socelars | 03bc61c86383045ec0d07802596d98ec5b869144fb9f41330332058d340183f3

Analysis

max time kernel
160s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8cc1b2dc76454583c3968d96af6d095.exe
Size

1.4MB
MD5

c8cc1b2dc76454583c3968d96af6d095
SHA1

bcd0ca7a524dbf55345baa6a0622acee27136eac
SHA256

03bc61c86383045ec0d07802596d98ec5b869144fb9f41330332058d340183f3
SHA512

c7c99a9f4d953373710f4cc3b80b3f8d36eee86491755437ec2a9648df08a804fc03b4ca769cb5df3751643f1c6c44b0907e73ff1947869dfcf9598368d9f883
SSDEEP

24576:76pYjfuKDGp9FGF3KUK2pdAlLnbYt6GH7LPv1l9oUejlPrLs:+pMRGe/4ebLPv1l2UKlDLs

Score

10^/10

socelars spyware stealer

Malware Config

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	c8cc1b2dc76454583c3968d96af6d095.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js	c8cc1b2dc76454583c3968d96af6d095.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js	c8cc1b2dc76454583c3968d96af6d095.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	c8cc1b2dc76454583c3968d96af6d095.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json	c8cc1b2dc76454583c3968d96af6d095.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html	c8cc1b2dc76454583c3968d96af6d095.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png	c8cc1b2dc76454583c3968d96af6d095.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js	c8cc1b2dc76454583c3968d96af6d095.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js	c8cc1b2dc76454583c3968d96af6d095.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js	c8cc1b2dc76454583c3968d96af6d095.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
640	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133490698437011154"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3680	chrome.exe
3680	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeAssignPrimaryTokenPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeLockMemoryPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeIncreaseQuotaPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeMachineAccountPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeTcbPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeSecurityPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeTakeOwnershipPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeLoadDriverPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeSystemProfilePrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeSystemtimePrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeProfSingleProcessPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeIncBasePriorityPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeCreatePagefilePrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeCreatePermanentPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeBackupPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeRestorePrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeShutdownPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeDebugPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeAuditPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeSystemEnvironmentPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeChangeNotifyPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeRemoteShutdownPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeUndockPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeSyncAgentPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeEnableDelegationPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeManageVolumePrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeImpersonatePrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeCreateGlobalPrivilege	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: 31	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: 32	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: 33	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: 34	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: 35	4660	c8cc1b2dc76454583c3968d96af6d095.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe
Token: SeCreatePagefilePrivilege	3680	chrome.exe
Token: SeShutdownPrivilege	3680	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4548	4660	c8cc1b2dc76454583c3968d96af6d095.exe	96
PID 4660 wrote to memory of 4548	4660	c8cc1b2dc76454583c3968d96af6d095.exe	96
PID 4660 wrote to memory of 4548	4660	c8cc1b2dc76454583c3968d96af6d095.exe	96
PID 4548 wrote to memory of 640	4548	cmd.exe	98
PID 4548 wrote to memory of 640	4548	cmd.exe	98
PID 4548 wrote to memory of 640	4548	cmd.exe	98
PID 4660 wrote to memory of 3680	4660	c8cc1b2dc76454583c3968d96af6d095.exe	99
PID 4660 wrote to memory of 3680	4660	c8cc1b2dc76454583c3968d96af6d095.exe	99
PID 3680 wrote to memory of 1140	3680	chrome.exe	100
PID 3680 wrote to memory of 1140	3680	chrome.exe	100
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 4524	3680	chrome.exe	101
PID 3680 wrote to memory of 2800	3680	chrome.exe	102
PID 3680 wrote to memory of 2800	3680	chrome.exe	102
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103
PID 3680 wrote to memory of 2116	3680	chrome.exe	103

C:\Users\Admin\AppData\Local\Temp\c8cc1b2dc76454583c3968d96af6d095.exe
"C:\Users\Admin\AppData\Local\Temp\c8cc1b2dc76454583c3968d96af6d095.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff99f449758,0x7ff99f449768,0x7ff99f449778
    3⤵
    PID:1140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1868,i,8662734555279707732,17282265946192329899,131072 /prefetch:2
    3⤵
    PID:4524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1868,i,8662734555279707732,17282265946192329899,131072 /prefetch:8
    3⤵
    PID:2800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1868,i,8662734555279707732,17282265946192329899,131072 /prefetch:8
    3⤵
    PID:2116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3168 --field-trial-handle=1868,i,8662734555279707732,17282265946192329899,131072 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3084 --field-trial-handle=1868,i,8662734555279707732,17282265946192329899,131072 /prefetch:1
    3⤵
    PID:400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3704 --field-trial-handle=1868,i,8662734555279707732,17282265946192329899,131072 /prefetch:1
    3⤵
    PID:2884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4712 --field-trial-handle=1868,i,8662734555279707732,17282265946192329899,131072 /prefetch:1
    3⤵
    PID:672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4956 --field-trial-handle=1868,i,8662734555279707732,17282265946192329899,131072 /prefetch:8
    3⤵
    PID:2340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5208 --field-trial-handle=1868,i,8662734555279707732,17282265946192329899,131072 /prefetch:8
    3⤵
    PID:2568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=1868,i,8662734555279707732,17282265946192329899,131072 /prefetch:8
    3⤵
    PID:2244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 --field-trial-handle=1868,i,8662734555279707732,17282265946192329899,131072 /prefetch:8
    3⤵
    PID:3448

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html

Filesize
786B

MD5
9ffe618d587a0685d80e9f8bb7d89d39

SHA1
8e9cae42c911027aafae56f9b1a16eb8dd7a739c

SHA256
a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

SHA512
a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png

Filesize
6KB

MD5
c8d8c174df68910527edabe6b5278f06

SHA1
8ac53b3605fea693b59027b9b471202d150f266f

SHA256
9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5

SHA512
d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js

Filesize
19KB

MD5
c4d896de9d1e676873d95503fd52b5d0

SHA1
8358cdf52b936a82e2c67f31f9557ff6f44ccca1

SHA256
1e56597e6c71e1dcc4c4dac085560403fcd2d69df2370a502895a5c76ac00724

SHA512
2b78fc22f871ad983af67642242510993478e767e92f845e8a94fc8a698cdb848a410fffac179e40259e401400a27325e113aee0940b2fe7029bf6f9b8a4b9c7

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js

Filesize
3KB

MD5
368dbd669e86a3e5d6f38cf0025a31fd

SHA1
93c6f457d876646713913f3fa59f44a9a373ff03

SHA256
40d6653a91bd77ecbd6e59151febb0d8b157b66706aab53d4c281bb1f2fe0cd6

SHA512
24881d53e334510748f51ce814c6e41c4de2094fd3acc1f250f8a73e26c64d5a74430b6c891fc03b28fb7bddfcf8b540edcf86498d2bb597e70c2b80b172ee7e

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js

Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js

Filesize
604B

MD5
23231681d1c6f85fa32e725d6d63b19b

SHA1
f69315530b49ac743b0e012652a3a5efaed94f17

SHA256
03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

SHA512
36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js

Filesize
268B

MD5
0f26002ee3b4b4440e5949a969ea7503

SHA1
31fc518828fe4894e8077ec5686dce7b1ed281d7

SHA256
282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

SHA512
4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json

Filesize
1KB

MD5
6da6b303170ccfdca9d9e75abbfb59f3

SHA1
1a8070080f50a303f73eba253ba49c1e6d400df6

SHA256
66f5620e3bfe4692b14f62baad60e3269327327565ff8b2438e98ce8ed021333

SHA512
872957b63e8a0d10791877e5d204022c08c8e8101807d7ebe6fd537d812ad09e14d8555ccf53dc00525a22c02773aa45b8fa643c05247fb0ce6012382855a89a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
b58a44cafc8d13d7fe45864cbf21128a

SHA1
a98e1c6b673da668600af00373ec9c3d236b617f

SHA256
264fa93c6bd7f70eba90b114844179b189ddb322e80aab416a412830aa4275bf

SHA512
d833eaf3cc4be98bf0fac36892821bef892e100bbaff687edea743a7b03198ea6213a6caa67e2e831098cab8f4727376de6ae754a79c36fa0bced7df46f3c545

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
5adb9e07e77e8d97aa650ff694b199a7

SHA1
211c3cab4b20c82f9cc6bd99989b82d98be68f1f

SHA256
8da7d317419845f5198cff1760fe1a5c3a49d34f002a93be1b705d81a757864e

SHA512
68ca8a45748c0476ff29ef514a49cf9d2bf4d7698a9d8d4131756e598b90140eee81870f80fa965d4c45f56bf07663ef46801267b191d0b721e4a96d5e616a85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
97a339f90061bb2aa90de190fc193975

SHA1
d3af42a05f12a68b1baec5806e6225ad6c974855

SHA256
61fa26eaa1623f886ec234cc8d1059b63db6f2a0b3b03ca6d82486f165729eec

SHA512
668e39b1e114b071a8a88c100dc0a59124524d15ba9953a3775313278944aff4b1a2f7b563b5d96f554237d78dea8e6978dfe9ecc0659660aed2275632a01964

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
497823992f9c497d788d9caa49b1fad5

SHA1
77c9a609e2ad78787d56f597b836828c20d58929

SHA256
15aeed0d871bc29ebb2eae76d8713ce628c51e629b77dfb04a3e3081d54d72a6

SHA512
15d0c7820c3029d7cf7839b1c297e662ddf0dcf38d16e16c08966e66c059a1a50b3c57b4467bb801ed7b86c7fe9b900ead93c369a3351bf11739aca57a6e446e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
3d524cdf768044fbbe47b128f3aa36c4

SHA1
24d380dcb45c6c0b03112929bcadcad0f53ca12f

SHA256
bb6bdacf882a4799f358aa43de4edc4abd309e5558175702333706f602505fd4

SHA512
42ad4600f2b29896b9d4c5854f5ffb62a90b606b27789f46efa52572f79b9de2b761e41215a901a1f08529f09c61953f5d9ddd13433a17637b2387ef542b8eb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5f141321a94f1387e2bcc70c9c395c27

SHA1
b6ce99096c78e6303bfc35cc1746513db3848f63

SHA256
03024258ff155599e618e8065f0092c377298a78ff9071e5c10188c0235d471c

SHA512
6b529630df48a97442b643fd7ff3d940a332dc5d6dbcad1443fa05401d4c8b063adebf07688ec88234c3eec003ea2edf525de4024f69ba59a4daf28376f22f8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
8d78253b866238986256a5add4dec7cc

SHA1
238ec3913f52806fa3f6dcf4a239365cf249c8e5

SHA256
72fc8fb82ab17b3248857074e7e90587427fa985c21b9154771be53c79d62a75

SHA512
02275200029dae7f0c354a32d33d6acbfc0a46c21260ffe74101e7ba5dc2f21519fb609d4a8de4c96b91fb7432d117d389cb9e4d5c3d8b7d9625379ebab39fed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
11KB

MD5
3f0738232f3a3bfa3624e59c495f8118

SHA1
ff3042a6188c702401859d900da3c3033c0f2529

SHA256
408b51b16a2eed76a94df970f9c65d147f6ddb4819cd226ecb572234c67e1a7e

SHA512
a1efcba54dcce6a4070b61192af0c803a18ab174c5343d060b1de278f4698584ebd8f9fc345280d8a9443ae0ffd2fbc833cb2d549a2678a874282402d7a07b81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
11KB

MD5
ad8aff902e6cff5c84322ab9497a883d

SHA1
8f132035210c17df6e808415234a64220b40f754

SHA256
7749a69f834cc59b3f68337df39043476d0a1c960c6e7db7423d46b09d999e42

SHA512
630342434d7d564b0cfa5292325482bf22834b6d74da1e568cb9db521c5bd68887cfde700cdb406781008238b36cf2e54d31b89393f0e9c15cf4e79165534a6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
226KB

MD5
f0aa689911deeff99478c81b5df5a0be

SHA1
14c3a0a882d4fa0dbac1954fe9a3e61963549ced

SHA256
607cb5116cc89339df86c24680aa0a99ba565d529d9620f493420c22a80d6606

SHA512
c1978047329eb8d49780febf8e6703183ce6f671caf7db3ccb3b5100928b9ae43474914b8a0afebac05a647effe7a05503e8cc696b085ccfa87b4e14305cb26f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit