreaseQuotaPrivilege	4712	wmic.exe
Token: SeSecurityPrivilege	4712	wmic.exe
Token: SeTakeOwnershipPrivilege	4712	wmic.exe
Token: SeLoadDriverPrivilege	4712	wmic.exe
Token: SeSystemProfilePrivilege	4712	wmic.exe
Token: SeSystemtimePrivilege	4712	wmic.exe
Token: SeProfSingleProcessPrivilege	4712	wmic.exe
Token: SeIncBasePriorityPrivilege	4712	wmic.exe
Token: SeCreatePagefilePrivilege	4712	wmic.exe
Token: SeBackupPrivilege	4712	wmic.exe
Token: SeRestorePrivilege	4712	wmic.exe
Token: SeShutdownPrivilege	4712	wmic.exe
Token: SeDebugPrivilege	4712	wmic.exe
Token: SeSystemEnvironmentPrivilege	4712	wmic.exe
Token: SeRemoteShutdownPrivilege	4712	wmic.exe
Token: SeUndockPrivilege	4712	wmic.exe
Token: SeManageVolumePrivilege	4712	wmic.exe
Token: 33	4712	wmic.exe
Token: 34	4712	wmic.exe
Token: 35	4712	wmic.exe
Token: 36	4712	wmic.exe
Token: SeShutdownPrivilege	1088	powercfg.exe
Token: SeCreatePagefilePrivilege	1088	powercfg.exe
Token: SeShutdownPrivilege	2364	powercfg.exe
Token: SeCreatePagefilePrivilege	2364	powercfg.exe
Token: SeShutdownPrivilege	3904	powercfg.exe
Token: SeCreatePagefilePrivilege	3904	powercfg.exe
Token: SeShutdownPrivilege	4500	powercfg.exe
Token: SeCreatePagefilePrivilege	4500	powercfg.exe
Token: SeShutdownPrivilege	3220	powercfg.exe
Token: SeCreatePagefilePrivilege	3220	powercfg.exe
Token: SeShutdownPrivilege	5204	powercfg.exe
Token: SeCreatePagefilePrivilege	5204	powercfg.exe
Token: SeShutdownPrivilege	4688	powercfg.exe
Token: SeCreatePagefilePrivilege	4688	powercfg.exe
Token: SeShutdownPrivilege	3396	powercfg.exe
Token: SeCreatePagefilePrivilege	3396	powercfg.exe
Token: SeDebugPrivilege	2760	tasklist.exe
Token: SeShutdownPrivilege	2684	powercfg.exe
Token: SeCreatePagefilePrivilege	2684	powercfg.exe
Token: SeIncBasePriorityPrivilege	5876	pulse.exe
Token: SeIncreaseQuotaPrivilege	2692	wmic.exe
Token: SeSecurityPrivilege	2692	wmic.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5876	pulse.exe
5876	pulse.exe
5876	pulse.exe
5876	pulse.exe
5876	pulse.exe
5876	pulse.exe
5876	pulse.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5876	pulse.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5876 wrote to memory of 4712	5876	pulse.exe	90
PID 5876 wrote to memory of 5476	5876	pulse.exe	93
PID 5876 wrote to memory of 3452	5876	pulse.exe	95
PID 5876 wrote to memory of 3352	5876	pulse.exe	97
PID 5876 wrote to memory of 3184	5876	pulse.exe	99
PID 5876 wrote to memory of 2588	5876	pulse.exe	101
PID 5876 wrote to memory of 4628	5876	pulse.exe	103
PID 5876 wrote to memory of 2864	5876	pulse.exe	105
PID 5876 wrote to memory of 4236	5876	pulse.exe	107
PID 5876 wrote to memory of 1088	5876	pulse.exe	109
PID 5876 wrote to memory of 2364	5876	pulse.exe	111
PID 5876 wrote to memory of 3904	5876	pulse.exe	113
PID 5876 wrote to memory of 4500	5876	pulse.exe	115
PID 5876 wrote to memory of 3220	5876	pulse.exe	117
PID 5876 wrote to memory of 5204	5876	pulse.exe	119
PID 5876 wrote to memory of 4688	5876	pulse.exe	121
PID 5876 wrote to memory of 3396	5876	pulse.exe	123
PID 5876 wrote to memory of 2760	5876	pulse.exe	125
PID 5876 wrote to memory of 2684	5876	pulse.exe	128
PID 5876 wrote to memory of 1952	5876	pulse.exe	130
PID 1952 wrote to memory of 2412	1952	msedgewebview2.exe	131
PID 1952 wrote to memory of 3832	1952	msedgewebview2.exe	132
PID 1952 wrote to memory of 3832	1952	msedgewebview2.exe	132
PID 1952 wrote to memory of 3832	1952	msedgewebview2.exe	132
PID 1952 wrote to memory of 3832	1952	msedgewebview2.exe	132
PID 1952 wrote to memory of 3988	1952	msedgewebview2.exe	133
PID 1952 wrote to memory of 5504	1952	msedgewebview2.exe	134
PID 1952 wrote to memory of 5504	1952	msedgewebview2.exe	134
PID 1952 wrote to memory of 5504	1952	msedgewebview2.exe	134
PID 1952 wrote to memory of 2644	1952	msedgewebview2.exe	135
PID 1952 wrote to memory of 2644	1952	msedgewebview2.exe	135
PID 1952 wrote to memory of 2644	1952	msedgewebview2.exe	135
PID 1952 wrote to memory of 2644	1952	msedgewebview2.exe	135
PID 1952 wrote to memory of 2644	1952	msedgewebview2.exe	135
PID 5876 wrote to memory of 2880	5876	pulse.exe	233
PID 5876 wrote to memory of 2692	5876	pulse.exe	137
PID 5876 wrote to memory of 2172	5876	pulse.exe	208
PID 5876 wrote to memory of 5368	5876	pulse.exe	166
PID 5876 wrote to memory of 4888	5876	pulse.exe	144
PID 5876 wrote to memory of 3504	5876	pulse.exe	146
PID 5876 wrote to memory of 4880	5876	pulse.exe	148
PID 5876 wrote to memory of 3224	5876	pulse.exe	150
PID 5876 wrote to memory of 4464	5876	pulse.exe	152
PID 5876 wrote to memory of 4580	5876	pulse.exe	154
PID 5876 wrote to memory of 2504	5876	pulse.exe	156
PID 5876 wrote to memory of 4484	5876	pulse.exe	159
PID 5876 wrote to memory of 4732	5876	pulse.exe	163
PID 5876 wrote to memory of 2908	5876	pulse.exe	165
PID 5876 wrote to memory of 2688	5876	pulse.exe	167
PID 5876 wrote to memory of 3248	5876	pulse.exe	169
PID 5876 wrote to memory of 4672	5876	pulse.exe	202
PID 5876 wrote to memory of 5888	5876	pulse.exe	232
PID 5876 wrote to memory of 692	5876	pulse.exe	175
PID 5876 wrote to memory of 3536	5876	pulse.exe	177
PID 5876 wrote to memory of 3156	5876	pulse.exe	179
PID 5876 wrote to memory of 856	5876	pulse.exe	181
PID 5876 wrote to memory of 1368	5876	pulse.exe	183
PID 5876 wrote to memory of 2576	5876	pulse.exe	185
PID 5876 wrote to memory of 1088	5876	pulse.exe	215
PID 5876 wrote to memory of 4764	5876	pulse.exe	188
PID 5876 wrote to memory of 4600	5876	pulse.exe	191
PID 5876 wrote to memory of 2392	5876	pulse.exe	193
PID 5876 wrote to memory of 1048	5876	pulse.exe	195
PID 5876 wrote to memory of 5992	5876	pulse.exe	241

C:\Users\Admin\AppData\Local\Temp\pulse.exe
"C:\Users\Admin\AppData\Local\Temp\pulse.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get name /value
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Queries registry keys for unique system GUIDs
  PID:5476
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v DisableAutoExclusions /t REG_DWORD /d 0 /f
  2⤵
  PID:3452
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Temp /t REG_DWORD /d 0 /f
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Temp\pulse.exe /t REG_DWORD /d 0 /f
  2⤵
  PID:3184
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\D3DSCache /t REG_DWORD /d 0 /f
  2⤵
  PID:2588
- C:\Windows\system32\reg.exe
  "reg" query HKCU\System\GameConfigStore /v GameDVR_FSEBehaviorMode
  2⤵
  - Modifies registry key
  PID:4628
- C:\Windows\system32\reg.exe
  "reg" query HKCU\System\GameConfigStore /v GameDVR_FSEBehaviorMode
  2⤵
  - Modifies registry key
  PID:2864
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\TCPIP\Parameters /v DisableTaskOffload
  2⤵
  - Modifies registry key
  PID:4236
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 be337238-0d82-4146-a960-4f3749d470c7 -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 893dee8e-2bef-41e0-89c6-b55d0929964c -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 bc5038f7-23e0-4960-96da-33abaf5935ec -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3904
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 36687f9e-e3a5-4dbf-b1dc-15eb381c6863 -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 0cc5b647-c1df-4637-891a-dec35c318583 -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3220
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 45bcc044-d885-43e2-8605-ee0ec6e96b59 -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5204
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 465e1f50-b610-473a-ab58-00d1077dc418 -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\system32\powercfg.exe
  "powercfg" /attributes 54533251-82be-4824-96c1-47b60b740d00 93b8b6dc-0698-4d1c-9ee4-0644e900c85d -ATTRIB_HIDE
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3396
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq PULSE.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\system32\powercfg.exe
  "powercfg" /list
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-dev-tools --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5876.936.4614207707801342236 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView /prefetch:4 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc958c5fd8,0x7ffc958c5fe4,0x7ffc958c5ff0
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1760,i,2829748818317950966,4758861261161873505,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=1760,i,2829748818317950966,4758861261161873505,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2080 --field-trial-handle=1760,i,2829748818317950966,4758861261161873505,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1760,i,2829748818317950966,4758861261161873505,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890 /prefetch:1
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=1760,i,2829748818317950966,4758861261161873505,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4200 --field-trial-handle=1760,i,2829748818317950966,4758861261161873505,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4172 --field-trial-handle=1760,i,2829748818317950966,4758861261161873505,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView" --webview-exe-name=pulse.exe --webview-exe-version=2.72.59 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=824 --field-trial-handle=1760,i,2829748818317950966,4758861261161873505,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:22721bf47f4f2a28e1341df90173977ade008890
    3⤵
    PID:5216
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" memorychip get SMBIOSMemoryType,Speed /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get name /value
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Queries registry keys for unique system GUIDs
  PID:2172
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_videocontroller get name /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Detects videocard installed
  - Suspicious behavior: EnumeratesProcesses
  PID:5368
- C:\Windows\system32\powercfg.exe
  "powercfg" /q SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 45bcc044-d885-43e2-8605-ee0ec6e96b59
  2⤵
  - Power Settings
  PID:4888
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\PULSE /v InstallerLanguage
  2⤵
  - Modifies registry key
  PID:3504
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path Win32_NetworkAdapter where "NetEnabled=TRUE AND PhysicalAdapter=TRUE" get AdapterTypeId,NetConnectionID,InterfaceIndex /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get Name,Manufacturer,NumberOfCores /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path Win32_PerfFormattedData_PerfDisk_LogicalDisk where Name='C:' get DiskReadBytesPerSec,DiskWriteBytesPerSec /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path Win32_NetworkAdapterConfiguration where IPEnabled=TRUE get DefaultIPGateway,InterfaceIndex /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "path win32_videocontroller" get Name /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance win32_videocontroller | ForEach-Object { Write-Output ('Name={0}' -f $_.Name); Write-Output '' }"
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games /s
  2⤵
  - Modifies registry key
  PID:4732
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" baseboard get Manufacturer,Product /format:list
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5368
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Electronic Arts" /s
  2⤵
  PID:2688
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Electronic Arts" /s
  2⤵
  PID:3248
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallPath
  2⤵
  PID:4672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance Win32_BaseBoard | ForEach-Object { Write-Output ('Manufacturer={0}' -f $_.Manufacturer); Write-Output ('Product={0}' -f $_.Product); Write-Output '' }"
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  PID:5888
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallLocation
  2⤵
  PID:692
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v GamePath
  2⤵
  PID:3536
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get Name,Manufacturer,NumberOfCores /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallPath
  2⤵
  PID:856
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallLocation
  2⤵
  PID:1368
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v GamePath
  2⤵
  PID:2576
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallPath
  2⤵
  PID:1088
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "path win32_videocontroller" get Name /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallLocation
  2⤵
  PID:4600
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v GamePath
  2⤵
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance win32_videocontroller | ForEach-Object { Write-Output ('Name={0}' -f $_.Name); Write-Output '' }"
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallPath
  2⤵
  PID:5992
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallLocation
  2⤵
  PID:1316
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v GamePath
  2⤵
  PID:3340
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4672
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" memorychip get SMBIOSMemoryType,ConfiguredClockSpeed,Capacity /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:472
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallPath
  2⤵
  PID:124
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallLocation
  2⤵
  PID:1424
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2172
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v GamePath
  2⤵
  PID:3984
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get Caption /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:6080
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallPath
  2⤵
  PID:6068
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallLocation
  2⤵
  PID:1088
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v GamePath
  2⤵
  PID:5832
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallPath
  2⤵
  PID:4104
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" baseboard get Manufacturer,Product /format:list
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Reads the TCP/IP host and domain name from the registry
  PID:3220
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallLocation
  2⤵
  PID:1348
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v GamePath
  2⤵
  PID:3860
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallPath
  2⤵
  PID:3592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance Win32_BaseBoard | ForEach-Object { Write-Output ('Manufacturer={0}' -f $_.Manufacturer); Write-Output ('Product={0}' -f $_.Product); Write-Output '' }"
  2⤵
  - Uses WMI to collect hardware manufacturer information
  PID:1300
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallLocation
  2⤵
  PID:4308
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5888
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v GamePath
  2⤵
  PID:2880
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" memorychip get SMBIOSMemoryType,ConfiguredClockSpeed,Capacity /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "Get-CimInstance MSAcpi_ThermalZoneTemperature -Namespace root/wmi 2>$null | Select-Object -First 1 -ExpandProperty CurrentTemperature"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6068
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get Caption /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1364
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games /s
  2⤵
  - Modifies registry key
  PID:3536
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Electronic Arts" /s
  2⤵
  PID:1136
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Electronic Arts" /s
  2⤵
  PID:5252
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallPath
  2⤵
  PID:6068
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallLocation
  2⤵
  PID:5300
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v GamePath
  2⤵
  PID:1336
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallPath
  2⤵
  PID:1752
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallLocation
  2⤵
  PID:4980
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v GamePath
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallPath
  2⤵
  PID:3392
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallLocation
  2⤵
  PID:4304
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v GamePath
  2⤵
  PID:2504
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallPath
  2⤵
  PID:4644
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallLocation
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v GamePath
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallPath
  2⤵
  PID:5540
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallLocation
  2⤵
  PID:5764
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v GamePath
  2⤵
  PID:4496
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallPath
  2⤵
  PID:5768
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallLocation
  2⤵
  PID:4860
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v GamePath
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallPath
  2⤵
  PID:1856
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallLocation
  2⤵
  PID:1844
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v GamePath
  2⤵
  PID:5312
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallPath
  2⤵
  PID:3224
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallLocation
  2⤵
  PID:4392
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v GamePath
  2⤵
  PID:804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "Get-CimInstance MSAcpi_ThermalZoneTemperature -Namespace root/wmi 2>$null | Select-Object -First 1 -ExpandProperty CurrentTemperature"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2540
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v DriverDesc
  2⤵
  - Modifies registry key
  PID:1400
- C:\Windows\system32\reg.exe
  "reg" query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString
  2⤵
  - Checks processor information in registry
  - Modifies registry key
  PID:4132
- C:\Windows\system32\cmd.exe
  "cmd" /C ver
  2⤵
  - Executes a command shell one-liner
  PID:2100
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games /s
  2⤵
  - Modifies registry key
  PID:5772
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Electronic Arts" /s
  2⤵
  PID:5528
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Electronic Arts" /s
  2⤵
  PID:3564
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallPath
  2⤵
  PID:5632
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallLocation
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v GamePath
  2⤵
  PID:5840
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallPath
  2⤵
  PID:3876
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallLocation
  2⤵
  PID:1772
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v GamePath
  2⤵
  PID:3228
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallPath
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallLocation
  2⤵
  PID:5768
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v GamePath
  2⤵
  PID:3872
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallPath
  2⤵
  PID:1372
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallLocation
  2⤵
  PID:1384
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v GamePath
  2⤵
  PID:4816
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallPath
  2⤵
  PID:1688
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallLocation
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v GamePath
  2⤵
  PID:2712
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallPath
  2⤵
  PID:5140
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallLocation
  2⤵
  PID:4152
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\WOW6432Node\GOG.com\Games /s
  2⤵
  - Modifies registry key
  PID:4680
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v GamePath
  2⤵
  PID:4640
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Electronic Arts" /s
  2⤵
  PID:5988
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Electronic Arts" /s
  2⤵
  PID:1300
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallPath
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallPath
  2⤵
  PID:2388
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallLocation
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v InstallLocation
  2⤵
  PID:4844
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v GamePath
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\World of Warcraft" /v GamePath
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallPath
  2⤵
  PID:4832
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallPath
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallLocation
  2⤵
  PID:2004
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v GamePath
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v InstallLocation
  2⤵
  PID:5764
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Overwatch" /v GamePath
  2⤵
  PID:3724
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallPath
  2⤵
  PID:5768
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v InstallLocation
  2⤵
  PID:1572
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo IV" /v GamePath
  2⤵
  PID:5328
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallPath
  2⤵
  PID:400
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v InstallLocation
  2⤵
  PID:3664
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Diablo III" /v GamePath
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallPath
  2⤵
  PID:912
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v InstallLocation
  2⤵
  PID:6020
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\StarCraft II" /v GamePath
  2⤵
  PID:5760
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallPath
  2⤵
  PID:588
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v InstallLocation
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Hearthstone" /v GamePath
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallPath
  2⤵
  PID:4532
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v InstallLocation
  2⤵
  PID:2276
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Heroes of the Storm" /v GamePath
  2⤵
  PID:5628
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallPath
  2⤵
  PID:1508
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v InstallLocation
  2⤵
  PID:3076
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\WOW6432Node\Blizzard Entertainment\Call of Duty MW" /v GamePath
  2⤵
  PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "Get-CimInstance MSAcpi_ThermalZoneTemperature -Namespace root/wmi 2>$null | Select-Object -First 1 -ExpandProperty CurrentTemperature"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3548

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5992

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1316

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2104

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 64190819af190e360177ef7a72830954969e607cec354999d0e8778b2a1212d1
MD5 633ac5d910e9ee99023dcf648a83fc3a
SHA1 6371962ba07426d3b760f973bdf5d334677e844a
SHA512 2712e723e3b29f9713e1e1de01e779998c0d7b4839b7548e8ed1f94c4aa0e79e9a938c7aefd5ee064623970c35c6838bc0b47bd3eb3b40f89ca751fd30a19055
TLSH
T1FB219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7d5423fab0bc688fe408ae455cf60ad90cd6398b0ebb0c5a535b34f8e429bcb9
MD5 dfea0acb42134448419e78d8a8221a92
SHA1 96596f18f5c130782bf5dd87402489f20b804151
SHA512 52c8f889df7c8183d579ed08e8e0cf86bd7b36589206473fd3b5d949e7bcc2525f2e6d1a6951d114b63bfa4e403e90d9244101644d7ded63c0465c5ea3bede7b
TLSH
T1A7217633F3DC8214C899013A10DDAC1036B687CB40DECF9B6B85E159A42F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5793bb9bf85cbf283ac30efb87dd45ae8d9dce9f268e2f773dfb2d00cde743e7
MD5 88416dbdd7ff051b235f2c5a92914b23
SHA1 5be37b77449cdfd6b88b6145ccb162b18b07cb14
SHA512 74f04f79c665c67cb38fa4977895e88784b0f8ddfe121e96e75a7feabc0848e852aa7a7400fde795642fb466930ed31efd69b2c262756a05e1b8d7bede29a8d0
TLSH
T102219837F3DC8224CCA9003A10DDAD0036B6C7CB40DECF5B6B81E159A42F298DF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d5313eb77845d18327a4684c54fdecae3f97da64f041245bdad17dda8174deba
MD5 1f019c08d7e7a159932a89af2b196d8e
SHA1 cd1bfc5890cfa349253e40a1f4b13d31f12d0f1d
SHA512 f6f12a0aea70757a16e38417f6aab57650702cfe2d7be40612578b84c6a5dcc1cdd3cd6417ebd102c80507db1dbfb641ab3fc4295461aca56445b2c055751258
TLSH
T14A217637B3DC8614C8A9003A10DDAD0036B687CB40DECF5B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ueremjta.0as.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ueremjta.0as.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

36552c0f-a84d-4c9c-b996-055a137ac121.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\36552c0f-a84d-4c9c-b996-055a137ac121.tmp
Size 3KB
SHA256 baa0943fd1aefe645aaa6044c4321c903c02a3da1992482dbb9c8acbafcef94e
MD5 0fb4d6ba2a793ad68a4d6267529ac730
SHA1 ad686b54d528787b7d8d79994d4fc3bd18936aa3
SHA512 4e054f3a5d1910265461f63f207a3503d0f58c819088641d5ab79cae65c12860c49f4e4c809bb05a821134242df6ae6e3089382a85a699405bf7f5d8aca48b1f
TLSH
T1B3617537AE74AA375EF29A05B9863B17ABA55023E5923F94D6EC0F1C11D73C82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8f3eb425858258ee5b18113378694ca822022c7a0a1068fea7f2c0f7e8b5e8c3
MD5 85daf4baac0a8504efadb9c7c659e4b0
SHA1 b08634097df950d195d651f34adae29981b094bf
SHA512 1330c0bfc1eb46d365bb168f2b7fa14fefa6ca243f3ca2e429551e36c6b0a3bbf54566b3726669b60d0604cc074ad20681947c5935b59a3dffc189d0ccbae185
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c538d7f06a290706d2b330aaeca3250fd2042438ac18d16bb9a8ba5154952e84
MD5 2b5b91daead51a419e5cedda3a895330
SHA1 60b1f53bf5668f8494686d1bd54046cce45b1eee
SHA512 f4042511eaf2378bf08a1e4fb2756b22d04c7e28149e55f30fdf3ef983d0906698dd0cf4725c4263140cacecac856d35b5e46b0b4017fdcdf0ec5192e6c253cc
TLSH
T1B1D0122232414138C42424334422B6490890C54B41558002542CD53E5E440600902443
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0d76422b-a450-497a-a987-410916e49f7b.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\0d76422b-a450-497a-a987-410916e49f7b.tmp
Size 6KB
SHA256 5c83ee1d97c2613ffea4eb5b32c83c7824448f80b3d8ba1db0bbc1948ac7ac65
MD5 5f89ffc74171353c490e03e45cf3ed9e
SHA1 e469d55c7491eb955fd93f7f88f8482febaafe27
SHA512 c14ba02a1d005c92608886a5cb805fbb3898fd5d3c9cb5361e1054e4fa7954043b3bafa670fdf038f42df9b6253716096059b2d1bcde2bd1dc7c53e39d098c61
SSDEEP 96:sts/dM+lZKs7b91Gk6o5h16Z0Gls7/x+6MhmuecJG6oCV1eje8K+gG6J28XM1C7K:stgOYt/GFonGlsV+FdG6oCVQjIk6JG6K
TLSH
T14FD1B6015F24797B4CC6E609FA69BB13E2FA5072B1D11D58EBFC862C18DA6CC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

778d8b43-19f9-4b2b-9026-cc648887fc28.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\778d8b43-19f9-4b2b-9026-cc648887fc28.tmp
Size 6KB
SHA256 ac24ec9f8826add9514ebf828cf7102461d79993813904f01963d5d677676417
MD5 4569ad7d73722efc81b2bf004e8d312b
SHA1 f364ccbbe01ba5383a098d4a58b4792614051284
SHA512 5e93f5a723adfdf10506e6a68249401ea14d5a3e2fcabd673a99d392018194654550e1538490d375a27685e11a0550452cb4a3376f976a2c243a20a39318f90e
SSDEEP 96:sts/dM+lZRGs7b91Gk6o5h16Z0Gls7/x+6MhmuecJG6oCV1eje8K+gG6P28XM1CO:stgOY3/GFonGlsV+FdG6oCVQjIk6PG6K
TLSH
T1A3D1B6025E24797B4CC7E609FA69BB13E2F55072B1D11E58EBFC852C08DA6DC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 432B
SHA256 4cba13442c26a5e8b4532eda72b021f34d25b7b6130727c35243994682dc2474
MD5 c5582d281b711b419a9cbd3c22e752cb
SHA1 bec458ef7aa6e6e8f9132fe3b3ebf5b81114ca19
SHA512 aa55efd975d3a0087359a433c0aa6780d223acd11e71d639291ef2f617f0face6e50f57bc26c6a30b9e014274234bbaed9009c9c9cb058eeb5770672c58c4fe2
TLSH
T1C8E0C7ED25306202C309F23208C7220AF9B90C2F05A30C1304C8B97D88A83C2B4B3E02
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7f775658cd31ce92cac117ff4ec199796587c503f246d4ea745ee463eddd42eb
MD5 c139d62ef1dabe58dbe9c575ef00a038
SHA1 692af2639ebefaf74de9dd355559bef7e91f611e
SHA512 38c68dc5c1a9eebe96105cdfc5a350e35aeea7f905c6db7a992369feda74db79ed0f80aed9579c3b77a3b10880e174a297736ffd149b00c1ea62e1b01700b902
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

408ff137-a5b8-473c-80e9-370a3e40b1cc.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\408ff137-a5b8-473c-80e9-370a3e40b1cc.tmp
Size 856B
SHA256 9e236c71f440026fc68125192ea9277b638ef44525abe3e401c62b6b9bf7c516
MD5 cfe02421b1df641bed9bc129d12b1477
SHA1 6d344bfc139133843c986247afa2330f2a6ae6a6
SHA512 3b52c3cc170222224fe3804a3e8a5d43bd48ca9a5c80ee8345747a444331a8570f6d3e8dd6fd66d840f7fd3fa286cac0887a74fff8e2fa3437b4425c6756c6a0
TLSH
T1FC11485351FA946B102DC9775E16BC061A7AA97295C2B4F9DFE383BC28804B75203066
MD5 SHA1 SHA512 TLSH

Submit Download

44aa6552-5e14-4844-8737-0d4b7785b7ff.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\44aa6552-5e14-4844-8737-0d4b7785b7ff.tmp
Size 850B
SHA256 509d74d36eea46e9a2e229813e6c711b3438c27f04bf46df4618d0e5ba1c6177
MD5 03395d86a8572f5292cd72f4699b74c4
SHA1 4d626230bb3ae980d5aa1d66048e30f5d03f32a0
SHA512 49b6ec16b088bee50d5eb2b4c9c2497a70b7ec1d331ab1b442d19a738780684764d37546368fddfecc9f3d03f977560887c02cbc59faaab3b9cc3cb1f9451b02
TLSH
T11A016F5342FA946B201E88BB0E15BC05597FE8B291C1B4F9DED7836C64904F79607166
MD5 SHA1 SHA512 TLSH

Submit Download

60a0c10b-dbd9-4478-bde8-0a84b844c24c.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\60a0c10b-dbd9-4478-bde8-0a84b844c24c.tmp
Size 2KB
SHA256 fff60bce20b6cf97890271f26d058a8c17a2bcfe5d51f6485e1c0ca70ee6ce83
MD5 ac98ae088b754bed3bfdb9e821d63cb9
SHA1 32d18e250368d99a7ccb333af100836cfb16af29
SHA512 fbd0473cee2108d434eabbc831ca1a581c985fde90402d9111a461b58c169fa71bfff7cbe652d7602675d52f90405bb76d9d17a52b1806b28f201e0069df78bb
TLSH
T1A1418E92C2E4C72D8A517BF42B347527C92E091D91183D2A8EDBDFEA6BD24B1E21150E
MD5 SHA1 SHA512 TLSH

Submit Download

719af729-dab4-4bb9-bdc3-395e10fd9096.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\719af729-dab4-4bb9-bdc3-395e10fd9096.tmp
Size 856B
SHA256 22358fc47787ddd41e351253c9beb58a77e3203be655faadc350a8852d1b5599
MD5 13517ff32adff0f6b980436166290c18
SHA1 a864d4038441ad3b5f05ef4ca45f0be3f2c9e43e
SHA512 5bf507c792e35f1da87b8ba093cde4cd835bd70e48d1ce8c0a44a3e7037305075a642c8657f22a3cd5b09ae41507fed10003fefa6242b1812cb700941176bcaa
TLSH
T17411485361FBA47B206DC9771E55BC0209BBA8B2D1C270F9DEE3836D24804FB9647562
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 6f4e63925af8a876a3518179aec001f4ddcfcfbc35f469a1c3320ee410845c67
MD5 8126a258bba9b81bc020fb3d39331607
SHA1 8de1d1b802905418042fd481ea57fcbf71171276
SHA512 2844e22952a938a5fc83ebb18f81e5f0bc1bcf5248c4c5fcefa91be256ba4813d259e497d21c4ea4a17d53caef2060ff6b4abfcf6261e3f1ef1c7c534aab4d12
TLSH
T10411A65394FEA82F102EC9770D14BC061A7AAD7286C270F8CFE7C3BC28804B76607066
MD5 SHA1 SHA512 TLSH

Submit Download

cba3f124-ce6a-41a5-97d8-86c7cf7d4e11.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Network\cba3f124-ce6a-41a5-97d8-86c7cf7d4e11.tmp
Size 856B
SHA256 3853d6b12d2385ab60f3493f25476a943b6ff424abbe68b4cd010ac795725dc9
MD5 e7405bdcaccbc22a1021fb3d84cc22bb
SHA1 d53130212d042dcb5e629cfbb9947be513f7be4d
SHA512 0c0da5072048290b54ff9bb77cda1ea6d39f5785266526800f34344e2baa0dc7dcf49e0038e8dc76f92ca4ac1da869003387937ff5b7beb128c50c6a9844af4f
TLSH
T13611485361FB946B206DCC771E55BC060ABAA9B291C270F9DEE3C3BD68804F79203576
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\Local State
Size 1KB
SHA256 616f4b8bbafd5878c9b4ba9b91aa0d587f60dabac952d83fbf2cba6d2350f803
MD5 f776b23770175fda06370bff3e4b34c9
SHA1 18ab69033eb2f3383e145a0fe4d01ad003265cbe
SHA512 330e7a559af2c4fdbe8bb905660e1bfeba7c54d6cedc87ce1f986c29657bf900785dbeedfc4c77ffdaa7a4c7f65f67dc785f29fa02cae1ea49447f60627c1697
TLSH
T1F3217573E9B45732BDD1664671567A139E325057C1014F00A5CD8B1C12E72CD611EC32
MD5 SHA1 SHA512 TLSH

Submit Download

b49a54d7-7f11-48b8-9d37-1507533eb269.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\b49a54d7-7f11-48b8-9d37-1507533eb269.tmp
Size 2KB
SHA256 9752e4f54f2af206777cece400ae6f65c1bedea2a9611fd00cf386e617324e35
MD5 30f52f8f93a19c7ad31269b975fc57fe
SHA1 55f2f1fae9f211a3b3b88bdc77ca09b007ad4669
SHA512 045c5ad2dbd770e1d84ac69c4d89cd5d003e0d6325fac524589fd15838d548e50fccc8491640494cc931d34088ba280260e3bae13c49839adfcc6d5589a8dc3b
TLSH
T19351A733BD64AB3799F25A49BD4A3F23DEB69052E6521F4096DC0B1C01D728C2306C3B
MD5 SHA1 SHA512 TLSH

Submit Download

defd6a38-bc43-4157-bfcf-63aac8895761.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\EBWebView\defd6a38-bc43-4157-bfcf-63aac8895761.tmp
Size 15KB
SHA256 fea042d5f35776235e6c85745741c0dd26f01c1d58b1cd22a69d149f7aca7ca6
MD5 9d148881cd44c11ad11f1b6ad6d58e92
SHA1 07afa184f35091e83d5774cc1442e02864c90a85
SHA512 6a6766e57823309b114f366ee274289c779aec0f2fc3f00b83168ec5af5114a1855efe9a6dc30a3529db8d1d393c85a479df54dfad6bdb5fe9253117e5334e0c
SSDEEP 384:b+OBqImmJvGBLx3NaFMJFXNBS6bwLTIBFg6r/:CcvGtlNngTIZz
TLSH
T1F472AE3A1D752B232CE7C60AFE892757CFB22153C0E16BD4DDEC9F0E11AB184134290A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

last_version.5876.4.tmp

Path C:\Users\Admin\AppData\Local\com.pulse.app\last_version.5876.4.tmp
Size 7B
SHA256 424789b99387b2d9bbb51113a2ae549710e0d3aee3b5490bac03cceebd0a0657
MD5 28564617443c54d781eb6c746dae787a
SHA1 4e67295e2b759783c7fc241a4f2be91d080d49c0
SHA512 37be593cb2d3ccc60fb1a75bbd25979344cf8091ca3a456fa1f3ee4b9eae102955cfead50882a81298c208230911512fc7872fa2a17ebdab732c5aaf930bf8d9
MD5 SHA1 SHA512

Submit Download

pulse.log

Path C:\Users\Admin\AppData\Local\com.pulse.app\pulse.log
Size 692B
SHA256 b6085529ad0859142eaccb03a0fd0bf053de4140348985f346cd0ddcbb280899
MD5 84b12a1ef606d8ef3cfc23f2bb1559b1
SHA1 0349050aa67a393a8e95cd2b1e4396783efaeb83
SHA512 5316a162c6beffa21b749073be18ed25d1f3de7e382405bc75572ee8dcf06a80d6e2b5dff8b1c014f8c0217211be7da45efd540d218513bc16adeac8c28213be
TLSH
T1C1012662B3FEB6B76F9412425CCAF498A3737231A2440A396734AF9400BEF143D6925D
MD5 SHA1 SHA512 TLSH

Submit Download

pulse.log

Path C:\Users\Admin\AppData\Local\com.pulse.app\pulse.log
Size 1KB
SHA256 47e370fdac6589a003dc53d8d79b7a0deeb85b9b535cce9a8e55ec7baf2bbb0d
MD5 89ea19c14deb7c0709d7ebc0ac457ec8
SHA1 e054f46343053d484494403791bb6d9842415cbd
SHA512 8f9a6905fb9cb9b30c7f808f4059ee3f7afef5747da9a14c1a870f85fcf54ce3b3e808ab35506d76bdbe273684defc6c84fed1b38953f909a872ceaaa76f6992
TLSH
T1AE21773273FDA6B72FA5138324CAB455A3B3633242440A793B34AF58006EF043E6916E
MD5 SHA1 SHA512 TLSH

Submit Download

pulse.log

Path C:\Users\Admin\AppData\Local\com.pulse.app\pulse.log
Size 2KB
SHA256 810f2308f50a65034003b970e705336908dbde0507d24b228b8c7454c9e24fda
MD5 95aeaefbcdae7d0e26f3782e5e13d507
SHA1 45578cc8e4a5e20ece066ca4fbfb7d7be1913e9a
SHA512 04b69da52eb9524c6290f4e0478f841d591ca103bedb034550b0e31ce950fcad8e9d9d56ae1d3977f345252abb1b0aedcb1fac0de01005e5db5925780abec35e
TLSH
T1AD51FE6133ED71775BA863A225AAB64257B3333702404D783BB4AF68147DE003E2D6BC
MD5 SHA1 SHA512 TLSH

Submit Download

pulse.log

Path C:\Users\Admin\AppData\Local\com.pulse.app\pulse.log
Size 3KB
SHA256 ac4687c03cb850d5bd4cc1de8da424a44736961e45cb668dab86d5e1d75ce27a
MD5 6f4f6644e07cee8f59686790b51c237b
SHA1 701706ec83c1068c563d7e8b7875a28be7ee1b67
SHA512 2dc8fa50fa03c36b90161c81e14b9650e12601d029d63c2824e21d4cf27029eefa9274d2286a4f0307d3c071ce5a4135a1c7b46dd37116621160b32fe5ece394
TLSH
T1B451ED6133ED71774FA863A221AAB64257B3333602004D783BB4AF68146DE003E2D2BC
MD5 SHA1 SHA512 TLSH

Submit Download

pulse.log

Path C:\Users\Admin\AppData\Local\com.pulse.app\pulse.log
Size 6KB
SHA256 8899f49ae42fdbaea6eeff99e90965c7b1bd6560a1ec80552ebceb7646761c48
MD5 d440a106a0e98c126bd724cc7e197148
SHA1 7229e473c805a3e30284759c6c89f119cb4c9363
SHA512 789a0d6fc5406e5e72568f879e1b270701d107eb7ae539a80c8f34ae1db709e26a43ba84c26ac67c98d26b0d583f92e9becb66eeb38757cfcb0cd17590573961
SSDEEP 96:omlSDFWlWOWlWTWGNcgTShWXZ8eZJ2WMvA/ANyHpSY4sTWlW+ZI/MhB:RiFWlWOWlWTWGagJJ2SY+iSWlWAI/u
TLSH
T1D1D1479133EDB13B4E65677126AEBA474763323B05004DB47FA8BB9414ADF413E2C6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pulse.log

Path C:\Users\Admin\AppData\Local\com.pulse.app\pulse.log
Size 1KB
SHA256 65fb46ebeca3d47e610418416f62f9d7a63b13e5192dc2d98f96e9f4ceb69e10
MD5 2bdf88f80d7538450cee1dcd9a6e6bc6
SHA1 6b596319ba58cfca8942b0b8ab98e1c5437a0a5d
SHA512 e463beb054652ab4bee258cd0b16e2f1018f0cfeff00b7c54537da6f77e007a229f3cbc3ea7f77c6e139c416dcf86d816e35814aa0a566e4be462fe1bf702189
TLSH
T14F31687173FDB2672BA9174324CAB45597B37372434409A92B34AF6C007DF043D691AD
MD5 SHA1 SHA512 TLSH

Submit Download

pulse.log

Path C:\Users\Admin\AppData\Local\com.pulse.app\pulse.log
Size 349B
SHA256 90562f0552c859c0972a55044f2995af8787b7b8a8be7bcfa07d6c6b88eb0d61
MD5 4dfe35843dd7c0bc750332eef5a250dc
SHA1 0e2cd444268d5b9430a34ed43676fefd01c933bf
SHA512 3a9d4b9e2c977559af56939995c9929960ed9a63713629dad1fa925b6f5b702ed15911c09b3f6617e85a4084df37822fcb5ecd128d5a65b55c46df20abd98f90
TLSH
T1C1E0DFA073BEB1BB9BA422024886B884226336319A450A78A320AF60043CF053C2828C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_1814489163\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_2069547369\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1952_645592449\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2280-1100-0x0000026604600000-0x0000026604601000-memory.dmp

Download

memory/2280-1096-0x0000026604600000-0x0000026604601000-memory.dmp

Download

memory/2280-1090-0x0000026604600000-0x0000026604601000-memory.dmp

Download

memory/2280-1098-0x0000026604600000-0x0000026604601000-memory.dmp

Download

memory/2280-1097-0x0000026604600000-0x0000026604601000-memory.dmp

Download

memory/2280-1092-0x0000026604600000-0x0000026604601000-memory.dmp

Download

memory/2280-1101-0x0000026604600000-0x0000026604601000-memory.dmp

Download

memory/2280-1099-0x0000026604600000-0x0000026604601000-memory.dmp

Download

memory/2380-972-0x00007FFCB7EA0000-0x00007FFCB7EA1000-memory.dmp

Download

memory/2380-973-0x00007FFCB7B20000-0x00007FFCB7B21000-memory.dmp

Download

memory/2540-1020-0x0000022C203E0000-0x0000022C20492000-memory.dmp

Download

memory/2644-145-0x00007FFCB7470000-0x00007FFCB7471000-memory.dmp

Download

memory/3832-60-0x00007FFCB7470000-0x00007FFCB7471000-memory.dmp

Download

memory/4484-441-0x00000296F29D0000-0x00000296F29FA000-memory.dmp

Download

memory/4484-442-0x00000296F29D0000-0x00000296F29F4000-memory.dmp

Download

memory/4484-440-0x00000296F2990000-0x00000296F299A000-memory.dmp

Download

memory/4484-431-0x00000296F2C10000-0x00000296F2CC2000-memory.dmp

Download

memory/4484-428-0x00000296F2970000-0x00000296F298E000-memory.dmp

Download

memory/4484-409-0x00000296DA340000-0x00000296DA362000-memory.dmp

Download

memory/5888-551-0x0000022B9EDC0000-0x0000022B9EE72000-memory.dmp

Download