| URL: | http://www.free-auto-clicker.com/FreeAutoClicker.exe |
| Full analysis: | https://app.any.run/tasks/a74a35df-3aaf-4d39-9c47-0efa46307026 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | May 30, 2020, 18:20:50 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | BF325F38E7088ED80BEE98642DE7B414 |
| SHA1: | B52DB8A655A50C84A2FC9881752C1321B23F6716 |
| SHA256: | 9511F60FC637C08CFD62009BB5EAA8F77B61B35083DA3E87C72083AD6B661A68 |
| SSDEEP: | 3:N1KJS4LgsIsy0X+aCGOtdA:Cc4MsIpPGOtC |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 876 | "C:\Program Files\Free Auto Clicker\goup.exe" | C:\Program Files\Free Auto Clicker\goup.exe | FreeAutoClicker.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 892 | "C:\Program Files\Opera\opera.exe" | C:\Program Files\Opera\opera.exe | explorer.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Exit code: 0 Version: 1748 Modules
| |||||||||||||||
| 956 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,9725222686499218508,15950612015003934839,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=382609601764195679 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1192 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.3.586440664\1108918970" -childID 1 -isForBrowser -prefsHandle 1708 -prefMapHandle 1704 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 1680 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 68.0.1 Modules
| |||||||||||||||
| 1448 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,3477584900083640822,2596086634742840404,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=17086649041196337501 --mojo-platform-channel-handle=1632 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: HIGH Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1592 | "C:\Users\admin\AppData\Roaming\Free Auto Clicker New Version Available\FreeAutoClicker.exe" /SPAWNWND=$2022C /NOTIFYWND=$20224 | C:\Users\admin\AppData\Roaming\Free Auto Clicker New Version Available\FreeAutoClicker.exe | FreeAutoClicker.tmp | ||||||||||||
User: admin Company: FreeAutoClicker Co., Ltd. Integrity Level: HIGH Description: Free Auto Clicker Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 1660 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1032,14979628979298711869,785442474643066187,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=16955154998999699280 --mojo-platform-channel-handle=1052 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1780 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 1073807364 Version: 68.0.1 Modules
| |||||||||||||||
| 2248 | "C:\Users\admin\Downloads\FreeAutoClicker.exe" | C:\Users\admin\Downloads\FreeAutoClicker.exe | chrome.exe | ||||||||||||
User: admin Company: FreeAutoClicker Co., Ltd. Integrity Level: MEDIUM Description: Free Auto Clicker Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 2272 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,14979628979298711869,785442474643066187,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=10965893643755361503 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2504 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| (PID) Process: | (2824) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2824) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2824) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (2824) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (2824) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2692) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 2824-13235336464778250 |
Value: 259 | |||
| (PID) Process: | (2824) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (2824) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (2824) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3120-13213713943555664 |
Value: 0 | |||
| (PID) Process: | (2824) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2824 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5ED2A411-B08.pma | — | |
MD5:— | SHA256:— | |||
| 2824 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\62fc9448-fe66-4255-96bf-e35909e0f501.tmp | — | |
MD5:— | SHA256:— | |||
| 2824 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2824 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:— | SHA256:— | |||
| 2824 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:— | SHA256:— | |||
| 2824 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF7cc75.TMP | text | |
MD5:— | SHA256:— | |||
| 2824 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF7cc95.TMP | text | |
MD5:— | SHA256:— | |||
| 2824 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old | text | |
MD5:— | SHA256:— | |||
| 2824 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2824 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF7ce79.TMP | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2328 | FreeAutoClicker.tmp | GET | 200 | 52.212.91.170:80 | http://rp.appuniverseapplication.com/ | IE | — | — | malicious |
3812 | rkinstaller.exe | GET | 304 | 205.185.216.10:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | — | — | whitelisted |
3812 | rkinstaller.exe | GET | 304 | 205.185.216.10:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | — | — | whitelisted |
3812 | rkinstaller.exe | GET | 304 | 205.185.216.10:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | — | — | whitelisted |
2328 | FreeAutoClicker.tmp | POST | 200 | 52.212.91.170:80 | http://rp.appuniverseapplication.com/ | IE | — | — | malicious |
2328 | FreeAutoClicker.tmp | POST | 200 | 52.212.91.170:80 | http://rp.appuniverseapplication.com/ | IE | — | — | malicious |
2328 | FreeAutoClicker.tmp | GET | 200 | 165.193.78.234:80 | http://post.securestudies.com/packages/RI1034/ContentI3.exe | US | executable | 412 Kb | malicious |
2276 | chrome.exe | GET | 200 | 172.104.13.22:80 | http://www.free-auto-clicker.com/FreeAutoClicker.exe | US | executable | 3.29 Mb | malicious |
2328 | FreeAutoClicker.tmp | POST | 200 | 52.209.230.43:80 | http://os.appuniverseapplication.com/ | IE | binary | 249 Kb | malicious |
2328 | FreeAutoClicker.tmp | GET | 200 | 205.185.216.10:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 57.0 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2276 | chrome.exe | 216.58.213.163:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2276 | chrome.exe | 172.104.13.22:80 | www.free-auto-clicker.com | Linode, LLC | US | malicious |
2276 | chrome.exe | 216.58.215.36:443 | www.google.com | Google Inc. | US | whitelisted |
2328 | FreeAutoClicker.tmp | 52.212.91.170:80 | rp.appuniverseapplication.com | Amazon.com, Inc. | IE | malicious |
2328 | FreeAutoClicker.tmp | 52.209.230.43:80 | os.appuniverseapplication.com | Amazon.com, Inc. | IE | malicious |
2328 | FreeAutoClicker.tmp | 165.193.78.234:80 | post.securestudies.com | Savvis | US | malicious |
2328 | FreeAutoClicker.tmp | 205.185.216.10:80 | www.download.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
3812 | rkinstaller.exe | 165.193.78.234:443 | post.securestudies.com | Savvis | US | malicious |
3812 | rkinstaller.exe | 205.185.216.10:80 | www.download.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
3812 | rkinstaller.exe | 104.126.237.21:443 | dpd.securestudies.com | Akamai Technologies, Inc. | US | unknown |
Domain | IP | Reputation |
|---|---|---|
www.free-auto-clicker.com |
| malicious |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
www.google.com |
| malicious |
ssl.gstatic.com |
| whitelisted |
sb-ssl.google.com |
| whitelisted |
rp.appuniverseapplication.com |
| malicious |
os.appuniverseapplication.com |
| malicious |
post.securestudies.com |
| malicious |
dpd.securestudies.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2328 | FreeAutoClicker.tmp | Misc activity | ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M2 |
2328 | FreeAutoClicker.tmp | Misc activity | ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M1 |
2328 | FreeAutoClicker.tmp | Misc activity | ADWARE [PTsecurity] InnoTools Download PE file |
2328 | FreeAutoClicker.tmp | Misc activity | ADWARE [PTsecurity] InnoTools Downloader |
2328 | FreeAutoClicker.tmp | Misc activity | ADWARE [PTsecurity] InnoTools Download PE file |
2328 | FreeAutoClicker.tmp | Misc activity | ADWARE [PTsecurity] InnoTools Downloader |
2328 | FreeAutoClicker.tmp | Misc activity | ADWARE [PTsecurity] InnoTools Downloader |
2328 | FreeAutoClicker.tmp | Misc activity | ADWARE [PTsecurity] InnoTools Downloader Check-in |
2328 | FreeAutoClicker.tmp | Misc activity | ADWARE [PTsecurity] InnoTools Downloader |
2328 | FreeAutoClicker.tmp | Misc activity | ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M3 |