b9c1ac478a01f44da5714dbff385a6b62fc498f577ba8a9118a9f6f2a85dfd61

Analysis

user interaction
yes
max time kernel
78s
max time network
80s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BlurAutoClicker_3.4.0_x64-setup.exe
Size 4.1MB
Sample260415-xpy9aagy2l
SHA256 b9c1ac478a01f44da5714dbff385a6b62fc498f577ba8a9118a9f6f2a85dfd61
MD5 f6df156f86903e5a3c6252799164c10e
SHA1 37e46103ccef3b9efab0afbf0d94895927a85b12
SHA512 c6a9bda0b3001c4b982327252da12322e26855eb7279ba9ba4f666c3f8f8e135fd01be5b7ee2a0c1bc9994ca2ee3b9bfb34157b8f9d71a8da432b9da052b0d79
SSDEEP 98304:tamQN3GUlL0MBiRhE2OxpPOtwCznGRsK1PXvKG23LvdIF6jjNzjbiwf:tamQ8UlQMBiRhE2mpKfTCP/0hae1awf
TLSH
T1DA16330C32514D99D87A4B7148A9BF0D5DE26821E6867B44B369FC9678B394FF30C32E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3296	BlurAutoClicker.exe
5044	BlurAutoClicker.exe

Loads dropped DLL 7 IoCs

pid	Process
2648	BlurAutoClicker_3.4.0_x64-setup.exe
2648	BlurAutoClicker_3.4.0_x64-setup.exe
2648	BlurAutoClicker_3.4.0_x64-setup.exe
2648	BlurAutoClicker_3.4.0_x64-setup.exe
2648	BlurAutoClicker_3.4.0_x64-setup.exe
2648	BlurAutoClicker_3.4.0_x64-setup.exe
2648	BlurAutoClicker_3.4.0_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BlurAutoClicker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BlurAutoClicker.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlurAutoClicker_3.4.0_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4908	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207533798993844"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2648	BlurAutoClicker_3.4.0_x64-setup.exe
2648	BlurAutoClicker_3.4.0_x64-setup.exe
3088	chrome.exe
3088	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2208	msedgewebview2.exe
2208	msedgewebview2.exe
2208	msedgewebview2.exe
2208	msedgewebview2.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	2648	BlurAutoClicker_3.4.0_x64-setup.exe
Token: SeImpersonatePrivilege	2648	BlurAutoClicker_3.4.0_x64-setup.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
3296	BlurAutoClicker.exe
3296	BlurAutoClicker.exe
3296	BlurAutoClicker.exe
5044	BlurAutoClicker.exe
5044	BlurAutoClicker.exe
5044	BlurAutoClicker.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3296	BlurAutoClicker.exe
3296	BlurAutoClicker.exe
5044	BlurAutoClicker.exe
5044	BlurAutoClicker.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 2208	3296	BlurAutoClicker.exe	82
PID 2208 wrote to memory of 4736	2208	msedgewebview2.exe	83
PID 2208 wrote to memory of 4912	2208	msedgewebview2.exe	85
PID 2208 wrote to memory of 4912	2208	msedgewebview2.exe	85
PID 2208 wrote to memory of 4912	2208	msedgewebview2.exe	85
PID 2208 wrote to memory of 4656	2208	msedgewebview2.exe	86
PID 2208 wrote to memory of 1884	2208	msedgewebview2.exe	87
PID 2208 wrote to memory of 1884	2208	msedgewebview2.exe	87
PID 2208 wrote to memory of 2400	2208	msedgewebview2.exe	88
PID 2208 wrote to memory of 2400	2208	msedgewebview2.exe	88
PID 2208 wrote to memory of 2400	2208	msedgewebview2.exe	88
PID 2208 wrote to memory of 1700	2208	msedgewebview2.exe	89
PID 2208 wrote to memory of 1700	2208	msedgewebview2.exe	89
PID 2208 wrote to memory of 1700	2208	msedgewebview2.exe	89
PID 5044 wrote to memory of 1288	5044	BlurAutoClicker.exe	91
PID 1288 wrote to memory of 3808	1288	msedgewebview2.exe	92
PID 2208 wrote to memory of 808	2208	msedgewebview2.exe	93
PID 2208 wrote to memory of 808	2208	msedgewebview2.exe	93
PID 2208 wrote to memory of 808	2208	msedgewebview2.exe	93
PID 2208 wrote to memory of 380	2208	msedgewebview2.exe	94
PID 2208 wrote to memory of 380	2208	msedgewebview2.exe	94
PID 2208 wrote to memory of 380	2208	msedgewebview2.exe	94
PID 3088 wrote to memory of 4800	3088	chrome.exe	96
PID 3088 wrote to memory of 3348	3088	chrome.exe	97
PID 3088 wrote to memory of 3348	3088	chrome.exe	97
PID 3088 wrote to memory of 4908	3088	chrome.exe	98
PID 3088 wrote to memory of 4816	3088	chrome.exe	99
PID 3088 wrote to memory of 4816	3088	chrome.exe	99
PID 3088 wrote to memory of 4280	3088	chrome.exe	100
PID 3088 wrote to memory of 4828	3088	chrome.exe	101
PID 3088 wrote to memory of 4280	3088	chrome.exe	100
PID 3088 wrote to memory of 4828	3088	chrome.exe	101
PID 3088 wrote to memory of 1856	3088	chrome.exe	104
PID 3088 wrote to memory of 1856	3088	chrome.exe	104
PID 3088 wrote to memory of 4532	3088	chrome.exe	105
PID 3088 wrote to memory of 4532	3088	chrome.exe	105
PID 3088 wrote to memory of 4480	3088	chrome.exe	107
PID 3088 wrote to memory of 5296	3088	chrome.exe	109
PID 3088 wrote to memory of 5296	3088	chrome.exe	109

C:\Users\Admin\AppData\Local\Temp\BlurAutoClicker_3.4.0_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\BlurAutoClicker_3.4.0_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648
- C:\Users\Admin\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe
  "C:\Users\Admin\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3296.1164.14355059509750687784
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x178,0x7fff4b47b078,0x7fff4b47b084,0x7fff4b47b090
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,15689792490914444229,477078838218719598,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1996,i,15689792490914444229,477078838218719598,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2272,i,15689792490914444229,477078838218719598,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3516,i,15689792490914444229,477078838218719598,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3472,i,15689792490914444229,477078838218719598,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:1
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4528,i,15689792490914444229,477078838218719598,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4808,i,15689792490914444229,477078838218719598,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
      4⤵
      PID:380

C:\Users\Admin\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe
"C:\Users\Admin\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5044.3060.12762843207852701730
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0x48,0x7fff4b47b078,0x7fff4b47b084,0x7fff4b47b090
    3⤵
    PID:3808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4938c728,0x7fff4938c734,0x7fff4938c740
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,15776315536508108557,6933320970573237011,262144 --field-trial-handle=1988,i,336744211878872120,14744100750053470511,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,10579412871284784476,15622477263411386591,524288 --field-trial-handle=1988,i,336744211878872120,14744100750053470511,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,16166215866016255285,18441653346329580762,524288 --field-trial-handle=1988,i,336744211878872120,14744100750053470511,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,14256399393254848166,2758718630440630598,2097152 --field-trial-handle=1988,i,336744211878872120,14744100750053470511,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,15086490096345578564,32002296388554186,2097152 --field-trial-handle=1988,i,336744211878872120,14744100750053470511,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,16907708131819651405,16390566305468228316,2097152 --field-trial-handle=1988,i,336744211878872120,14744100750053470511,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4412 /prefetch:9
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4648,i,12915068355732013401,6122370127212042146,2097152 --field-trial-handle=1988,i,336744211878872120,14744100750053470511,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,7771428343624298979,6191904479285696436,524288 --field-trial-handle=1988,i,336744211878872120,14744100750053470511,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5828,i,17242879298682893701,4026191328651833938,2097152 --field-trial-handle=1988,i,336744211878872120,14744100750053470511,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BlurAutoClicker.exe

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe
Size 16.9MB
SHA256 540faf95442494e86f817d914db455cc28e07babef9c08c93ffd6fc767190b75
MD5 d18c29acc1b368cb20910c38fdbf29bb
SHA1 7d6c0874c797e793bc6af6895e3c715f2795b9c2
SHA512 c04e9317e9726c3f2919d4234365d9bc3518905457ef20445f2ac917cde8b0c242bb38c30aad56f078274872bec3271221e770f5593028a5e0af94b5a27e7e6c
SSDEEP 98304:14fPc/7gJ125FY8ep4PvpFQu5mJp0uhwcg2YCQqGwzuOJMXvX+BTiO72nUyLTFo/:97c5p4Z5Us9CQkpJM/uTiOELTKXMb
TLSH
T1A607E7217B5A99ACC09AC4B4834B4A72497530EB0B35B9FF448562F82F6DFF41F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e09cdba2933b58d6095ea91c5e79d78bec3694329f8897c349f69d688fc35534
MD5 0ff21c63cafbd7647f40df6534d16e92
SHA1 d314eae023a5ea942d8edc27f0cc30705171a0e5
SHA512 ce864561d51fa0ba177dd0c89133c17978590074f8bb1777164e38b1c1701fd001f00ce60b5b28f6489694256840f2d560339656c59b24c953b1f6c8b926fff9
TLSH
T1D9D012227311017CC020323302526A485800ED0B80054000682C857D1A191505A06441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1248ca9acd3b2efde480872b99f7a92e4e9ad1189a4f77b4479da220f495dc16
MD5 f99b9727898289c19d9e38e7e013bdff
SHA1 44170564a3f1fcf2910f633e85ac7f01b360a6bc
SHA512 14d73368989c30e80691b4ed0a1426024e43c129c100a19c3de07d237afa8fc733d76e7241fce9a2681db4d2ae1888e0708bb9a4774b2071503ffc31f406007a
TLSH
T1C4D02B2732220A28C46035330341A7493D20EC0A804380011C2F406F4E740D17BC6548
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 781c1ba7d826823116c7210c20552f9f732f40aa81cae4b99ab889d9f2f69fa1
MD5 44cc9155f7e4ae0a829de55b3d887726
SHA1 86db5325e6387d59ec8ee6177c1d7431a785850c
SHA512 62e5a53c58c6bbafdd690ec34e4dc22d03f91fe13e6f935b542b847fa8140a860dee35419b34bd4941dc09f3a107104ef1ae12c206ea864024ebec5f8676d56e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f8adc3a1e993b3907781e8dd0ec7c2d0238ae18c013f1f9b60aa48a5163f8434
MD5 7939c0329e7826b31e74f9ffa79da33d
SHA1 29c139542c2285125a5dfeff3ec83152723141e7
SHA512 2a0a732c44a5cff507daac04cdbf56203f4ecca5d83b6e291f9da570b01941fe084a63f1f7a54e6d6a6f328f7e58f301549b2f199aed38e43e4f8d273c9c257f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 e6d6e6e96b7fb65f9ac3a6c13eae9cb7d317d399a43d984061b318dd0e35dafd
MD5 a7ec90c6fcc96100e547d336059a368b
SHA1 b70fd0e016a41f9340f67beca1b247767016b0b4
SHA512 c9e435a8b9b5ac111296fcf2f9127bf61c333cefbde4ccb1703aeb92b4a165c22d33b3efea1dd3401be8cc1e81730480fbb06e71861cff92587feb49bbeadd8e
TLSH
T1BDD092E72054C207F7D5513417E552A87E736B1EB04B5E4254DA437D49E87451285A20
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Preferences
Size 6KB
SHA256 da18d19e6766750a0d43c96d778dad1ac26c151eddaff76bb4095409dd24d4bc
MD5 23bd4c67ce3b2dfa92fecd2c51bf0262
SHA1 e29de54c5f7cd482721f64f2ed5dbce7ad32cb3b
SHA512 fe7dadd5746a0f6349f2abcadcb23a70dc385d5f5b58a2e7b559086423605fee15b3e0eddf20df3f06ed336dd678649b548b888a0e54c2f2a3ff56d1b75b82b1
SSDEEP 96:st/205dsyPslb9TffVlZ8i0vhEEs0kt/xm/7qx+WVHMSm+uecJbIf8RdQjiE+gg6:stu0vwfjZ8pav8/S+WiTbIWd+eoMC
TLSH
T126E1A7035E28597B4CC7E61D7A35BF12D6F6206263D40E58EBFC8A0C05E66CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a4f2d36b-d753-425d-9f05-f14f1afe50a4.tmp

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\a4f2d36b-d753-425d-9f05-f14f1afe50a4.tmp
Size 6KB
SHA256 fc76fce378efbc5121b90b77c119838cc2d5c3312733d19c5c4fe5c7de7cf630
MD5 6324888fbf487f70a2b76f2ab99c2b32
SHA1 e646cee1007cd0540ba16b4d28d67ea5d5055994
SHA512 6fcf3bb691da1fea87e6a48a561db79a4314e526fced0da0f5d030d9261eef0fbbb8653f1a7923127e767b7b9ba83afdd925e2017ba16f7022c96912f81b0ec6
SSDEEP 96:st/205dsyPslb96ffVlZ8i0vhEEs0kt/xm/7qx+WVHMSm+uecJ/UTnURdQjiE+gB:stu0vNfjZ8pav8/S+WiT8T2d+WoM8
TLSH
T124D1AA035E28597B4CC7E619BE75BF13D6FA207266D40E58EBFC861C04D66CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 1KB
SHA256 d5c4265f855276350161590bc51f54f9ab55deffd0ba6af57705394e5bb5b617
MD5 ce3d90cf9da727a1acd980ccddb5b8f2
SHA1 20a1b17557612a91d045369ef0e81e9822b2f1f4
SHA512 a54f89daa966d3750f0b7e0f7701e8a18cfbcedbb2b3bce8bfee857e5b8b3f7d39a781c16fe6f6c65f888d922beaaefd56ca09de767acbc7d5e22218eeb5f193
TLSH
T1C13185B3D0A85B366DA256457193BF475D711035C3614F08A1DD0F1C01E26ECA236C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 2KB
SHA256 8969b50195b9d7c9257c85e543de003cbe9866336698a0b06e10a39bca2c484d
MD5 67982a97dfbcd6967b49041639f8d23f
SHA1 4f61dc804eed224bbea800ddc19fa3d545c7985e
SHA512 95b421c877eef0ad7789c461c7c43d2405b994d557743bade9be0d55242b50d36db4ffbd0d1809bcb8ab49d25badd48f9570d0df8fa627f3dc16ffbfa3a7e34c
TLSH
T16951A573E858963B89E34A44B9977F1399725171D7A22F50A5ED0F0C01E66AC3312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 16KB
SHA256 20775cad6f621a3e60d24ca24cff2d58a5c729ab62c7792dbfb488cc6e058328
MD5 4f1c61fbbc0c08d63806e7fd2837f940
SHA1 4b6d536712ae42202bceb7f342c8be17cb87b91a
SHA512 e6fed7cea414ca5bffd9886455f0cd7afd3b0bcd10d1929b883ebe75d0d566911fea96e73ba3b7d1d3e5f5b750c688f5c7a1e995d156a77aa6c21317cb9a4620
SSDEEP 384:zefRE5BdEZfr0kuh9Rt/nP9yE3NbmJLKpqgIuU6HQu:SRkurqhNsEk4qgi6HQu
TLSH
T16E72BF638934993B6CF7850A390A6F02A5F48459D6E22E94B8DD2F1D06D3BE91363D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 3KB
SHA256 3700b4c277d7233a265edb22f22d7cf7f3b83eae3c438b2a1a1e7f07060c5a2a
MD5 aa97d9595b017d2910db3b995a8cb294
SHA1 945f1a501421907c715dbb5fcbc4b09b3176a9a2
SHA512 2a4a2bca623d64296dcd77d21746a3ccf62486145157bb963b5d35efe7f72002537f193779185352d20d005ca7bbfd5257ec19d0fb0c29c8a914c2ac73050cf2
TLSH
T1E3716363A8A8953B4DF29A44B8863F06B6A15136D6953F99D5EC0F0C01D76E82352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 16KB
SHA256 5837c6ab7c37ebc2efc05053c16d58313ae5b5e03ba771d2e4857ceff5523808
MD5 f96549a2550056221cee6b61087211a2
SHA1 cddc3e5d3a7d726ce1e2912014632ba0bea2a72d
SHA512 2741ad87753ac3451b1a8522f12d950615679c2ccb3f4c1c5e8dbc656b2a25683aafd8918488806ef41fb6784c8cc9ad85b89ec1c3d3cd3f77f4fbb31f9e3bb0
SSDEEP 384:zFfRE5BdEZfr0kuh9Rt/nP9yW3Nbn8ripqgIuU6HQu:1RkurqhNsW0gqgi6HQu
TLSH
T1A272BE638934993B6CF7850A390A6F02A5F48459E6E22E9478ED2F0D06D3BD91363D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58632a.TMP

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State~RFe58632a.TMP
Size 1KB
SHA256 f7143109292cad6fa936ee79cb94cedb404c9190d4aecc3b375baf0d3b5722e2
MD5 1046ad1e417c83c448b182be529796be
SHA1 2f1cac3299134cc8b4fe3e470eb0f4df7c279270
SHA512 6afbcdc92de0011e04617673942b6b180f67c8e78dfd4d8e2b8ff7bc5b23b39ae927ce1e8537b1445237090e727bd525a51bd13aab692fd4696c3c94d65360ff
TLSH
T1BC2162B3C0EC6A3AA9914945B193BF872D615078C3605F09A1DD071C02A79FC9237C33
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6a0445fd7520b8c531b0e6dc382da25efb17e7138c5810a40c46295c24b84dac
MD5 23870784fe8af38124236e693dbbbe37
SHA1 409c6408bacf5dc8d4fc6b9dc2fec53bcf9fd097
SHA512 705481b9aa2c4819c52eaf1da5e5aa9e9981d7b85ce6b8782bc31d6c71e9e798e5ef3c429a05507d63febd255466624caa390ca135b2b33aac685e26e35563e9
TLSH
T14DE02BAACD119C370CFD571960688647EB54135B67514D5F3A3D430C4FB127B094285C
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a025d5dee5aa962d52c63e9b14b5cb016ccda2434aded5ff60916b251be8a6cc
MD5 afc902ff9106be89eb1e9d43d2bd95fb
SHA1 a64c46911a878746ef9fb25446a3301d8491c73d
SHA512 2ed306cbeb15f740d91f6a664839708bfb594e976251660a8c25c1510a3ffdd95fb61d49b5887bff889250bb640a552047cf3bec489ed7845c7ff74a167049d1
SSDEEP 192:mReNYrs7GD2Nv7spAPRp229AHsb+WNnxm0vbakwjVQ+VyIsnAUgtaJ:mReNMCtgUX92ws0jaDd8
TLSH
T1E342D82EB918693B5CD7C22AFD657B83D7F61021A1C51E84E6FC8A2C25E75CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
MD5 191a425abbe14997e55d6c34d96395de
SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
TLSH
T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 fab85459238daa076985996d98544c46b1e3798914ec74f90013b9b689d7dbc3
MD5 0aded102f3800780f9bac5401bfc5a15
SHA1 d6ec51cc820d39db2a6354a18c8208d24d244635
SHA512 f448d232ae71c8c5f33009363f423834a2d2acc0d8417825350a601bf36cc5b1a38c95ce298aee7a85a81cb4d800df50210a08c952197fd0f29434a26205cad1
SSDEEP 1536:4L1P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gt++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1579302B9991E7D39636ED396A0079CAC8CD3DCCE1510517C30C76F0E14BA3A3A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 48ea89a3e74f6e34cfd4120987265059a655df1c731df7439518b88d13b5d8fc
MD5 57ef09cd10b257b147424b46c00a64d9
SHA1 60bd73c20f89c74a88245f3a0df1bff33cbcb992
SHA512 d98b3f1445ac67532e2d117fc1d2521855206b33daf05e4bd0a1655e29b3b1e32e7d3eb36fb90ed896bb2afd28182a78b3a974dded600291ca607ff1ea95af3e
SSDEEP 3072:1LWbIDny76IR3kR5zgznoe56mQi+/H6NNc++J3qUQm08KMWF0bFTcVHr6zI+:1ythRyg96bio6Xc++JjcMW2VcVLl+
TLSH
T1C814226D6C2B3E76035DC3BD201B9D1F88E39CCFA615A17462C67F4612E83E24B0785A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3C3B.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsr3C3B.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3C3B.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr3C3B.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 027ae65c1c2327bf398bb56d016567d049a3bf403645b9f8b93c3abd0bda701a
MD5 757d150203864f9320304dc15d43f79d
SHA1 01e6b24214e58e921b4f6f34a8148df9f0e795ca
SHA512 80b9d3d8eb6823ed8d604d4002f8f9f0c8dc2e4023b5dbc782fde2589544ad4bc054d98e6443ef28b33f60738e9397ab9198d77d9639e43bfe980d1e98e049f5
SSDEEP 48:p/YHcdOCFYGzdJ9zZYKvdDzXXulkzDp3/YHcdOCFYGzdJ9zlYKLpdDzXXulkz+26:/zvJZLzHumzDzzvJl5zHumzg
TLSH
T1A2A1005447D30B22F2F7AEB254F37711AA77B846EA844BCE04C142241D72B8478B8FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 b1c6e69797082aa531ee8091e98fb82eb6000b5d5c901e8b4562d47093f9b7fa
MD5 6b9fd51bf2083a699b4e1499c4bf6794
SHA1 61534c1a7712985e74a2c3ef3d2708fca966c5cb
SHA512 ce8e4ccb88e4e096f066d282b9692d152f29502856347c2a82bac46a9f056ad9ee285d5034b61646b0befc2a79ae39a891c6546651b7d045ff190e3c588568dc
SSDEEP 48:A/YHcdOgL+YV8zdJ9zZYKvdDzXXulkzDpa/YHcdOCFYGzdJ9zlYKLpdDzXXulkzg:48zvJZLzHumzDEzvJl5zHumzg
TLSH
T14DA1E05447D20722F2F7AE7255B37B51AA77B446EA844BCE00C142242D72B8478B9FBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/380-334-0x0000024442610000-0x00000244426AE000-memory.dmp

Download

memory/808-333-0x0000021689C10000-0x0000021689CAE000-memory.dmp

Download

memory/1700-323-0x000002664EA20000-0x000002664EABE000-memory.dmp

Download

memory/2208-308-0x000002049A000000-0x000002049A0AF000-memory.dmp

Download

memory/2400-247-0x00000185AD150000-0x00000185AD1EE000-memory.dmp

Download

memory/2400-196-0x00007FFF68710000-0x00007FFF68711000-memory.dmp

Download

memory/2648-51-0x00000000021D0000-0x0000000002291000-memory.dmp

Download

memory/3296-307-0x000002B98C9D0000-0x000002B98CA7F000-memory.dmp

Download

memory/4040-441-0x00000170BAC60000-0x00000170BAD0F000-memory.dmp

Download

memory/4656-321-0x0000019A04600000-0x0000019A046AF000-memory.dmp

Download

memory/4912-320-0x0000023AC84C0000-0x0000023AC856F000-memory.dmp

Download

memory/4912-319-0x0000023AC5C10000-0x0000023AC5CAE000-memory.dmp

Download

memory/4912-77-0x00007FFF68710000-0x00007FFF68711000-memory.dmp

Download

memory/5044-332-0x00000131022F0000-0x000001310239F000-memory.dmp

Download