hxxps://github[.]com/Blur009/Blur-AutoClicker/releases/download/v3[.]8[.]3/BlurAutoClicker_3[.]8[.]3_x64-setup[.]exe

Resubmissions

02/07/2026, 10:51

260702-mxt97aex6m8

02/07/2026, 10:46

260702-mt1b2aew7r8

Analysis

user interaction
yes
max time kernel
60s
max time network
61s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Blur009/Blur-AutoClicker/releases/download/v3.8.3/BlurAutoClicker_3.8.3_x64-setup.exe
Sample260702-mxt97aex6m

Score

8^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	3456	firefox.exe

Executes dropped EXE 3 IoCs

pid	Process
4152	BlurAutoClicker_3.8.3_x64-setup.exe
2308	BlurAutoClicker.exe
3360	BlurAutoClicker_3.8.3_x64-setup.exe

Loads dropped DLL 9 IoCs

pid	Process
4152	BlurAutoClicker_3.8.3_x64-setup.exe
4152	BlurAutoClicker_3.8.3_x64-setup.exe
4152	BlurAutoClicker_3.8.3_x64-setup.exe
4152	BlurAutoClicker_3.8.3_x64-setup.exe
4152	BlurAutoClicker_3.8.3_x64-setup.exe
4152	BlurAutoClicker_3.8.3_x64-setup.exe
4152	BlurAutoClicker_3.8.3_x64-setup.exe
3360	BlurAutoClicker_3.8.3_x64-setup.exe
3360	BlurAutoClicker_3.8.3_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BlurAutoClicker.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\BlurAutoClicker_3.8.3_x64-setup.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlurAutoClicker_3.8.3_x64-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlurAutoClicker_3.8.3_x64-setup.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274631187630163"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\BlurAutoClicker_3.8.3_x64-setup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4152	BlurAutoClicker_3.8.3_x64-setup.exe
4152	BlurAutoClicker_3.8.3_x64-setup.exe
2308	BlurAutoClicker.exe
2308	BlurAutoClicker.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4152	BlurAutoClicker_3.8.3_x64-setup.exe
2308	BlurAutoClicker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3992	msedgewebview2.exe
4660	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeDebugPrivilege	3456	firefox.exe
Token: SeImpersonatePrivilege	4152	BlurAutoClicker_3.8.3_x64-setup.exe
Token: SeImpersonatePrivilege	4152	BlurAutoClicker_3.8.3_x64-setup.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
2308	BlurAutoClicker.exe
2308	BlurAutoClicker.exe
2308	BlurAutoClicker.exe
2308	BlurAutoClicker.exe
3456	firefox.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2308	BlurAutoClicker.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
2308	BlurAutoClicker.exe
2308	BlurAutoClicker.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5252 wrote to memory of 3456	5252	firefox.exe	80
PID 5252 wrote to memory of 3456	5252	firefox.exe	80
PID 3456 wrote to memory of 5616	3456	firefox.exe	81
PID 3456 wrote to memory of 5616	3456	firefox.exe	81
PID 3456 wrote to memory of 5616	3456	firefox.exe	81
PID 3456 wrote to memory of 3376	3456	firefox.exe	82
PID 3456 wrote to memory of 3376	3456	firefox.exe	82
PID 3456 wrote to memory of 3376	3456	firefox.exe	82
PID 3456 wrote to memory of 3376	3456	firefox.exe	82
PID 3456 wrote to memory of 3932	3456	firefox.exe	83
PID 3456 wrote to memory of 3932	3456	firefox.exe	83
PID 3456 wrote to memory of 3932	3456	firefox.exe	83
PID 3456 wrote to memory of 3932	3456	firefox.exe	83
PID 3456 wrote to memory of 3452	3456	firefox.exe	84
PID 3456 wrote to memory of 3452	3456	firefox.exe	84
PID 3456 wrote to memory of 3452	3456	firefox.exe	84
PID 3456 wrote to memory of 4996	3456	firefox.exe	85
PID 3456 wrote to memory of 4996	3456	firefox.exe	85
PID 3456 wrote to memory of 4996	3456	firefox.exe	85
PID 3456 wrote to memory of 4996	3456	firefox.exe	85
PID 3456 wrote to memory of 5664	3456	firefox.exe	86
PID 3456 wrote to memory of 5664	3456	firefox.exe	86
PID 3456 wrote to memory of 5664	3456	firefox.exe	86
PID 3456 wrote to memory of 5664	3456	firefox.exe	86
PID 3456 wrote to memory of 1448	3456	firefox.exe	87
PID 3456 wrote to memory of 1448	3456	firefox.exe	87
PID 3456 wrote to memory of 1448	3456	firefox.exe	87
PID 3456 wrote to memory of 1448	3456	firefox.exe	87
PID 3456 wrote to memory of 4028	3456	firefox.exe	88
PID 3456 wrote to memory of 4028	3456	firefox.exe	88
PID 3456 wrote to memory of 4028	3456	firefox.exe	88
PID 3456 wrote to memory of 4028	3456	firefox.exe	88
PID 3456 wrote to memory of 1336	3456	firefox.exe	89
PID 3456 wrote to memory of 1336	3456	firefox.exe	89
PID 3456 wrote to memory of 1336	3456	firefox.exe	89
PID 3456 wrote to memory of 1336	3456	firefox.exe	89
PID 2308 wrote to memory of 3992	2308	BlurAutoClicker.exe	94
PID 3992 wrote to memory of 1168	3992	msedgewebview2.exe	95
PID 3992 wrote to memory of 5536	3992	msedgewebview2.exe	97
PID 3992 wrote to memory of 5536	3992	msedgewebview2.exe	97
PID 3992 wrote to memory of 5536	3992	msedgewebview2.exe	97
PID 3992 wrote to memory of 4164	3992	msedgewebview2.exe	98
PID 3992 wrote to memory of 2324	3992	msedgewebview2.exe	99
PID 3992 wrote to memory of 2324	3992	msedgewebview2.exe	99
PID 3992 wrote to memory of 5152	3992	msedgewebview2.exe	100
PID 3992 wrote to memory of 5152	3992	msedgewebview2.exe	100
PID 3992 wrote to memory of 5152	3992	msedgewebview2.exe	100
PID 2308 wrote to memory of 4660	2308	BlurAutoClicker.exe	101
PID 4660 wrote to memory of 2272	4660	msedgewebview2.exe	102
PID 4660 wrote to memory of 1692	4660	msedgewebview2.exe	103
PID 4660 wrote to memory of 1692	4660	msedgewebview2.exe	103
PID 4660 wrote to memory of 1692	4660	msedgewebview2.exe	103
PID 4660 wrote to memory of 2408	4660	msedgewebview2.exe	104
PID 4660 wrote to memory of 1988	4660	msedgewebview2.exe	105
PID 4660 wrote to memory of 1988	4660	msedgewebview2.exe	105
PID 4660 wrote to memory of 3348	4660	msedgewebview2.exe	106
PID 4660 wrote to memory of 3348	4660	msedgewebview2.exe	106
PID 4660 wrote to memory of 3348	4660	msedgewebview2.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Blur009/Blur-AutoClicker/releases/download/v3.8.3/BlurAutoClicker_3.8.3_x64-setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5252
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Blur009/Blur-AutoClicker/releases/download/v3.8.3/BlurAutoClicker_3.8.3_x64-setup.exe
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {d352ba57-1679-4080-b21c-f9003af9bcf7} -parentPid 3456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3456" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {b73ca3a1-c9ac-4a88-8ef0-bdce87d66b04} -parentPid 3456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3796 -prefsLen 25164 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 3804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {250ae11d-82ae-4344-be45-a0c9eb1ad480} -parentPid 3456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3960 -prefsLen 27274 -prefMapHandle 3964 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {34f36764-6fd5-427e-95ce-8be7821c3a4e} -parentPid 3456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3456" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2668 -prefsLen 34773 -prefMapHandle 2916 -prefMapSize 270279 -jsInitHandle 2636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2728 -initialChannelId {19c65f22-667e-4ba5-867a-37db1c174484} -parentPid 3456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2800 -prefsLen 34903 -prefMapHandle 4960 -prefMapSize 270279 -ipcHandle 4996 -initialChannelId {df82b76b-920c-47ad-b865-aaeee72b858c} -parentPid 3456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432 -prefsLen 32952 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5420 -initialChannelId {4a1cc8c1-0eb6-4e00-baaa-bbf0882be2dd} -parentPid 3456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {68a50b9b-dc53-4838-b3fc-b8465f8c3c05} -parentPid 3456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5780 -prefsLen 32952 -prefMapHandle 5784 -prefMapSize 270279 -jsInitHandle 5788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {b2ff7d59-56bf-4a27-8b4b-ab337ce17e03} -parentPid 3456 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3456" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1336

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5124

C:\Users\Admin\Downloads\BlurAutoClicker_3.8.3_x64-setup.exe
"C:\Users\Admin\Downloads\BlurAutoClicker_3.8.3_x64-setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4152
- C:\Users\Admin\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe
  "C:\Users\Admin\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.8.3 --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2308.1756.889669827353991661
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffca3afb078,0x7ffca3afb084,0x7ffca3afb090
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,16198141813648611786,7398207650424037184,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:2
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1984,i,16198141813648611786,7398207650424037184,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2288,i,16198141813648611786,7398207650424037184,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:13
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3524,i,16198141813648611786,7398207650424037184,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:5152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.8.3 --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2308.1756.13058910633729961966
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffca3afb078,0x7ffca3afb084,0x7ffca3afb090
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1780,i,15726021163346601652,8670887467458538192,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1804,i,15726021163346601652,8670887467458538192,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:11
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2248,i,15726021163346601652,8670887467458538192,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:13
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView" --webview-exe-name=BlurAutoClicker.exe --webview-exe-version=3.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3456,i,15726021163346601652,8670887467458538192,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:3348

C:\Users\Admin\Downloads\BlurAutoClicker_3.8.3_x64-setup.exe
"C:\Users\Admin\Downloads\BlurAutoClicker_3.8.3_x64-setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BlurAutoClicker.exe

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe
Size 16.3MB
SHA256 18e6f97db8b3d76c2bd0ce98764975278c9c78da70e718b9e1cd8b9db0a3dbc4
MD5 d1bafd02a470c852254ec6b578633b0a
SHA1 59f058b454665b41e397f61d589a1363c2cc5be0
SHA512 36b203fdc9a462e2761ac334443775ef0732c02c933a569f271eef616aef8011cb96b796fc8d744c56327f6e6513254ffa8e0d4c19ebc6a95e8bf14f6c1e0613
SSDEEP 196608:R/+1BnYR3UH64FPcYmCoFeUihlWQlwxQzqM/J:RW1BnYR3bQlE8
TLSH
T164071B11BA5B95ACD1DAC8F4C34686774D6134EB0A36B8AF41C461F83F6EFE05B28319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 14c4333db4a1c4d4929a0f52c10026b9df635cd3d6a75ff40b86bffe08fabfce
MD5 ac7305bcf68aa1862b057e1345945456
SHA1 8d30fcd60afce67b22e4ae684dff13268961dc9e
SHA512 052dfaba065bb61bd3df6f4b33353931824824b073180340ead8165f5083945924c730ac5e0df44b56190460da706fc1b08e40d08bf4a8b1de0496b9328c8a33
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 48c744929c2724c4720f3a7fa377c90db06a4692e90147a8d31c9d928636e16d
MD5 7423ca20093c2f1ae687cb7ce2d72745
SHA1 6a5b1acf8d70e15e1f156977e53b0f8c6c0e16d0
SHA512 a3b1730264adc9ead16f8a3f6400ec14040366fac875273d6c5191d37a2c176743398d9de67fab25b773e334b93291890df905cd0f6017a65dc13c068acf0711
TLSH
T162D0121236510278C19030331422621C1481C50B810944909429871D1A48450090AD53
MD5 SHA1 SHA512 TLSH

Submit Download

2634a958-16dd-442e-8689-520e43fb3433.tmp

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Default\2634a958-16dd-442e-8689-520e43fb3433.tmp
Size 6KB
SHA256 cefa795c1bdcd988dcd113b9bc324a570f1a5b1d79ae72d2795493feb1e10cec
MD5 19deb202440bea3e7f49251d2d268f03
SHA1 6ef8672d98fd2a5b706bfea54ab078cb6f21e8c1
SHA512 5b36ba587bb8cfdf57c2d3a11f6920ab4f103bcaba0daa36dedb87dc69ef0e90e246f47f4de2c6bf78e2ecdcf09a677d692b886d87edcc4b0ae3052b0a10e482
SSDEEP 96:stU05EaGagb9emffpZ8i0vhElukt6m/7qx+WVHMSm+uecJ6K1idQj4w+gqOArMEB:stU0BYfhZ8palVX/S+WiT6KwdhwqrM8
TLSH
T15AD1B8439F28AD7B4CC7E2197A35BF52E2F5206266D40E58EBFD861C09D66CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 73f0be40ef675312762370763a68408b40d4c631942ba28c1de01eef4b29f252
MD5 a5ef6556ccdb65cc8e5859dcd3f5fd32
SHA1 5602dd020bdb961b0513e4bf146c38cdfe72557d
SHA512 74b0ad896cd635455828ecd8256856cfece6ba31c919b9c1649bf670ab0e1f05ca3ab4ee2864ad0ab2674bfb7757ab29b4de4ca689c47ac6edeef30f144a1cf9
SSDEEP 3:LstlNllkll/lzRkl:LsX3lEt9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Local State
Size 16KB
SHA256 f883d37419a521dfc733ffe518cbc9667c5e39c6cd4b360b1f63e52fd86a4b01
MD5 7ca603ecbbb1282e51c5256f7af6c6f9
SHA1 70a789fab94968a0a6ae2854899e08bbfc0cf129
SHA512 1687eb3b48b70b91d71f7808246baa875f4bca5c1e20724495aa2d6db2aa53fee854e2ebb662b02a58d532eca491d6b9933df369d9c2c61c932f4acc41c7633b
SSDEEP 384:zAUsrv+89zHqlDNP9oidaPNbx5srjR1YgLK8wyOZNr:sfrv+4UNbdqqrd1PK8wyINr
TLSH
T185728C32A538D63799F29544B48A2E077B7861A6CAD11BB4D9ED0F4D439F0C92317E43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Local State
Size 1KB
SHA256 77843679aab83becd1cee360296f4c9c29718660130443a5002868f1db9b1c9f
MD5 dd00e542076b9e1cb666474ac0ec8296
SHA1 e6f2774e698ef83156c003cea023f8f61810b2d4
SHA512 241281c2970801a08fb04575cba8d59616782046b488eb59074a3bf68c3e0856cfcd532cc96aa598f62f1d46e729f93b74e5a11440b97acae548bd9db2ae1726
TLSH
T1353142B3D4505B37A8929241B1973E5B6D6010B6C6704E04B2EE4B1C03D769C933FE33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Local State
Size 2KB
SHA256 bb0529f05caa985cc16bdc3b4b2980a9186a3ecb5b117370eefcd436d9331b68
MD5 f36b0c7e039e6dd8387ebfc218b0cd30
SHA1 e971f8336ed63cf074d82c4e9b43a6b931ca8b8a
SHA512 48a1d3343485d9a9ebef90c34319d794724d07eb7f10216f2143c20ec7790862eb9a99482ad5df2d1900bd0f2cd36af93b4e4954498ec1c215114c8ddfaa1e3b
TLSH
T1B9518773A814DB7784E38640795A3F12AD7560B2DB711F50A6ED0B0C03DB55C2317D27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Local State
Size 3KB
SHA256 88eb8d1b3042ade6435b592f3b60bc710773daab9cdf40442eb37f7779c41b97
MD5 30128c24d460f20742443ea69d493650
SHA1 db6a59c0bb0206b69f6b50a8544c63247a135ff7
SHA512 d3b0d90517f54690194a5248a52a861703b19afc258c892aa396cda436035012b560e8e47cd4d3d1917b90e6de424c9a63757d9231a21f604cefe1a99eed482a
TLSH
T1D9718672A964DA3B4DE39A00B8862F16B6A55073DAA13F95D5ED0F0C03DB2981312D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Local State
Size 16KB
SHA256 b86a3b11e52427bba70cfb9e6f7d0c95233797bc28cd867a149fc914551a8206
MD5 162d5b85abdad5bbfaf96aeb3acca8ec
SHA1 4bdce8007586920e3b58d3097f2b4b1ad0bdd1da
SHA512 cf7092e7b0d96031aae2cff08936887bc15b13a5f26a38ce662296f1b0180c2e2edd4337f415beced874be61b094a33f3a3358c41729faabf216223a746c6a0d
SSDEEP 384:zApsrv+89zHqlDNP9oidaPNbx5srjR1YgLK8wyOZNr:s2rv+4UNbdqqrd1PK8wyINr
TLSH
T18A728C32A928DA3799F29544B49A2E077B7861A6CAD11BB4D9ED0F4D438F0C92317E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58ad42.TMP

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView-overlay\EBWebView\Local State~RFe58ad42.TMP
Size 1KB
SHA256 62cdf6a0f33c835ef2d5c8fb68f8ce02c7da79f94d7084c4548eff90eb5edeb7
MD5 4721fd497f2d1e85708b96520e964f6f
SHA1 9daec7b6ab1d5b8f56bdeadee6d7ff4ea7f0802b
SHA512 9fc5957ce9e306c7b013639d90d41a66e510103ca0923e7a7a2301fd7efa850f78623ebdaf0f1ffa23a7fbaa09a329c35a0facb5e07fdd9766f22e91b07ae66a
TLSH
T1822112B3C4549B77A8918240B1537F4A2D5050B6D6704E18F2DE471C03D75AC973BD73
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7263290354ac18bcbbc97f461e869dd96cd4562afd4dcbe4c7576c5a214429f3
MD5 2d49ef4d63225128e9f6a5473ec4f14f
SHA1 87e0021d4d6c986ac3e2daa72bdcbf6b3c6cec20
SHA512 69c570cebda80ee9b08fcb72a0f9ba74662e50dd7ecc4da340a09ef8918c76e00b9c17314ac7933d562371f0758ba9c857881faf4aeb1d42fa075615c473e702
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c0aa7a6bc6b5b89effe2e822bdbbab037e39dfe4d8e4582844c5ebbbdeb0b469
MD5 925b60cabce7987cb9e28f736a9dc54d
SHA1 3221b7332eefaf1ad08a1ba52e37848f0764b00f
SHA512 c51c8329230ee6afe5b1122cd4f5a9e13f93d56f54adb39f24aa3527808f3f73efced56aea47be15c163f1bff99218f4ddd2138c02788ba60f21ca68cfcc5ad0
TLSH
T19ED01122B2828A38C02028330082A20A0802CA2B808A8020A8288A2EAE0C0A00E22882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 acd121c2478797fffa0e3da789777f0bf488b616221bf765403c5e627b13ebf5
MD5 f0deb2b1016a22ffba336067c15c9655
SHA1 5263c5502aad1064e28578c62442e1f5fdac1f01
SHA512 944ddba0e7de423ec097373082d2d7b1e5978ec249779155a0832db0f32975e327a93bca46bd94fde9f74d321e3af9fe22791f4351e5ce6eadb627e1bd0ab96e
TLSH
T1E0D0121CEB7199DCD7206F3020C1A745BFF054505E039D2745F51AF2A8A4B5006C60CE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 65d97a438b5cda511b4f3d349433286cfc6c618f3f294635b8e128e4f702df58
MD5 5ecff113b404e1ad4359b1ccaa5fff11
SHA1 6e309158b81bb2c9be2192e5fe8ac36c76f1c20b
SHA512 12784f58d5be444418adba446e4513f0a3bb1888dec6a3033fd41e47d5facaa979a652dccc4124b86c3f3a499b0fc7830ae32a9ec4d8de133cc22b553d3695c4
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 16KB
SHA256 4ddcb1e0d66d92abd969761d21b2feb601db2bf669dbd95bebbe4be7bd2bdb71
MD5 903c461e4adcbcee4e5fd787ec42694a
SHA1 938a30568d6acf62fa4089cb469e72dc7e1d5184
SHA512 5a8de92283a7ecced2f39cc7ee7b0a5e38b77a51cb2fe4b6a82af3306d53a1713fe13651981abf2693b90b2f5c41f9d41f5a071c6b581cdd519e71913b314276
SSDEEP 384:z1srv+89zHqlDNP9oidNNbp3ff/lRwypNN:urv+4UNbdJP3lRwypNN
TLSH
T11F729C33A538E7335DF29944B48A6E077B7861AA9AC10AB4DADD0F4D039F0C9231BD03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 1KB
SHA256 b0c4bc9b2b5fe8a8e117ff2cf6a2e4d1e513dcc856d0e08a736b342319525f6c
MD5 b4f42e93f39d27b0bc5aad516f1d7828
SHA1 0a0f015bfaca0c5ce14149e123d647c615a948e4
SHA512 401bac8a7f002d3925653628c37db8da17fd7b9b69a07835c27258554317f28093aa824a0f247c072c999e8816ad99f8e6413c9d758826ae694c673719a9339c
TLSH
T1013185B3E1A4AB375C929B4173827D5B5E60102AC7205E44B2DD4B1C03EF99C9A3AC22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 2KB
SHA256 f5e95d24ae58f8858e00af61cfe6c3340984d4ac9966fd3868ebf875eaa76e70
MD5 25e335019dc3f95060c53357df519bd8
SHA1 a5a3782e04a6765bb28ba100bb737c9bb118e59b
SHA512 ce9d1a1a01f1d0367cbe55fd2f7dc7511febe5eb2225bc0936bae3e0c9b8dbc5de5dba079d7797e745b0767bf610ee181338f9e1b7c946b9d75c9707778397a9
TLSH
T1B85196B3A818AB774DE38B40BA853E179B7550669F612F60A6DD0B0C03DF55C1316C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State
Size 3KB
SHA256 8d9c45b75a7aedfc747a00edfcb44f5edaaf9a83148b7862c4a40a2182acb8da
MD5 4e084041ef628cad551da0359c2aa80b
SHA1 c7c27a6cd32c329b43abb9c10676e7dcb1830ebf
SHA512 3836c8efff403e288ff9f35252143ec08e7217502ca77dfa1aa3358219ac8984c3c12587805f322cb25f758e0377771625f5c9f86217e4aecd402feac508c95c
TLSH
T125719577A964EA2B4DF3DA00B9C52F06A7A15127DA903FA4D6ED0F0C03DF6981352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58a572.TMP

Path C:\Users\Admin\AppData\Local\BlurAutoClicker\EBWebView\Local State~RFe58a572.TMP
Size 1KB
SHA256 d065d146309390f338c3bd85b9daef85982a2dcc64fff56396a3e060246bf078
MD5 b321e4fe5012510ad79ece6b5b916450
SHA1 4e73744c64d1514a71ec4553754f1acf425906d4
SHA512 c3e4934300165935871b1ef48e33b5d9d67da869237b71af9c4e4204949bbe3168e51cc0fa92f3abcb5f293ee572e253bebad702380f8013787b848ad0256a98
TLSH
T1B02135B3D598BB776D528A41B3827D4F1E50506997205F18E1DD471C03EF99C8A3AC73
MD5 SHA1 SHA512 TLSH

Submit Download

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 885b25ef35c5a444c3f18b1d816534821744bf3cda19d0eda4f72e0766a19d94
MD5 7bf9e493c3f123d7ea1371dd83fff13d
SHA1 aab433951bb29936f6023995aac1de58b4e94565
SHA512 48a5564beb0918f1dbd2f25d00456c5fd01d410bc05b8542748ddb4c3d3631fbdb1c7eb79745bd48141fef3922de6b72e02cd76e3ebc32bccc837f6918f3c3e1
SSDEEP 384:HPC9iO024Yko6J+Sl1xDnZBPsac4j0lpDII+/GU:v9ZYko0+Sl7zZlsac4ID8Lz
TLSH
T1F8527DB99F013CAA2926D5E4D9AE9244CD08A6BBEED2D05616143C04CA447B9F4F68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 13KB
SHA256 3707247bf93bc782ee9a5d0e2052172e40072b830e007029a2338d4c02a530a6
MD5 204a7c2d096acffd218886d218f1735b
SHA1 652eb16aa26a41656e81183252431c66b81390e9
SHA512 252fa5c206048a45db797d3c867d83bade530913f99a06864052eaabcea1b9f10c418137cb852be20676d753b5e3c9ad3a204c938406004a45160fc5b4a5e5cc
SSDEEP 384:H9XghOiO024YQo6J+Sl1xDnZBPsac4j0lpDII+Qhs:dX+ZYQo0+Sl7zZlsac4ID8LD
TLSH
T148529DBE9F0138AA1D27D195D9BE9244CD04B6BBEEE2C16616143C04CA487B9F4E24CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy591A.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsy591A.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy591A.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy591A.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 211aa25de2dfcba0c96cadd6a653fac3e091c135d2174b075c051b68489a1137
MD5 a493470d3ee70947a488c3fd26def6b4
SHA1 61b57ea0111465b6a70bcdc00a3990a75f74873b
SHA512 c6da6b2e4336ecdbf486db15d49dd3e2938b09e156841a0405e264400f412854afca90458a4d4f8e57814a8144dbf1aac0af815b2d2ebc71538280bfe6325ab8
SSDEEP 192:kOv5zboz3ZP2yjY7ATBJcc1d66Joz0dzgCl6mc0dz:nborZP2yjQGd66JozQzgC1jd
TLSH
T11AD1EE28E629863BC418123BCCA51B500F36395A9C4E3F2536EC641D2D572DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 dd2b5f8bfcc2936e762dce8af058647db77dbf70dc232c1c5c001e1c4c906958
MD5 d86101d094cbab98f664dc3c18369757
SHA1 0e4bc538adca426c8bd768ee5df58362ca84d424
SHA512 d194df4a1424012f3446821d581e9324c13e60898259cacdb3680f50150230c3f07d1a770004cb393976582cf71b7fc58a6cabf83e5a36190fcdd2b3c37173b7
SSDEEP 192:VATBJcc1d66Joz0dzgCl6mc0d6Ov5zboHz3ZP2yj6+:tGd66JozQzgC1jPboLZP2yj
TLSH
T1E3E13264EA28867FC418127BCCA51B404F36399ADC4E3F18359C641C2D572DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 5345b34189c6a5630c6db85b8fcd386cefcf56ee087ca330f5206e9b0375b9cb
MD5 dfe3f4323dc5ce365ff89f37380df8d2
SHA1 4f5e85b47a03b1744b9040b3bfdffd59c8684570
SHA512 640f3a7e5a21abc34a4b8ed06c03a1260085c38adbf9a1a578b7a4e94b247ec67d514ee8274c48d37296d33829d1308b91f716e28767688634a6e710bb5db089
SSDEEP 96:JdSdF95/7bkW6QXjrcEP2yUR6JWZAF12FRAzFRtFRVFRcc/dd66Joz0dzgClKtm5:POv5zboobP2yjY7ATBJcc1d66Joz0dzr
TLSH
T159C1ED28F639863BC458123BCCA51B500E32355BAC5E7F2536EC64092D572DE7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5e9c32fc88ec55d296edd34e7a2a26dd21df5834fa2d53ff25238ef0b1d971b6
MD5 bd550b9b874442488a085f97332dc917
SHA1 73dd228ce61ca6ac4f12ef3bfa3e27a638b7685f
SHA512 44b7c331a4f71b66fd5d48ccbc3da2b3d8d37d78ed0499f332bb1cbcde97586c0c487784eb2d236084c66ec517300d78bca5002eada513c2b268dd59d2aec766
TLSH
T11E11C0CC3DF84D29AC87E2AC7441028D53658E02C5A75C474E12EFCECE84AD9326E43C
MD5 SHA1 SHA512 TLSH

Submit Download

33413428-1470-4616-a7f5-2799a594f4f8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\33413428-1470-4616-a7f5-2799a594f4f8
Size 886B
SHA256 5a19c30b420fdac3ffc2f90d560439741418077129fbdc5db975fc603c871ffe
MD5 88295be48dcd827633ef556b431572f0
SHA1 afd6d548ad3af02ec1be1b6ec37000e7f6d3872a
SHA512 d4fa9d0eb78bb199729a95b0b8892f12426ecd2cdd074c8e54fe3413fc17c9683a7a07ff6dc807150d27c8bfc8f7e3ecf71a8917af44fe9238a010d3f76a19ec
TLSH
T14D1100408921B5B2CC68A35FD9A5771186E4712380C90D287FA55B280EBA51EF767B07
MD5 SHA1 SHA512 TLSH

Submit Download

3360c3e7-ee4b-46ef-9167-15e9758bf464

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\3360c3e7-ee4b-46ef-9167-15e9758bf464
Size 235B
SHA256 cabd377f361b6b261b36a07a91100ac56ca0a56dff9b44ab1509bdbed7b79d5e
MD5 fc490ae4275cb84138ecefa5bec13e5b
SHA1 7e5e5f759538f7f69f3a8e7ab3c2d3f66ebb84da
SHA512 6911687328afdc01a875efb13357e888a1cecaa6dde09fdf7a4ba992ef83330586d87591b07cad56e13e8a5a4dbbe3b12d24a8dffc3bdab1f2a67e8495e5c20e
TLSH
T19BD097896488A71D08040F06F0A62AC230488C332460A8208AA240749AFCEC40162E5B
MD5 SHA1 SHA512 TLSH

Submit Download

6282e99e-4371-4ffe-874b-658f5bc54728

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\6282e99e-4371-4ffe-874b-658f5bc54728
Size 16KB
SHA256 4359e53d15bbc7a1f2a53ecfbc618e5fea49e288a39f123781bc0213858305f5
MD5 54f9e3b0ef2a8b5f76684868e0454adf
SHA1 1f12d0e25e0eab71a576dbe92692d91203b58fd0
SHA512 c63d68eb81725f28959c90ce1f4c2444035d05eb9cac52c4e90b4e65cbf4763916b0b4edc8227acacaaf42057f0850bf6641b51266be3d578dd7869996cbbfa5
SSDEEP 192:zN6BtB+1Mz4dxhcCwHoD+7i6SzXuLtzCn0RTtYM/xSDi6wNE3IRCtXwpGpZ:utShcjZ7i6Sz+Lt3RVcaCtAgpZ
TLSH
T16A72A9566420457AC251E36894ECBFC3E6F538CF4C419FCA9BE4BD085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c17e8be-2e7e-4fce-952e-fba25b53adaa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\7c17e8be-2e7e-4fce-952e-fba25b53adaa
Size 2KB
SHA256 8c36a310a1e58ab82fd2682d0a025509e92aa00c70dbc24494ee51141e58de8f
MD5 b2e27571fd34fbec6a66a697c76bc8ad
SHA1 b2de012f9c41a5a7393c6464e2481aeadbdd8ae2
SHA512 aa1bc6172df55f80a669f01884cc3d95e890afed02b9cf59c56329215d6493be3f6ae06d9ef925e7ba903d78d19e715385a16b1c0835ed8e7f4f2aaec7049aab
TLSH
T19E41311C75749CB79CDAF5DD9483328D57708A0204C51C832EA2DF0C8C9A69D237B97B
MD5 SHA1 SHA512 TLSH

Submit Download

87b7a09a-2d94-423c-b3a8-9618c62e4272

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\87b7a09a-2d94-423c-b3a8-9618c62e4272
Size 235B
SHA256 adb9675238956915897c717f0fa660b532d04a7aa867e94dbf92dc893e0d372e
MD5 e10bedaa9cd6b56e055bf14c02365382
SHA1 3ae480c58fc50fdefa7c3a62a413ad0fbf0db56a
SHA512 a7eb6853e54f8b4d1417bd3a4e2cff4cba1b017a1b837a037e9ad3a43905224bda2ec6d8da9c76f0fa35fc5703f34487026fd7d83e0dc760825c5f1700f7d5cb
TLSH
T171D097C414D8B35C08040F13F4A06AC630588C33A9A458608A62063C99BEAC80262D27
MD5 SHA1 SHA512 TLSH

Submit Download

9ea0a79f-e871-4aee-8741-7a6d53924836

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\9ea0a79f-e871-4aee-8741-7a6d53924836
Size 883B
SHA256 0f2b026ab73b910d43a34fa5b92c2c4d5b06326636842d75c32255032fa662a6
MD5 ea61c4b30f45631e1176dab7fd3b6c7f
SHA1 d8fcf8fb67d8314a9cdd0fce4c4cc2e504c8cf7e
SHA512 d28713faf18254772e432e596476034b8e144a2483dc7018263418d843290056a0e48666c47efa5478f32bba7d4260f245192624f03385679c1e0149a3300ca9
TLSH
T1C5110080A930B4F2CC78A20FC95577118BF8712384C594142EE65E140DBEA1EA35AF5B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\extensions.json
Size 16KB
SHA256 93ad4958920ee63fbb6d7f7e97b1e5416c60e151252e14c7cb195c02671a9be9
MD5 2d401cca5863ffcbce887c21a33d0399
SHA1 7471e965414a02c14d9baa30be1ae12b61ca96b8
SHA512 67444471127878d228084907b5619bf2b700d94afa1a0718c3166715c0d51fde35908ccd2e87d59c98a65f031c95f908d3494f4bcd1868ca01220885a6fccb14
SSDEEP 384:OkI4vTUmldvOz8dhWA94zvH96oLL4HvL4PjL4H3L4Hh0nL4Hr14hk:hI47Rf3XJ4x604T434b4BY4J4K
TLSH
T1D672421545048E78298EA78BAA367E01C37D573B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
Size 6KB
SHA256 cf91eb6693e6f18fb963c39e5ae1410f59e388d3e0cda6eae6988ad92fecbe48
MD5 efc0004994045d452899729a6850219d
SHA1 b2dbd4616808eeec2b04d55512cf1c8c8d861bce
SHA512 80a7d405b607c161239eb29038a87fd519fdff1a265f1240ab6b53da76c0fcc602e6e1cbf8f71e651ef34bc65e6bf9a0d26dc43531e3935b92bdf02f5f3154eb
SSDEEP 96:xHNUTUwPqGqznfkd11zSUSSl5dv9j9nGSRHyuCRBw88H8L4cnHNq:/gCRzfkd1NSSkS9QBw883
TLSH
T132E11F7894088B7F74B6776CAC6888716AB2013BBBBF68C750B55485050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 6KB
SHA256 4af65127e2c60a5e830a5f41a23df3c941bb3199c0db4d5ab63d8b717012b530
MD5 3ad04cacbe9ae61369884bb0b875127d
SHA1 12263074aa0334218b81048ad4f0a970419f8927
SHA512 a043c0261a34621ce476ff87e4ed19ac8c1cd001b4a3defcd88fb6196fb663e7d07206c0105d866221bbfa54723e9fc6fb675b41d7537ecb4386be6963d3e058
SSDEEP 96:xHNUTUVqGqznfkWA1zS6cSSl5dv9jxnGSRHyuCRBw88H8L4cnHNq:/4RzfkWA3cSSYS9QBw883
TLSH
T114E1207854088F7F74B677ACAC6888716AB2013B7BBF68C350B55484050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 6KB
SHA256 59f6694531b3524b0f11a8a106b9daf6ee52fe1947605099d6bb4c41daf277de
MD5 a80e010a6080768d634913f3798ff10d
SHA1 8913f075fa65d4f614a593f7a4cd3862ddbb2a25
SHA512 1e305643f1106909925d642223c43234564713a14abf00291039524fa1a961a684254f3e205681ee86b2d3c708809e450a483bf74231cf14ef9f146b8565fb81
SSDEEP 96:xHNUTUVqGqznfkd11zSUSSl5dv9jxnGSRHyuCRBw88H8L4cnHNq:/4Rzfkd1NSSYS9QBw883
TLSH
T180E1307894088F7F74B6776CAC6888716AB2013BBBBF68C750B55485050CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 6KB
SHA256 997f53de23d934b2f126ff164373eb9fa0e97a1083fa75cf22c982fcfeec1a52
MD5 e81e1f50294690c755be15ab93235b60
SHA1 b401c906bf22ba33eed0dc315129b51d4041c5da
SHA512 4510927d9ed392aa8703798ede2e4b081e991f252ff72b678649beee4624dcda4c88511fda6119106404515921b5fde0789d723b0dd10527ef1da5e58ee4e701
SSDEEP 96:xHNUTUwPqGqznfkd1ObzSUSSl5dv9j9nGSRHyuCRBw88H8L4cnHNq:/gCRzfkd1KSSkS9QBw883
TLSH
T194E11E7894088B7F74B6766CAC6888716AB2013BBBBF68C350B554C5051CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 7KB
SHA256 ac87ba790f86a1d75e48fdb5b2d4accc7e1fe271c3037d5bde1e221c1990e886
MD5 ea1623cf20c66fbcc23864fef7187352
SHA1 e6c71e74d9517a6ca5f7fa3815a8872285c09ff7
SHA512 f5df806c1146cee3d55eff4dc36d473c7f998f96a2c86c87871fd9a8527cfb493d7ccb13e5b22e7d487daf6c12888ce51cc3b11d6962b1e5c45ded0b2b995083
SSDEEP 96:xHNdTUwPqGqznffd1ObzSUSSl5dv9j9nGSRHyuCABw88g8L4cnHRq:/RCRzffd1KSSkS9ZBw88g
TLSH
T162F1FE789414CB7F74B6777CAC2488715AB2023BBBBF68C214B95495050CF3446FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b7ab4b6ca3d0953a5652d57334c606e5034ebb590f4a9d7493418803ae68387c
MD5 e319fcea92abb15ba4b06567d28cc53b
SHA1 0e0b5482356a5960f00fa8ed5894b0f6e9e5247e
SHA512 3b4be5cf6e93f2982180a1b9903613542b69c12d09dad0a5c3af1e0e9271748dda523de9de032b37821d5ca7dd3ea13fc76a1dae487cff8d40663f49671025d5
TLSH
T1CC210883C4672DEAFE6001AAD8440FB4C52730254D718CF0925EAF84E1DE8463B8F209
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.4MB
SHA256 7fb07c4a54a5f03ee55b466ee5cb00e15366fa4635c3e837799196b5cfd0b446
MD5 c1c5f3aa3c5a01570f63eccd7578f9b0
SHA1 285d71a09b895a9f852a2e9d27db9ec564ea272b
SHA512 50535f45aacb7396d48228240e73d040ad834d731c8ff1547dcda880d778a4f7f3a16d4df4b679128b4a6d2493ddf0d67d584287dcaba4369d7e6c440e9690f1
SSDEEP 24576:BEpKTU5DB1U1UJkvA7Y5OpZhGSIofj69hsB64bHkd1kj+RIyo51xUpE:BEpD5Q1UJkvgYUXpfj69hqbHkdaqRoY
TLSH
T1EE2629E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlurAutoClicker_3.4jM68rVX.8.3_x64-setup.exe.part

Path C:\Users\Admin\Downloads\BlurAutoClicker_3.4jM68rVX.8.3_x64-setup.exe.part
Size 5.9MB
SHA256 07b4f5003514fc245526913cd09769d30a565340405dc3524f4054c1ceac89fe
MD5 943175fbdda4acff6453295303375397
SHA1 b173e7532ec53a7d305ec2efbedf80c3862b78fb
SHA512 ef9ef11944b13ce365a746a6d82b3dc702ea9decc3550fc07fcea1d907363d9234e7a233956cb47dad92c420f9f362a255ef2979bef7ce6692696bd84961ac0e
SSDEEP 98304:t/Yl+xgOGp3o911XGFQtZiEMIQ2Lrjxufi35FGCmkyGGOmlfUFTpyF/cz/vTLGUs:tq+03A11XGyniEY2LH9oqSsPu/cz/vWR
TLSH
T17E56336619DDBAF3F1FE2E740C0789516AF83540445DCB98E316B781AEA2B1CCC5C88E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1692-1157-0x000001E779090000-0x000001E77913E000-memory.dmp

Download

memory/3348-1158-0x000002089C040000-0x000002089C0EE000-memory.dmp

Download

memory/5152-1140-0x0000018CFC210000-0x0000018CFC2BE000-memory.dmp

Download

memory/5152-533-0x00007FFCCD980000-0x00007FFCCD981000-memory.dmp

Download

memory/5536-426-0x00007FFCCD980000-0x00007FFCCD981000-memory.dmp

Download

memory/5536-1139-0x0000020E16540000-0x0000020E165EE000-memory.dmp

Download