Windows Analysis Report
http://www.5movierulz.mom

Overview

General Information

Sample URL:	http://www.5movierulz.mom
Analysis ID:	1538455
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Performs DNS queries to domains with low reputation

Queries memory information (via WMI often done to detect virtual machines)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTML body with high number of embedded images detected

HTML page contains hidden javascript code

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Classification

Signatures

HTML body with high number of embedded images detected

Source: https://syncfreeuberthe-file.top/hTECdNI_CXQCZ4NZwjDnQiy61ZmYwMsaU6UD7OMil6M/?cid=80914XzDr25J06&sid=394_NTI0

HTTP Parser: Total embedded image size: 20831

HTML page contains hidden javascript code

Source: https://www.5movierulz.mom/

HTTP Parser: Base64 decoded: 1729499595.000000

Source: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYnBNPTo6WMNoeG8uCf7x14IWm_iVcA	HTTP Parser: No favicon
Source: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYnBNPTo6WMNoeG8uCf7x14IWm_iVcA	HTTP Parser: No favicon
Source: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYnBNPTo6WMNoeG8uCf7x14IWm_iVcA	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0KEB0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6GE5G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-F3RC7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6KBP3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-87DHK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-O9D5K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-L257R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-VE7A3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-CRA9L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0CSCM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-H2EM6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-5598U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-3HHMQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-KTLDF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-9TFL3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-BB1AB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-UEA0R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-QGFEN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0PK67.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-1P3N2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-LIGJH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-EDLB4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-PJAFC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-BRFBS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-1ENUK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-9FRHH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-VMGQA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6FJPH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-UV5LR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-HFM4K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-IP3KO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-M8N4O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\is-S0GGU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-MCER5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-F6BGF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-V8S6A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\AutoClickerUpdate.bat

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.161.82.109:443 -> 192.168.2.16:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49993 version: TLS 1.2

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us.boxthis.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us.boxthis.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us.wenga.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us.wenga.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: www.5movierulz.momConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.5movierulz.mom
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: acscdn.com
Source: global traffic	DNS traffic detected: DNS query: youradexchange.com
Source: global traffic	DNS traffic detected: DNS query: pubtrky.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: track.starmobmedia.com
Source: global traffic	DNS traffic detected: DNS query: mode.heptix.net
Source: global traffic	DNS traffic detected: DNS query: syncfreeuberthe-file.top
Source: global traffic	DNS traffic detected: DNS query: feed.rtbadshubmy.com
Source: global traffic	DNS traffic detected: DNS query: sdk.ocmhood.com
Source: global traffic	DNS traffic detected: DNS query: t.rtbadshubmy.com
Source: global traffic	DNS traffic detected: DNS query: cdn.ocmtag.com
Source: global traffic	DNS traffic detected: DNS query: t.ocmhood.com
Source: global traffic	DNS traffic detected: DNS query: cdn.ocmhood.com
Source: global traffic	DNS traffic detected: DNS query: plus.affflow.com
Source: global traffic	DNS traffic detected: DNS query: reloadsreviews.top
Source: global traffic	DNS traffic detected: DNS query: cap.affiliatrack.com
Source: global traffic	DNS traffic detected: DNS query: utilitysafe-view.info
Source: global traffic	DNS traffic detected: DNS query: url.giveaff.com
Source: global traffic	DNS traffic detected: DNS query: ssventp.com
Source: global traffic	DNS traffic detected: DNS query: p.awesomefa.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: e.autocclick.com
Source: global traffic	DNS traffic detected: DNS query: ny-feed.rtbadsmenetwork.com
Source: global traffic	DNS traffic detected: DNS query: ny-t.rtbadsmenetwork.com
Source: global traffic	DNS traffic detected: DNS query: cdn.amnew.net
Source: global traffic	DNS traffic detected: DNS query: us.boxthis.xyz
Source: global traffic	DNS traffic detected: DNS query: us.wenga.xyz

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.161.82.109:443 -> 192.168.2.16:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49993 version: TLS 1.2

One or more processes crash

Source: C:\Program Files\AutoClicker\AutoClicker.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3252 -s 1972

Source: classification engine

Classification label: mal48.troj.evad.win@43/120@109/322

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3252
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5760:120:WilError_03

Source: C:\Users\user\Downloads\HUY.exe

File created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "

Source: C:\Users\user\Downloads\HUY.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Downloads\HUY.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Downloads\HUY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.5movierulz.mom"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6372 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6372 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6712 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\HUY.exe "C:\Users\user\Downloads\HUY.exe"
Source: C:\Users\user\Downloads\HUY.exe	Process created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp "C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp" /SL5="$E0078,1361471,857600,C:\Users\user\Downloads\HUY.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6712 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Program Files\AutoClicker\AutoClicker.exe "C:\Program Files\AutoClicker\AutoClicker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\AutoClicker\AutoClicker.exe AutoClicker.exe /update
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\HUY.exe "C:\Users\user\Downloads\HUY.exe"
Source: C:\Users\user\Downloads\HUY.exe	Process created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp "C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp" /SL5="$E0078,1361471,857600,C:\Users\user\Downloads\HUY.exe"
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3252 -s 1972
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Program Files\AutoClicker\AutoClicker.exe "C:\Program Files\AutoClicker\AutoClicker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\AutoClicker\AutoClicker.exe AutoClicker.exe /update
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Downloads\HUY.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\HUY.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: apphelp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: mscoree.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: apphelp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: version.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dwrite.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wldp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: profapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: winnsi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dwmapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: d3d9.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: urlmon.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: iertutil.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: srvcli.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: netutils.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: propsys.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: winsta.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: powrprof.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: umpdc.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dataexchange.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: d3d11.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dcomp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dxgi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dxcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: textshaping.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: d3dcompiler_47.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wintypes.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wintypes.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wintypes.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: msctfui.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: mscoree.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: version.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dwrite.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wldp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: profapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: winnsi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: amsi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: userenv.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rasapi32.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rasman.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rtutils.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: mswsock.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: winhttp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: secur32.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: sspicli.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: schannel.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: msasn1.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: gpapi.dll

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\AutoClicker\AutoClicker.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0KEB0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6GE5G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-F3RC7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6KBP3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-87DHK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-O9D5K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-L257R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-VE7A3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-CRA9L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0CSCM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-H2EM6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-5598U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-3HHMQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-KTLDF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-9TFL3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-BB1AB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-UEA0R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-QGFEN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0PK67.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-1P3N2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-LIGJH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-EDLB4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-PJAFC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-BRFBS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-1ENUK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-9FRHH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-VMGQA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6FJPH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-UV5LR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-HFM4K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-IP3KO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-M8N4O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\is-S0GGU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-MCER5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-F6BGF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-V8S6A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\AutoClickerUpdate.bat

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-0KEB0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-HFM4K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-6KBP3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Users\user\AppData\Local\Temp\is-995L5.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Downloads\HUY.exe	File created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\a1f41e66-b911-4f6f-a1d6-c04ee74d607c.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-CRA9L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-M8N4O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-QGFEN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-BRFBS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-87DHK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-1P3N2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-6FJPH.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 531338.crdownload	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-EDLB4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-BB1AB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-0CSCM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-9FRHH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-L257R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-5598U.tmp	Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\Downloads\HUY.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Program Files\AutoClicker\AutoClicker.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PortConnector

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Memory allocated: 1A3F7740000 memory reserve \| memory write watch
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Memory allocated: 1A3F9220000 memory reserve \| memory write watch
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Memory allocated: 26A5C750000 memory reserve \| memory write watch
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Memory allocated: 26A760A0000 memory reserve \| memory write watch

Contains capabilities to detect virtual machines

Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: VBoxGuest
Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: vmci
Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: HGFS
Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: VBoxTrayIPC
Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: \pipe\VBoxTrayIPC
Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: VBoxMiniRdrDN

Contains long sleeps (>= 3 min)

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Program Files\AutoClicker\AutoClicker.exe

Window / User API: threadDelayed 3831

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-HFM4K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-6KBP3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-995L5.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-CRA9L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-M8N4O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-QGFEN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-BRFBS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-87DHK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-1P3N2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-6FJPH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-EDLB4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-BB1AB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-9FRHH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-0CSCM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-L257R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-5598U.tmp	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 5108	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 4016	Thread sleep count: 3831 > 30
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 4016	Thread sleep count: 156 > 30
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 3744	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 2868	Thread sleep time: -922337203685477s >= -30000s

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Program Files\AutoClicker\AutoClicker.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Process information queried: ProcessInformation

Checks if the current process is being debugged

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process queried: DebugPort
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process queried: DebugPort

Enables debug privileges

Source: C:\Program Files\AutoClicker\AutoClicker.exe

Process token adjusted: Debug

Source: C:\Program Files\AutoClicker\AutoClicker.exe

Memory allocated: page read and write | page guard

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Program Files\AutoClicker\AutoClicker.exe "C:\Program Files\AutoClicker\AutoClicker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\AutoClicker\AutoClicker.exe AutoClicker.exe /update

Queries the volume information (name, serial number etc) of a device

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\AutoClicker.exe VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.Console.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.File.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Text.Json.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Memory.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Buffers.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Text.Encodings.Web.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Numerics.Vectors.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Resources\Icons\location-crosshairs-solid.ico VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\AutoClicker.exe VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.Console.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.File.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Text.Json.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Memory.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Buffers.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Text.Encodings.Web.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Numerics.Vectors.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Source: C:\Program Files\AutoClicker\AutoClicker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.214.25	mode.heptix.net	United States	13335	CLOUDFLARENETUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
2.16.164.105	unknown	European Union	20940	AKAMAI-ASN1EU	false
142.250.74.200	unknown	United States	15169	GOOGLEUS	false
104.21.60.90	ny-t.rtbadsmenetwork.com	United States	13335	CLOUDFLARENETUS	false
23.111.151.106	track.starmobmedia.com	United States	29802	HVC-ASUS	false
54.196.173.211	url.giveaff.com	United States	14618	AMAZON-AESUS	false
142.250.181.234	unknown	United States	15169	GOOGLEUS	false
104.26.7.228	t.ocmhood.com	United States	13335	CLOUDFLARENETUS	false
172.67.195.2	ny-feed.rtbadsmenetwork.com	United States	13335	CLOUDFLARENETUS	false
109.200.209.144	us.wenga.xyz	Netherlands	49544	I3DNETNL	true
142.250.110.188	mobile-gtalk.l.google.com	United States	15169	GOOGLEUS	false
172.67.169.246	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.141.52	plus.affflow.com	United States	13335	CLOUDFLARENETUS	false
104.21.29.251	reloadsreviews.top	United States	13335	CLOUDFLARENETUS	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
104.21.37.234	cap.affiliatrack.com	United States	13335	CLOUDFLARENETUS	false
104.21.91.188	youradexchange.com	United States	13335	CLOUDFLARENETUS	false
185.199.110.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.26.6.228	cdn.ocmhood.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
104.21.8.108	pubtrky.com	United States	13335	CLOUDFLARENETUS	false
172.67.134.219	utilitysafe-view.info	United States	13335	CLOUDFLARENETUS	false
104.21.76.3	t.rtbadshubmy.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.110	android.l.google.com	United States	15169	GOOGLEUS	false
140.82.121.3	github.com	United States	36459	GITHUBUS	false
104.18.21.226	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.63.53	www.5movierulz.mom	United States	13335	CLOUDFLARENETUS	false
142.250.186.106	unknown	United States	15169	GOOGLEUS	false
18.173.205.6	p.awesomefa.com	United States	3	MIT-GATEWAYSUS	false
109.200.199.111	cdn.adx1.com	Netherlands	49544	I3DNETNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	syncfreeuberthe-file.top	European Union	13335	CLOUDFLARENETUS	false
3.161.82.109	e.autocclick.com	United States	16509	AMAZON-02US	false
188.114.96.3	acscdn.com	European Union	13335	CLOUDFLARENETUS	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
64.233.184.84	unknown	United States	15169	GOOGLEUS	false
172.67.184.145	feed.rtbadshubmy.com	United States	13335	CLOUDFLARENETUS	false
31.204.132.207	us.boxthis.xyz	Netherlands	49544	I3DNETNL	true
142.250.186.40	unknown	United States	15169	GOOGLEUS	false
172.217.16.196	unknown	United States	15169	GOOGLEUS	false
172.67.72.9	sdk.ocmhood.com	United States	13335	CLOUDFLARENETUS	false
18.245.46.34	ssventp.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
us.boxthis.xyz	31.204.132.207	true
t.ocmhood.com	104.26.7.228	true
url.giveaff.com	54.196.173.211	true
pubtrky.com	104.21.8.108	true
mobile-gtalk.l.google.com	142.250.110.188	true
acscdn.com	188.114.96.3	true
cap.affiliatrack.com	104.21.37.234	true
youradexchange.com	104.21.91.188	true
p.awesomefa.com	18.173.205.6	true
plus.affflow.com	172.67.141.52	true
www.google.com	142.250.186.36	true
ny-feed.rtbadsmenetwork.com	172.67.195.2	true
www.5movierulz.mom	104.21.63.53	true
utilitysafe-view.info	172.67.134.219	true
ny-t.rtbadsmenetwork.com	104.21.60.90	true
android.l.google.com	142.250.185.110	true
track.starmobmedia.com	23.111.151.106	true
a.nel.cloudflare.com	35.190.80.1	true
cdn.adx1.com	109.200.199.111	true
github.com	140.82.121.3	true
raw.githubusercontent.com	185.199.110.133	true
t.rtbadshubmy.com	104.21.76.3	true
sdk.ocmhood.com	172.67.72.9	true
syncfreeuberthe-file.top	188.114.97.3	true
ssventp.com	18.245.46.34	true
e.autocclick.com	3.161.82.109	true
mode.heptix.net	172.67.214.25	true
us.wenga.xyz	109.200.209.144	true
feed.rtbadshubmy.com	172.67.184.145	true
reloadsreviews.top	104.21.29.251	true
cdn.ocmtag.com	188.114.97.3	true
cdn.ocmhood.com	104.26.6.228	true
cdn.amnew.net	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.5movierulz.mom/	false	unknown
https://reloadsreviews.top/XUDfxjuxZ9drpIGAH7ZoIeLtrnNIQEq00hsXKpMlE30/?cid=ZxYR5l0kMgcAGXZ4AA9q0wBVNZAAAAAA&sid=81969&s=0.001000	false	unknown
https://www.5movierulz.mom/	false	unknown
https://syncfreeuberthe-file.top/hTECdNI_CXQCZ4NZwjDnQiy61ZmYwMsaU6UD7OMil6M/?cid=80914XzDr25J06&sid=394_NTI0	false	unknown

HTML body with high number of embedded images detected

Source: https://syncfreeuberthe-file.top/hTECdNI_CXQCZ4NZwjDnQiy61ZmYwMsaU6UD7OMil6M/?cid=80914XzDr25J06&sid=394_NTI0

HTTP Parser: Total embedded image size: 20831

HTML page contains hidden javascript code

Source: https://www.5movierulz.mom/

HTTP Parser: Base64 decoded: 1729499595.000000

Source: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYnBNPTo6WMNoeG8uCf7x14IWm_iVcA	HTTP Parser: No favicon
Source: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYnBNPTo6WMNoeG8uCf7x14IWm_iVcA	HTTP Parser: No favicon
Source: https://ssventp.com/download/U1F6a3JwNXBaaG9OZ21pMkNVSnd1R0pmK09DNllOZExPNlVINnk2TFBsb2V4bnF1Y09vdmQ4WFAyYmRobHBEMkdyQTA0Qmx6WEhSYldIQ20zV1F1OHhVeEFISE43d2J2QlAwTkxNYnFGRm1jdWdiZUpKeG45UEhIUHorb0EyUFBYMGVpb3JYKzFnZnVlV2RJKzd0WkxzVXVyejdFbWdZOVpTQkRlN0xJYnBNPTo6WMNoeG8uCf7x14IWm_iVcA	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0KEB0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6GE5G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-F3RC7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6KBP3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-87DHK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-O9D5K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-L257R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-VE7A3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-CRA9L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0CSCM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-H2EM6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-5598U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-3HHMQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-KTLDF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-9TFL3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-BB1AB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-UEA0R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-QGFEN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0PK67.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-1P3N2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-LIGJH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-EDLB4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-PJAFC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-BRFBS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-1ENUK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-9FRHH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-VMGQA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6FJPH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-UV5LR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-HFM4K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-IP3KO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-M8N4O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\is-S0GGU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-MCER5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-F6BGF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-V8S6A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\AutoClickerUpdate.bat

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.161.82.109:443 -> 192.168.2.16:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49993 version: TLS 1.2

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us.boxthis.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us.boxthis.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us.wenga.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: us.wenga.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: www.5movierulz.mom
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: acscdn.com
Source: global traffic	DNS traffic detected: DNS query: youradexchange.com
Source: global traffic	DNS traffic detected: DNS query: pubtrky.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: track.starmobmedia.com
Source: global traffic	DNS traffic detected: DNS query: mode.heptix.net
Source: global traffic	DNS traffic detected: DNS query: syncfreeuberthe-file.top
Source: global traffic	DNS traffic detected: DNS query: feed.rtbadshubmy.com
Source: global traffic	DNS traffic detected: DNS query: sdk.ocmhood.com
Source: global traffic	DNS traffic detected: DNS query: t.rtbadshubmy.com
Source: global traffic	DNS traffic detected: DNS query: cdn.ocmtag.com
Source: global traffic	DNS traffic detected: DNS query: t.ocmhood.com
Source: global traffic	DNS traffic detected: DNS query: cdn.ocmhood.com
Source: global traffic	DNS traffic detected: DNS query: plus.affflow.com
Source: global traffic	DNS traffic detected: DNS query: reloadsreviews.top
Source: global traffic	DNS traffic detected: DNS query: cap.affiliatrack.com
Source: global traffic	DNS traffic detected: DNS query: utilitysafe-view.info
Source: global traffic	DNS traffic detected: DNS query: url.giveaff.com
Source: global traffic	DNS traffic detected: DNS query: ssventp.com
Source: global traffic	DNS traffic detected: DNS query: p.awesomefa.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: e.autocclick.com
Source: global traffic	DNS traffic detected: DNS query: ny-feed.rtbadsmenetwork.com
Source: global traffic	DNS traffic detected: DNS query: ny-t.rtbadsmenetwork.com
Source: global traffic	DNS traffic detected: DNS query: cdn.amnew.net
Source: global traffic	DNS traffic detected: DNS query: us.boxthis.xyz
Source: global traffic	DNS traffic detected: DNS query: us.wenga.xyz

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.161.82.109:443 -> 192.168.2.16:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.16:49993 version: TLS 1.2

One or more processes crash

Source: C:\Program Files\AutoClicker\AutoClicker.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3252 -s 1972

Source: classification engine

Classification label: mal48.troj.evad.win@43/120@109/322

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3252
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5760:120:WilError_03

Source: C:\Users\user\Downloads\HUY.exe

File created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "

Source: C:\Users\user\Downloads\HUY.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Downloads\HUY.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Downloads\HUY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.5movierulz.mom"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6372 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6372 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6712 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\HUY.exe "C:\Users\user\Downloads\HUY.exe"
Source: C:\Users\user\Downloads\HUY.exe	Process created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp "C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp" /SL5="$E0078,1361471,857600,C:\Users\user\Downloads\HUY.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6712 --field-trial-handle=1920,i,10451475700952946686,3645390677050965185,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Program Files\AutoClicker\AutoClicker.exe "C:\Program Files\AutoClicker\AutoClicker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\AutoClicker\AutoClicker.exe AutoClicker.exe /update
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\HUY.exe "C:\Users\user\Downloads\HUY.exe"
Source: C:\Users\user\Downloads\HUY.exe	Process created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp "C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp" /SL5="$E0078,1361471,857600,C:\Users\user\Downloads\HUY.exe"
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3252 -s 1972
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Program Files\AutoClicker\AutoClicker.exe "C:\Program Files\AutoClicker\AutoClicker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\AutoClicker\AutoClicker.exe AutoClicker.exe /update
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Downloads\HUY.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\HUY.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Section loaded: apphelp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: mscoree.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: apphelp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: version.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dwrite.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wldp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: profapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: winnsi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dwmapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: d3d9.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: urlmon.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: iertutil.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: srvcli.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: netutils.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: propsys.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: winsta.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: powrprof.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: umpdc.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dataexchange.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: d3d11.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dcomp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dxgi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dxcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: textshaping.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: d3dcompiler_47.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wintypes.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wintypes.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wintypes.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: msctfui.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: mscoree.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: version.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dwrite.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wldp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: profapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: winnsi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: amsi.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: userenv.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rasapi32.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rasman.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rtutils.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: mswsock.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: winhttp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: secur32.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: sspicli.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: schannel.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: msasn1.dll
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Section loaded: gpapi.dll

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\AutoClicker\AutoClicker.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0KEB0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6GE5G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-F3RC7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6KBP3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-87DHK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-O9D5K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-L257R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-VE7A3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-CRA9L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0CSCM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-H2EM6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-5598U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-3HHMQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-KTLDF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-9TFL3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-BB1AB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-UEA0R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-QGFEN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-0PK67.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-1P3N2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-LIGJH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-EDLB4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-PJAFC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-BRFBS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-1ENUK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-9FRHH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-VMGQA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-6FJPH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-UV5LR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-HFM4K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-IP3KO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\is-M8N4O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\is-S0GGU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-MCER5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-F6BGF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\Resources\Icons\is-V8S6A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Directory created: C:\Program Files\AutoClicker\AutoClickerUpdate.bat

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-0KEB0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-HFM4K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-6KBP3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Users\user\AppData\Local\Temp\is-995L5.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Downloads\HUY.exe	File created: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\a1f41e66-b911-4f6f-a1d6-c04ee74d607c.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-CRA9L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-M8N4O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-QGFEN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-BRFBS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-87DHK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-1P3N2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-6FJPH.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 531338.crdownload	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-EDLB4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-BB1AB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-0CSCM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-9FRHH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-L257R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	File created: C:\Program Files\AutoClicker\is-5598U.tmp	Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\Downloads\HUY.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Program Files\AutoClicker\AutoClicker.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PortConnector

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Memory allocated: 1A3F7740000 memory reserve \| memory write watch
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Memory allocated: 1A3F9220000 memory reserve \| memory write watch
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Memory allocated: 26A5C750000 memory reserve \| memory write watch
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Memory allocated: 26A760A0000 memory reserve \| memory write watch

Contains capabilities to detect virtual machines

Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: VBoxGuest
Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: vmci
Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: HGFS
Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: VBoxTrayIPC
Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: \pipe\VBoxTrayIPC
Source: C:\Program Files\AutoClicker\AutoClicker.exe	File opened / queried: VBoxMiniRdrDN

Contains long sleeps (>= 3 min)

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Program Files\AutoClicker\AutoClicker.exe

Window / User API: threadDelayed 3831

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-HFM4K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-6KBP3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-995L5.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-CRA9L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-M8N4O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-QGFEN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-BRFBS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-87DHK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-1P3N2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-6FJPH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-EDLB4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-BB1AB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-9FRHH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-0CSCM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-L257R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Dropped PE file which has not been started: C:\Program Files\AutoClicker\is-5598U.tmp	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 5108	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 4016	Thread sleep count: 3831 > 30
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 4016	Thread sleep count: 156 > 30
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 3744	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\AutoClicker\AutoClicker.exe TID: 2868	Thread sleep time: -922337203685477s >= -30000s

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Program Files\AutoClicker\AutoClicker.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp

Process information queried: ProcessInformation

Checks if the current process is being debugged

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process queried: DebugPort
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Process queried: DebugPort

Enables debug privileges

Source: C:\Program Files\AutoClicker\AutoClicker.exe

Process token adjusted: Debug

Source: C:\Program Files\AutoClicker\AutoClicker.exe

Memory allocated: page read and write | page guard

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Program Files\AutoClicker\AutoClicker.exe "C:\Program Files\AutoClicker\AutoClicker.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\AutoClicker\AutoClicker.exe AutoClicker.exe /update

Queries the volume information (name, serial number etc) of a device

Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\AutoClicker.exe VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.Console.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.File.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Text.Json.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Memory.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Buffers.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Text.Encodings.Web.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Numerics.Vectors.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Resources\Icons\location-crosshairs-solid.ico VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\AutoClicker.exe VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.Console.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\Serilog.Sinks.File.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Text.Json.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Memory.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Buffers.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Text.Encodings.Web.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Program Files\AutoClicker\System.Numerics.Vectors.dll VolumeInformation
Source: C:\Program Files\AutoClicker\AutoClicker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation

Source: C:\Program Files\AutoClicker\AutoClicker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

ID:	1538455
Product:	CloudBasic
Start time:	10:32:42
Start date:	21.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Program Files\AutoClicker\AutoClicker.exe (copy)	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	A8A58F5BC41307844089EC33E2439A2C	8ECCD6B3053A0CF3F4E1E39EC66AFC1EA8C62F74	631AB5D05F6AEE6CD78FCA2FBE7507E1D701F37B44758D339DF550130129AEEB
C:\Program Files\AutoClicker\AutoClicker.exe.config (copy)	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	CCF2419187B9583166F17A82971D6EC5	3BEBB957E0544D7E745823CB4D2B3B9FFFAD8440	A52A88FEA8CBFC4465BFA4D520879C29C5F2366502DB608F490B42A45658EE52
C:\Program Files\AutoClicker\AutoClicker.pdb (copy)	MSVC program database ver 7.00, 512*275 bytes	86EFB657B1A0974BCEA59B289E6BDD0A	FDC986C355D01DB01AEBA0D746AA60488292D6D6	A286F34B00E0264E62DB9F26DC2BEB416595AE77A2E41492166FDA93DE2E6309
C:\Program Files\AutoClicker\AutoClickerUpdate.bat	DOS batch file, ASCII text, with CRLF line terminators	86125FAFCF3A7C569C9629E77D4F1CAA	6AA1981E114F00D13D2109ECD45145DE65DD895E	C559FD909C052BB65C009129CA29AE6CC2023F8446E59ED4BEA92E2A35865446
C:\Program Files\AutoClicker\CommonServiceLocator.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	E5F3B59AB9FD9157857D69B3D9611D0B	057DB8A55C224569A192F24C88F7CF0AF02DD9BD	8951F1B70412949C6AC5F5A73441E689D954522EE199F17F56C97D3C90908AFD
C:\Program Files\AutoClicker\Microsoft.Bcl.AsyncInterfaces.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	1EE251645B8A54A116D6D06C83A2BD85	5DBF1534FFBFF016CC45559EB5EFF3DC4252A522	075CE79E84041137C78885B3738C1B5A03547D0AE2A79916E844196A9D0EC1DB
C:\Program Files\AutoClicker\Microsoft.Bcl.AsyncInterfaces.xml (copy)	XML 1.0 document, ASCII text, with very long lines (321), with CRLF line terminators	0737B770BA5D854D4887A8F4D9C8DE04	40A8A356D807D71C102C91D68AD1A0AD6E3FDDA6	CA53D9B1BBEA04C30DB4186B015B7C57DCE7C5ECDF1CFAC9E4AFE9FFCF6910F0
C:\Program Files\AutoClicker\Microsoft.Practices.Prism.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	1488C726A98F80C3DDC6A1D00A8D0B8B	824AD1174E5C2FC5C68B04E68C39C35E1BF4E812	3E4EF152246EB9D1EBF58C2BB93EA038232AFA0C1DF03B6D3A9E398620938759
C:\Program Files\AutoClicker\Microsoft.Practices.Prism.xml (copy)	XML 1.0 document, ASCII text, with very long lines (354), with CRLF line terminators	65014C44702CA43A739BFE9688A84831	C076F7C17BB076BE64D833FE1B4C306B4E9A05BA	E82F59726374B3ACFA05B038C882B087F4A3CC91B5F2CC4CA3A5A8B0D0B60BA0
C:\Program Files\AutoClicker\Resources\Icons\icon.ico (copy)	MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel	A78008E9C55FCB98C9ADF7E1263D8464	46FA36020C1C70BF3649F66B92CE09E8D9A112B7	E186AB8FEC275EE81701BB161F4EF34C69F69419936C43505B5DCDA6D4B9A248
C:\Program Files\AutoClicker\Resources\Icons\icon_running.ico (copy)	MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel	4F1487DA2DD64F4313C3520B80AC81DA	1217A1ADF889220292B8A924CE6F71CB3BB98B17	6A05921B9F60A78F928B95382DD3005C8C3217851C43090E12965415299D0EBB
C:\Program Files\AutoClicker\Resources\Icons\is-F6BGF.tmp	MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel	4F1487DA2DD64F4313C3520B80AC81DA	1217A1ADF889220292B8A924CE6F71CB3BB98B17	6A05921B9F60A78F928B95382DD3005C8C3217851C43090E12965415299D0EBB
C:\Program Files\AutoClicker\Resources\Icons\is-MCER5.tmp	MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel	A78008E9C55FCB98C9ADF7E1263D8464	46FA36020C1C70BF3649F66B92CE09E8D9A112B7	E186AB8FEC275EE81701BB161F4EF34C69F69419936C43505B5DCDA6D4B9A248
C:\Program Files\AutoClicker\Resources\Icons\is-V8S6A.tmp	MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit gray+alpha, non-interlaced, 32 bits/pixel	5363E77E69E003BCD8CDE06F34C3C884	8B364C849A4EA39D402F5B3BCDED0166F6B275EB	2D221F00AD119037FA63CD4E347C6CB9A2D48DC99614677E926CC4B5A1FC6C95
C:\Program Files\AutoClicker\Resources\Icons\location-crosshairs-solid.ico (copy)	MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit gray+alpha, non-interlaced, 32 bits/pixel	5363E77E69E003BCD8CDE06F34C3C884	8B364C849A4EA39D402F5B3BCDED0166F6B275EB	2D221F00AD119037FA63CD4E347C6CB9A2D48DC99614677E926CC4B5A1FC6C95
C:\Program Files\AutoClicker\Resources\is-S0GGU.tmp	JSON data	9086691D3237737D380505930380E319	705D51D6A5059B42FA859CA996DB63F5205A403B	0D3E3C266198D8F68460EC522D2D3915F487AFDE3DBBF72A052157B2E13374DA
C:\Program Files\AutoClicker\Resources\keyMappings.json (copy)	JSON data	9086691D3237737D380505930380E319	705D51D6A5059B42FA859CA996DB63F5205A403B	0D3E3C266198D8F68460EC522D2D3915F487AFDE3DBBF72A052157B2E13374DA
C:\Program Files\AutoClicker\Serilog.Sinks.Console.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	F526BDF426ADDEC5F78065EB870D9058	71062E45CC998965E3D0A5B34661E44F30F96938	C5BE08CE2FB67A7937669CB878134B2832C725EF8F07DE7577C150EFAAD5D1A2
C:\Program Files\AutoClicker\Serilog.Sinks.Console.xml (copy)	XML 1.0 document, ASCII text, with very long lines (346), with CRLF line terminators	EBE0A1E5F2373700EF7057643C50B52F	C89BF980C47EED5D954A4D8B2612D22109F4C555	FC7CB577061FEEB6A06C24207B0BA1D5F5CFD6ABD4F8D15CDCF54469067F13DE
C:\Program Files\AutoClicker\Serilog.Sinks.File.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	C25357A7950DCFC7F85EE9D593CB1A24	6A533712852465AB3C11B5C76004312D6482F07F	5B70DC2EECEB1963F9C3690C1CC8FFA793B280E903FA9A31780E6A7BB0BDFCF9
C:\Program Files\AutoClicker\Serilog.Sinks.File.pdb (copy)	Microsoft Roslyn C# debugging symbols version 1.0	F1AF59548261BE14DD1A0D5A10CADEC0	411C5EB1B529AEC73F6A246AB965C25248701E14	0AE6BE9B8D7BA5B2D7AD09C9A0C2439671D6D419211199A86C3C6722E9FA6CF9
C:\Program Files\AutoClicker\Serilog.Sinks.File.xml (copy)	XML 1.0 document, ASCII text, with very long lines (499), with CRLF line terminators	28D966EDE9C3C25CF49E1F20D9AA6847	B154321576F50BF8C0E27E940DA030842B580D8E	5337A07C7AA7DD901A330C893C7D1B6F101AB3706B7AAB8CC3EAF4E5C236D9F7
C:\Program Files\AutoClicker\Serilog.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	0AA45A8A1CD24CD2B589E4AAD925F35D	0DC29954C4C2FFEA4C33AF0E56CE84158849B81E	7A26A473AF5EB7A00196E275C86D773F36E1D4CAEF566F97F1DF7E07E20B1670
C:\Program Files\AutoClicker\Serilog.xml (copy)	XML 1.0 document, ASCII text, with very long lines (454), with CRLF line terminators	9286AA30EB743A001D67B100236E9011	A476D5424129C7E40EC815A911313A71B92FE840	C8F6500C2CD3D89E43A91D7C6E71C9480550BE1F3F2B79874CFEE6231D81B996
C:\Program Files\AutoClicker\System.Buffers.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	ECDFE8EDE869D2CCC6BF99981EA96400	2F410A0396BC148ED533AD49B6415FB58DD4D641	ACCCCFBE45D9F08FFEED9916E37B33E98C65BE012CFFF6E7FA7B67210CE1FEFB
C:\Program Files\AutoClicker\System.Buffers.xml (copy)	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (727), with CRLF line terminators	1C55860DD93297A6EA2FAD2974834C3A	7F4069341C6B62ECFC999A6C2D8A2D5FB59D44F6	2EC7FB12E11F9831E40524427F6D88A3C9FFDD56CCFA81D373467B75B479A578
C:\Program Files\AutoClicker\System.Memory.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	6FB95A357A3F7E88ADE5C1629E2801F8	19BF79600B716523B5317B9A7B68760AE5D55741	8E76318E8B06692ABF7DAB1169D27D15557F7F0A34D36AF6463EFF0FE21213C7
C:\Program Files\AutoClicker\System.Memory.xml (copy)	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	ADD19745A43B2515280CE24671863114	CF44E6557FDE93288FF2567A002A69279965CABA	D5714C96607EB1A9D0F90F57CA194D8A9C3EDE0656A1D1F461E78B209F054813
C:\Program Files\AutoClicker\System.Numerics.Vectors.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	AAA2CBF14E06E9D3586D8A4ED455DB33	3D216458740AD5CB05BC5F7C3491CDE44A1E5DF0	1D3EF8698281E7CF7371D1554AFEF5872B39F96C26DA772210A33DA041BA1183
C:\Program Files\AutoClicker\System.Numerics.Vectors.xml (copy)	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	95DD29CA17B63843AD787D3BC9C8C933	1A937009A92B034EDB168CFAC0EC1C353BE8F58E	AE2C3DE9AD57D7091D9F44DCDEE3F88ECCF2BA7CB43ADC9BB24769154A532DC7
C:\Program Files\AutoClicker\System.Runtime.CompilerServices.Unsafe.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	9A341540899DCC5630886F2D921BE78F	BAB44612721C3DC91AC3D9DFCA7C961A3A511508	3CADCB6B8A7335141C7C357A1D77AF1FF49B59B872DF494F5025580191D1C0D5
C:\Program Files\AutoClicker\System.Runtime.CompilerServices.Unsafe.xml (copy)	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	AA2CB9BA14481A623EE20F821CF5D180	8B27D2B07845A94AA7741093E8A4D6D2E7B768DF	A22E09986A09839DC697F13D76AADED6008001F3632986ACAEBC29F8EF489B82
C:\Program Files\AutoClicker\System.Text.Encodings.Web.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	E8CDACFD2EF2F4B3D1A8E6D59B6E3027	9A85D938D8430A73255A65EA002A7709C81A4CF3	EDF13EBF2D45152E26A16B947CD953AEB7A42602FA48E53FD7673934E5ACEA30
C:\Program Files\AutoClicker\System.Text.Encodings.Web.xml (copy)	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (347), with CRLF line terminators	ACC8AF8D28DC65488D1C49DEFD8EA153	1EECE92A2F2E40DE4AFB43F7A5CAEC9A3B384B87	0772B7895A1FEA1D3BBEE2ED2F5200EF4F9EB38B22C3D00B5405325BE9D8A7CD
C:\Program Files\AutoClicker\System.Text.Json.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	38470CA21414A8827C24D8FE0438E84B	1C394A150C5693C69F85403F201CAA501594B7AB	2C7435257690AC95DC03B45A236005124097F08519ADF3134B1D1ECE4190E64C
C:\Program Files\AutoClicker\System.Text.Json.xml (copy)	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	FED072426E07DBC27A1D734D99526654	2282862D21FDC500CF34CD20B928E8888D662FD0	DDA6AE13AA1736B29AC98109B7334D70081DD907A7AD6890C265A552D2DA03B6
C:\Program Files\AutoClicker\System.Threading.Tasks.Extensions.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	E1E9D7D46E5CD9525C5927DC98D9ECC7	2242627282F9E07E37B274EA36FAC2D3CD9C9110	4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
C:\Program Files\AutoClicker\System.Threading.Tasks.Extensions.xml (copy)	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	C89E735FCF37E76E4C3D7903D2111C04	3C0F1F09C188D8C74B42041004ECE59BBD6F0F56	975A9555F561B363C3E02FD533F6BF7083AA11BBC7CBF2B46C31DF3D3696B97B
C:\Program Files\AutoClicker\System.ValueTuple.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	23EE4302E85013A1EB4324C414D561D5	D1664731719E85AAD7A2273685D77FEB0204EC98	E905D102585B22C6DF04F219AF5CBDBFA7BC165979E9788B62DF6DCC165E10F4
C:\Program Files\AutoClicker\System.ValueTuple.xml (copy)	XML 1.0 document, ASCII text, with CRLF line terminators	B6E60687AE5DB6D011E21E6993620745	B117C6BBDDC72E7F4B590173992EE17BFDDE4BE1	C37E163FA76629C196460C7B4D54E95B1A46A4C66AB7B6F3311959C8137DC5F1
C:\Program Files\AutoClicker\System.Windows.Interactivity.dll (copy)	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	3AB57A33A6E3A1476695D5A6E856C06A	DABB4ECFFD0C422A8EEBFF5D4EC8116A6E90D7E7	4AACE8C8A330AE8429CD8CC1B6804076D3A9FFD633470F91FD36BDD25BB57876
C:\Program Files\AutoClicker\is-0CSCM.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	F526BDF426ADDEC5F78065EB870D9058	71062E45CC998965E3D0A5B34661E44F30F96938	C5BE08CE2FB67A7937669CB878134B2832C725EF8F07DE7577C150EFAAD5D1A2
C:\Program Files\AutoClicker\is-0KEB0.tmp	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	A8A58F5BC41307844089EC33E2439A2C	8ECCD6B3053A0CF3F4E1E39EC66AFC1EA8C62F74	631AB5D05F6AEE6CD78FCA2FBE7507E1D701F37B44758D339DF550130129AEEB
C:\Program Files\AutoClicker\is-0PK67.tmp	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	ADD19745A43B2515280CE24671863114	CF44E6557FDE93288FF2567A002A69279965CABA	D5714C96607EB1A9D0F90F57CA194D8A9C3EDE0656A1D1F461E78B209F054813
C:\Program Files\AutoClicker\is-1ENUK.tmp	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (347), with CRLF line terminators	ACC8AF8D28DC65488D1C49DEFD8EA153	1EECE92A2F2E40DE4AFB43F7A5CAEC9A3B384B87	0772B7895A1FEA1D3BBEE2ED2F5200EF4F9EB38B22C3D00B5405325BE9D8A7CD
C:\Program Files\AutoClicker\is-1P3N2.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	AAA2CBF14E06E9D3586D8A4ED455DB33	3D216458740AD5CB05BC5F7C3491CDE44A1E5DF0	1D3EF8698281E7CF7371D1554AFEF5872B39F96C26DA772210A33DA041BA1183
C:\Program Files\AutoClicker\is-3HHMQ.tmp	Microsoft Roslyn C# debugging symbols version 1.0	F1AF59548261BE14DD1A0D5A10CADEC0	411C5EB1B529AEC73F6A246AB965C25248701E14	0AE6BE9B8D7BA5B2D7AD09C9A0C2439671D6D419211199A86C3C6722E9FA6CF9
C:\Program Files\AutoClicker\is-5598U.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	C25357A7950DCFC7F85EE9D593CB1A24	6A533712852465AB3C11B5C76004312D6482F07F	5B70DC2EECEB1963F9C3690C1CC8FFA793B280E903FA9A31780E6A7BB0BDFCF9
C:\Program Files\AutoClicker\is-6FJPH.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	E1E9D7D46E5CD9525C5927DC98D9ECC7	2242627282F9E07E37B274EA36FAC2D3CD9C9110	4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
C:\Program Files\AutoClicker\is-6GE5G.tmp	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	CCF2419187B9583166F17A82971D6EC5	3BEBB957E0544D7E745823CB4D2B3B9FFFAD8440	A52A88FEA8CBFC4465BFA4D520879C29C5F2366502DB608F490B42A45658EE52
C:\Program Files\AutoClicker\is-6KBP3.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	E5F3B59AB9FD9157857D69B3D9611D0B	057DB8A55C224569A192F24C88F7CF0AF02DD9BD	8951F1B70412949C6AC5F5A73441E689D954522EE199F17F56C97D3C90908AFD
C:\Program Files\AutoClicker\is-87DHK.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	1EE251645B8A54A116D6D06C83A2BD85	5DBF1534FFBFF016CC45559EB5EFF3DC4252A522	075CE79E84041137C78885B3738C1B5A03547D0AE2A79916E844196A9D0EC1DB
C:\Program Files\AutoClicker\is-9FRHH.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	38470CA21414A8827C24D8FE0438E84B	1C394A150C5693C69F85403F201CAA501594B7AB	2C7435257690AC95DC03B45A236005124097F08519ADF3134B1D1ECE4190E64C
C:\Program Files\AutoClicker\is-9TFL3.tmp	XML 1.0 document, ASCII text, with very long lines (454), with CRLF line terminators	9286AA30EB743A001D67B100236E9011	A476D5424129C7E40EC815A911313A71B92FE840	C8F6500C2CD3D89E43A91D7C6E71C9480550BE1F3F2B79874CFEE6231D81B996
C:\Program Files\AutoClicker\is-BB1AB.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	ECDFE8EDE869D2CCC6BF99981EA96400	2F410A0396BC148ED533AD49B6415FB58DD4D641	ACCCCFBE45D9F08FFEED9916E37B33E98C65BE012CFFF6E7FA7B67210CE1FEFB
C:\Program Files\AutoClicker\is-BRFBS.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	E8CDACFD2EF2F4B3D1A8E6D59B6E3027	9A85D938D8430A73255A65EA002A7709C81A4CF3	EDF13EBF2D45152E26A16B947CD953AEB7A42602FA48E53FD7673934E5ACEA30
C:\Program Files\AutoClicker\is-CRA9L.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	0AA45A8A1CD24CD2B589E4AAD925F35D	0DC29954C4C2FFEA4C33AF0E56CE84158849B81E	7A26A473AF5EB7A00196E275C86D773F36E1D4CAEF566F97F1DF7E07E20B1670
C:\Program Files\AutoClicker\is-EDLB4.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	9A341540899DCC5630886F2D921BE78F	BAB44612721C3DC91AC3D9DFCA7C961A3A511508	3CADCB6B8A7335141C7C357A1D77AF1FF49B59B872DF494F5025580191D1C0D5
C:\Program Files\AutoClicker\is-F3RC7.tmp	MSVC program database ver 7.00, 512*275 bytes	86EFB657B1A0974BCEA59B289E6BDD0A	FDC986C355D01DB01AEBA0D746AA60488292D6D6	A286F34B00E0264E62DB9F26DC2BEB416595AE77A2E41492166FDA93DE2E6309
C:\Program Files\AutoClicker\is-H2EM6.tmp	XML 1.0 document, ASCII text, with very long lines (346), with CRLF line terminators	EBE0A1E5F2373700EF7057643C50B52F	C89BF980C47EED5D954A4D8B2612D22109F4C555	FC7CB577061FEEB6A06C24207B0BA1D5F5CFD6ABD4F8D15CDCF54469067F13DE
C:\Program Files\AutoClicker\is-HFM4K.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	23EE4302E85013A1EB4324C414D561D5	D1664731719E85AAD7A2273685D77FEB0204EC98	E905D102585B22C6DF04F219AF5CBDBFA7BC165979E9788B62DF6DCC165E10F4
C:\Program Files\AutoClicker\is-IP3KO.tmp	XML 1.0 document, ASCII text, with CRLF line terminators	B6E60687AE5DB6D011E21E6993620745	B117C6BBDDC72E7F4B590173992EE17BFDDE4BE1	C37E163FA76629C196460C7B4D54E95B1A46A4C66AB7B6F3311959C8137DC5F1
C:\Program Files\AutoClicker\is-KTLDF.tmp	XML 1.0 document, ASCII text, with very long lines (499), with CRLF line terminators	28D966EDE9C3C25CF49E1F20D9AA6847	B154321576F50BF8C0E27E940DA030842B580D8E	5337A07C7AA7DD901A330C893C7D1B6F101AB3706B7AAB8CC3EAF4E5C236D9F7
C:\Program Files\AutoClicker\is-L257R.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	1488C726A98F80C3DDC6A1D00A8D0B8B	824AD1174E5C2FC5C68B04E68C39C35E1BF4E812	3E4EF152246EB9D1EBF58C2BB93EA038232AFA0C1DF03B6D3A9E398620938759
C:\Program Files\AutoClicker\is-LIGJH.tmp	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	95DD29CA17B63843AD787D3BC9C8C933	1A937009A92B034EDB168CFAC0EC1C353BE8F58E	AE2C3DE9AD57D7091D9F44DCDEE3F88ECCF2BA7CB43ADC9BB24769154A532DC7
C:\Program Files\AutoClicker\is-M8N4O.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	3AB57A33A6E3A1476695D5A6E856C06A	DABB4ECFFD0C422A8EEBFF5D4EC8116A6E90D7E7	4AACE8C8A330AE8429CD8CC1B6804076D3A9FFD633470F91FD36BDD25BB57876
C:\Program Files\AutoClicker\is-O9D5K.tmp	XML 1.0 document, ASCII text, with very long lines (321), with CRLF line terminators	0737B770BA5D854D4887A8F4D9C8DE04	40A8A356D807D71C102C91D68AD1A0AD6E3FDDA6	CA53D9B1BBEA04C30DB4186B015B7C57DCE7C5ECDF1CFAC9E4AFE9FFCF6910F0
C:\Program Files\AutoClicker\is-PJAFC.tmp	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	AA2CB9BA14481A623EE20F821CF5D180	8B27D2B07845A94AA7741093E8A4D6D2E7B768DF	A22E09986A09839DC697F13D76AADED6008001F3632986ACAEBC29F8EF489B82
C:\Program Files\AutoClicker\is-QGFEN.tmp	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	6FB95A357A3F7E88ADE5C1629E2801F8	19BF79600B716523B5317B9A7B68760AE5D55741	8E76318E8B06692ABF7DAB1169D27D15557F7F0A34D36AF6463EFF0FE21213C7
C:\Program Files\AutoClicker\is-UEA0R.tmp	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (727), with CRLF line terminators	1C55860DD93297A6EA2FAD2974834C3A	7F4069341C6B62ECFC999A6C2D8A2D5FB59D44F6	2EC7FB12E11F9831E40524427F6D88A3C9FFDD56CCFA81D373467B75B479A578
C:\Program Files\AutoClicker\is-UV5LR.tmp	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	C89E735FCF37E76E4C3D7903D2111C04	3C0F1F09C188D8C74B42041004ECE59BBD6F0F56	975A9555F561B363C3E02FD533F6BF7083AA11BBC7CBF2B46C31DF3D3696B97B
C:\Program Files\AutoClicker\is-VE7A3.tmp	XML 1.0 document, ASCII text, with very long lines (354), with CRLF line terminators	65014C44702CA43A739BFE9688A84831	C076F7C17BB076BE64D833FE1B4C306B4E9A05BA	E82F59726374B3ACFA05B038C882B087F4A3CC91B5F2CC4CA3A5A8B0D0B60BA0
C:\Program Files\AutoClicker\is-VMGQA.tmp	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	FED072426E07DBC27A1D734D99526654	2282862D21FDC500CF34CD20B928E8888D662FD0	DDA6AE13AA1736B29AC98109B7334D70081DD907A7AD6890C265A552D2DA03B6
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AutoClicker.exe_66b4896887b9d3ad052f967583dad879eb4f10_8c46e609_a878767d-ecfd-4a86-8295-2ae2eede3950\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	521EC4367C16BB9165861025FB9B12FB	C5724A2A5F6974DB75049DF7E88D8EFD9493DBDF	CC5416A471DEACC0178C0CF01039788E4CBFD578CF0326509109136C00BD3A0F
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB77.tmp.dmp	Mini DuMP crash report, 16 streams, Mon Oct 21 08:35:05 2024, 0x1205a4 type	B04D240684A921E750C7682E634FE496	E1B66BE60F1E27284CDCD714FBC7C0037B297D7B	9DC32FCD57C35DF922D8A950EB6226C8BBDEF47A5AA2F9D0F051F98E25150D2D
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDD9.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	3D73AED30AC4D40051706B81B2D92289	FF3942027360DC4BA92D13A3DCCB72ABB0EA1D67	60F534DDAD07DAFB7A2157C5C589FEC411AEEFD0716C429C124DFAEA2A4E77BE
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDFA.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	7CD53097BD067F95CDC4493E8BA069C8	28D1740DCE255D8B01531F480C1C1E4E6BF31A83	434B16A166067E7BF5145E991D8CACB008BEF68A2235EF9FE3F9302A7123F03C
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560	Certificate, Version=3	E94FB54871208C00DF70F708AC47085B	4EFC31460C619ECAE59C1BCE2C008036D94C84B8	7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	0D2396654409938A05F2026ED74CE161	7E19DF93BF66A9D9DA3BED5F37F583A1CC1B0FA5	3C1C7B6219CFAEDDC5754BC5E6840675EA3D5F610B5163AC1A2014E52438961F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560	data	E5223B58880C3C3FBF5387CBE28432C6	F6FEEDA7130187AF800090D991951A8AF2EDD9C6	7FC349F7BA96C2BD6A104F2C0AA819140B8E8CD0F58E0EF820A62A24A8011A66
C:\Users\user\AppData\Local\Temp\is-7IBMG.tmp\HUY.tmp	PE32 executable (GUI) Intel 80386, for MS Windows	BCF1478E2217221B21EEC151C1799DC0	D4E92222158D356A59741C14F0D245F98E5B64DE	ACD8804789B64E208243881DA188F779D90B93675C46917BC51FB2F8CDAD725B
C:\Users\user\AppData\Local\Temp\is-995L5.tmp\_isetup\_setup64.tmp	PE32+ executable (console) x86-64, for MS Windows	E4211D6D009757C078A9FAC7FF4F03D4	019CD56BA687D39D12D4B13991C9A42EA6BA03DA	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
C:\Users\user\AppData\Roaming\AutoClick_Logs.txt	ASCII text, with CRLF line terminators	F4B1FD624DF370F6E74CB1A15D596985	736256CD027223FB1A656FFC7C5B711581894C87	137AB450C08EF5F0677F9736486C20222175D3E0D9DAD6BA679471967C444B9F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 07:33:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	89FC08CE80DCF5E42DD37855094FB04A	29BB04DAA1C4B5E5351FA009ADDF4EFC3B4199E2	4B49BBB2AADB09FECE43FB81B6B9D7FCDB63E06FC78A7A18D5FDAA0747CA117F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 07:33:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	50E7D5EAC2D36A695D2813BB38CEB27A	22D0A1A53A97B7E587C26F9CB326A511092E2309	85AC89C6E7C1F559A7A1BB095A91F91BF74BC7D01A7F90ED07B2320EE49182C9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	2FC1BC70BA29B11976908A8BC91135C1	F4F5C57715A6F793C5C6E5AB16156B0F6D8FC19D	F7F125010A61C320860CDA2D5E9B03D6D444F3C5FF92124F89DFB48D7F294187
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 07:33:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6A994C69B77DE4C07C7D2C6B9DF367A6	978A9491C187F4BE100C69DC6820A32621778D2B	C3BA59B1760F2D624FBEA87ACADA115F2CFA72A61AAD9EEF568A47E6A3B0A4C7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 07:33:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	34FFBCBAE2C5A79C0117106453B0361D	6C33FE88343CB3DF8DAA468424B18C4A98AD3322	900048CCF2E65F2B83CA213933F67B3374DA5E733DE553AE696B4B21A10B7490
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 21 07:33:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	CD9DB467D4FA13773EB59C5548DC2514	76B0ABFDDD8330FB2FAAA84C0A0FD3F96F188308	0363B5166FF63B94857F0FA916AF640C2A3C8B6B26951887C667AF42CF4BD1D0
C:\Users\user\Downloads\HUY.exe (copy)	PE32 executable (GUI) Intel 80386, for MS Windows	EA0002831B7749C2B1A94B56F57C1AA2	3D64145503FE9D29E244CB74A25CCE8B2C91A5A9	2C6CF12C6859BD01E391B6E0400A263F57765FB14383E29E855E0FB5927867C3
C:\Users\user\Downloads\Unconfirmed 531338.crdownload	PE32 executable (GUI) Intel 80386, for MS Windows	EA0002831B7749C2B1A94B56F57C1AA2	3D64145503FE9D29E244CB74A25CCE8B2C91A5A9	2C6CF12C6859BD01E391B6E0400A263F57765FB14383E29E855E0FB5927867C3
C:\Users\user\Downloads\a1f41e66-b911-4f6f-a1d6-c04ee74d607c.tmp	PE32 executable (GUI) Intel 80386, for MS Windows	6D942C859782B1A8190F8B87C5F22FF4	675625350DEB3E52280BA28C10496F082571AC20	1B14CE9362B25E0784235069EC7B77BE4A30BC4FF9533D722AEA80E4BB335D19
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	7DBE8FE604BA419B087C2A2EBE5B826A	3B0BA5E23249FA431353ADD2562D53AF12695649	9FA05EE64C757230E3AC261E2F8E9C8FD0229A1AA518AAAB3EDD02CBBEDDA75B
Chrome Cache Entry: 166	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	10CFB800691090F40313E8B7F023E833	14A2713E1B629C511FDEAD8EC1D0DAB37AF2F365	9E0E812004ECF5749246CB38C9E39717A07EBBEA7C1A686309771A478843CB9F
Chrome Cache Entry: 167	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	D066D9DA739A8E617E23A946EEB11F88	B49629D3D567E98CF757CAA02D6C77262E7B68B2	0DBC52A2B4A14E6D059D36ED153CC7A0C03B96B6CECAD669398A71B8A27D2AC2
Chrome Cache Entry: 168	Unicode text, UTF-8 text, with very long lines (63028), with no line terminators	8C24B56EDA595FD9B563B16EB92087D6	61A384A63A0F3179CA7318084E768119EB67157A	35EC1D1B03AB4FFA697084F162CF49B979F7D27C84B8771F8F591FAD95FEB757
Chrome Cache Entry: 169	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	41676D5F5F7C850460C3247B63835ECF	AC061ACB93E4833C4A9AC64519FD981822546D1F	18281069E47677742FDE7269A74D7E9CEF9BAE1C13BA14B7CB0885E03274B098
Chrome Cache Entry: 170	JSON data	99914B932BD37A50B983C5E7C90AE93B	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
Chrome Cache Entry: 173	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	E9CE45915A1A14D1D2F97AA3F1D88FCE	2A871F4413AEAEB1DD3BA825F9D9695C0E55ADD4	B486F8A1E27CC208D6D972DDBA5599F209169DE35AEC448B3D0E0C886BE8A364
Chrome Cache Entry: 174	ASCII text, with very long lines (423), with no line terminators	DB9E52F463876A02D0F71877E99ED08D	13EE04109B570BF80E98867559CC2E2E892227A3	CF2B288DB136B919380C88BAC5AE76F94CCC9F17FE4FEA15B634BD9710756758
Chrome Cache Entry: 175	JSON data	AED2A4C2A470A527D9E7D38CF78526E2	FB7288F266A2136E45D5A3B815CD982364E79B78	E59CDD1B86A833A784D48844A7E67B4DAFA49650AC8DF22198069AD2EFC4F76B
Chrome Cache Entry: 176	HTML document, ASCII text	D35E3F13C46C1F46675A4BDCF8A5A60A	1B36D7D512AA4E4762EE2B127E406425208454EE	6F1369C703966A70074BDC2C4D9B467ED5B4148F744F371AD6A2771D6CA62611
Chrome Cache Entry: 178	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	B43489D73B654DA394F5F5FEDF09A9B4	F9130C75D4298BD95592C9FB2B96A913B5E32A0B	2A9CE3ACD593C3160DAE8C3ADAB609A29D473AE2DBE3E8F35CDEB012EF74B663
Chrome Cache Entry: 179	ASCII text, with very long lines (5945)	50275562436E4A078491519581FE4E2E	68D82116E200CB332C7F0C14172064143C214B07	A863004122C606359D7C00C81B341BBF5F27DD32E8A8BE25F5469640CCF3C07E
Chrome Cache Entry: 180	JSON data	B11411EB782B00D1A67E0588E8BB2F85	AAEEE30168C24AADD70CDA4C5A22C59D63BF321D	905ED3A08BD3C888A4A1599DB39BCEB61EF0C4EA332B2155A5AF12AA971AE6D9
Chrome Cache Entry: 181	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	7109AC8C84298D07E72170F94E4E3F4F	7483C857AD0107E496935A0EA03F4BF6E1602895	46EA9842A4A4CB4FF538996886D28BAEDA5D6826E711C313F30763FCABB5F04A
Chrome Cache Entry: 182	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	F04A90DF5B2AF459E54DEE32EE94F648	7D919542A89793A42F9E36206126990E6570706C	7AB771FCC3512BCA40FB3839739C48EA999AD51E2A8A33101283C230FAFA2EEB
Chrome Cache Entry: 183	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	EA3981BD106DB70407EEB2782926F9F4	612730C291EA0ED0C1BA85C2F7D77B3B09A36099	600531F2E7773DF22C110EAA0F4AAFFEBFF41C37422F903A39ACF185FA36FB80
Chrome Cache Entry: 184	RIFF (little-endian) data, Web/P image, VP8 encoding, 492x328, Suserng: [none]x[none], YUV color, decoders should clamp	76C9BF520D8860DB1D53DAA8EE030757	A3CA4CCA1754426B08CD7F9705390C74D206AD40	53D2E50BDFEA129C791A55AE7F52CE8A1A7ACAEED7FF629CCFF615A3C5BB8C5C
Chrome Cache Entry: 185	ASCII text, with no line terminators	C78FC4C73991971736F95F00B7C09E4F	2BFE006346297E446B58308E3F37169A4BC29046	C70E533105E5FE64092A52295354E975F8D6DDF470DA3F7AE4A6D4F3FC915283
Chrome Cache Entry: 186	HTML document, ASCII text, with very long lines (945), with CRLF line terminators	816854A221477D974DAB6F7602E06BF4	4DD65DA43E45F215D5A8855894932115255F3EA0	23F4BD2EFB458B9D3F19539E864F350BE16B3D310D9AD3C51304EFE6E28AA528
Chrome Cache Entry: 187	ASCII text, with very long lines (8033), with no line terminators	29599D54458805CCA5829B174B854095	AFD893921EF4BCF72983E81CC7A9F3008132232D	15764C2A77A6371FA2F7E72DB878694E3BAFE4A6F75A4BC2D85E4986B7889853
Chrome Cache Entry: 189	JSON data	8ED4CEF6401294733BAF8417698D18A0	87A5F41479800FC977E938AFAAEDF07F48A0E8F4	A51E8A02C7C7C09DAA03260235C23F9F9845D78DDDA82AC8922953EA7D62A843
Chrome Cache Entry: 190	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	135FF6B560F96FE8205CC5F067B45F6F	C8C7728DB62F7AC8A01B01AC426926368A18883D	3C1FE8701EBBBD2168F03D09431DB87C002637CC2D22B1BDD96B6D608E775DA6
Chrome Cache Entry: 192	HTML document, ASCII text, with CRLF line terminators	92D1240D0145792EE71E684CFCA8F575	868C60C9FF18397741C904E9F44409BF95D1CE2F	023AE51653C14E6CE9DE83D964FB9146328DCC3A9C5166D958546B6BF609F549
Chrome Cache Entry: 193	RIFF (little-endian) data, Web/P image, VP8 encoding, 192x192, Suserng: [none]x[none], YUV color, decoders should clamp	11335A75DAC7288CDE2386107BEECD14	ABB6F6E1A43E63125ECDF327639ED6BED1C02340	2F4E4F54C8ED5929524742737235BD6B66A5AB4FAE51D625E44820901FA2F2B8
Chrome Cache Entry: 194	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	39BD48C537AD9908730D14D7DD9C6EE7	8679AB442892DB5BC5BE1F4A0A50250319229724	D40580EC7996900D8DDCC1EE580C825C33C364B57E5A82AFFECBD6F64E1636E5
Chrome Cache Entry: 196	HTML document, ASCII text, with very long lines (2116), with CRLF line terminators	2E4981AD5EAD5150B1B1F1839BD3D1F5	63B6C2956DC56716DAC41D2DF7BB8E64EDA87A33	E23ACBF1BC80C3A53AED90EE1AF4AA3033E60EAFE6A38F8563A456D7A1B88476
Chrome Cache Entry: 198	PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced	69327BFCB21ADDC98B7123B88EDD260C	C5CCA695C805F41FD60EAE3A22918657C4C39FCA	D2E48932FED488CD746884F38925A1A4F36BF2CD123CD2B1CDC6B9D7AC3BDF12
Chrome Cache Entry: 199	HTML document, Unicode text, UTF-8 text, with very long lines (14121)	5E897C2D5DD1B3C86BCDEC61433564E7	D4369548D3881444451927281F0B2D0DEC4C1DA6	6BA605EBD11F02FF4DE615A70935D6E30D18D5DC583B63CDEED252BB7D405FDB
Chrome Cache Entry: 204	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	AF056230AAAC2EDE74CAB637C8F4ED96	1DADA1FCA3915C9AEBD4DB7C17182E129EA7BA55	59E6BCB3959F442E6A5BBA77EF30ADD14264439130483881D7D7DBF50101029F
Chrome Cache Entry: 209	JSON data	0E52A3641D43F06822D7D491A3480D55	6AF42F07B52A1FD5BAF610CCF7484166AB4C4036	3951F1367B2F9A50F303E8E8CE489175BB563D663FAF2F53EAC9DCE972DF5DAD
Chrome Cache Entry: 211	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	64D48EBD5B071C0B58CB4D329DB72158	5EFEF0CD179B8F608937DF67C3DC1B5ADFD71B23	1EAF485A3B972C31F6D1FA874760020AEE61FD7E2B34BC7FE0248BD54132973C
Chrome Cache Entry: 214	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	A3D8864A560AA94DD3B071630883A5FD	D21BCDE480543D666E3B8B9823E38EF41B952AEA	8AD2D27C02130BF98DCC93ED4EA0DA6AE26C86E80A2690C2CA4129E2F499B6C1
Chrome Cache Entry: 216	ASCII text, with very long lines (33530)	742C3FB27A4D5E4E7AB5AB93D7ABE3E9	6EDB5651A0F13E3A9CFBFFB8ECFB3C331EBBF8BD	81195ECEF1EF260CDDAB7B3AB6123888768242882B856B5FAB360F25850A9FA1
Chrome Cache Entry: 217	Unicode text, UTF-8 text, with very long lines (65499), with no line terminators	F83E4596E20DA20F2F64F43A19BF40DB	4B58227469C218E107817522BB71ADE4D75658A8	7FE4378133DB32B73F8D9A1BF6607BA4C5150C8D8F343DF06236ED61D128EDA1
Chrome Cache Entry: 219	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	8071138B3A299CA932B1923F809BC7BC	A9087590F8DCBE62E2F2E3AE69CF9CC422AE4076	5B0442E49B94793A43CA78A40D15B12931ACBB9ACE2B4B45E2C90A23ED5E74F5
Chrome Cache Entry: 220	MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel	28284116542FC6802B3A729153ADEE30	BE4ED46111DD7CDE52654D3926699AEA42346E99	C9360A50F993A3471C0F0BF19D1755D53906FDD02629C1CC876C2693A02D0B8F
Chrome Cache Entry: 223	PNG image data, 8 x 9, 8-bit/color RGBA, non-interlaced	C517B731F833DBAD09F989DBF1469384	0FE32D459A85CCEF07807B79D0785CD0378C1665	32E40C597C0EF46359DEC7A2BBCA9F08A215BF9A2E35B6F5290119B11844F4D4
Chrome Cache Entry: 225	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 165x220, components 3	D6AEA49B6005B1A646EB56FFA35265E0	C5DB26489C7067C274CAC1F33E3776087D5EF74F	24A005E5684E00246D9D5A1EE7E4DA3A33A1FDBF2C4704F9279BA79F452A3110
Chrome Cache Entry: 226	ASCII text, with very long lines (8030), with no line terminators	1B4D332B1E2A0FECB8EBD0FD24C912B7	3ECA8EE43D8EAB9B30F1A7A72EE45A8DE3C2DF02	5CD010721DE918A4D248D4F18CC7BD3F5790C8F16C276A6D7EC90FDBD27ECAA4
Chrome Cache Entry: 227	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	D7027CE33446CC683FA2378E916BA84D	FD8EF7648B89C62CF2E4A18CBDCB5D6319E483F4	66AC92074167586C9AE9E4484AA1EA0C2B4819DF6C6DA5D3975837FADE506D51
Chrome Cache Entry: 228	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	266FBB4F567AF255CB46CCF2081C5585	E62D9A09B5AD98D5A05E9BB97484A42C074ED045	77275BAEF96737F271EFC76111133947B661B0DB2C7A83378267A53DDF269E15
Chrome Cache Entry: 229	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	A3A51FA300EBAED9951840AC4444D2D0	3113777280D8D003FEEF8A109237CD0436821135	B0B280F13AFC02D7D6A209F18E94995948EB02F98823EEBC06321FBE15F71725
Chrome Cache Entry: 231	ASCII text, with very long lines (11044)	0D0D954A1E22B41EFEDB810B7BC4D24F	725C519DE72E5BE15732BB3F0C76AE5C45787C23	1A98DE7E5ED8C32242EE0D7FA6BADEA90AA9310D71BAC378F4A6BF7BF5706C5E
Chrome Cache Entry: 232	RIFF (little-endian) data, Web/P image, VP8 encoding, 492x328, Suserng: [none]x[none], YUV color, decoders should clamp	8B119C25E37A4BA67D3F3AE698C93FE5	C8A08298ABBBE824D1EC1C9CDDC5590B22F4E2CB	29B17010CB4BABC2165D79CB78ED28FD07FCFB1DA58FEA02363F0C8EF21535B7
Chrome Cache Entry: 235	ASCII text, with very long lines (761)	2EBFC13DB94085E51E5C5BC0D716620A	9BC77506FD3818601B5CC9492987C356AE896365	6D8C4E56C71CC8BDE83EC8595396C6B9187FBDEE2F97958E7658991CF403F875
Chrome Cache Entry: 236	ASCII text, with very long lines (423), with no line terminators	5E13DD427C0C2B7C5C0483726C89BBD5	4792221E7119F6640167C39D1920F49E6261ADA8	FB71F6B9F1E5E3289A9FEA93E44B9770F6B0CD902DB6EF49F6CA32B8FA39DE4E
Chrome Cache Entry: 239	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	98EC01464FD0C8E3D1A8C1CFACE2E51E	D483F6CB6B3CA73799CE55C0D77F2B59DB99009D	1C379AF1FC5354A2FFA6B0940B472EFEC8C0A279728CFABDF56F0455A7211DD5
Chrome Cache Entry: 242	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	22C179E477B67060354B39D0A9A6D1E4	27CE5E8ABA0B7FE99B051BFFF6D8A57D38D4CDCD	565CB3802FE10741031168A3022171CB18CB274CE8B12C584159DDA0329A7DE6
Chrome Cache Entry: 243	JSON data	9DC836DF8089BF316AAC47DEFA77E504	866604BD99BDB64B3B61DB31A1142AF1C6755BDD	CCEF7DD419F1669F0DBC94A60EEB895AEA55DFE5F92966BE0246F112CAB090B0
Chrome Cache Entry: 244	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	4EFEE4A96509135542720D40A4BCF979	A2D5F0F36B9A20274DDEF80D3DA63ADB09EEFEAD	BC3716F7543BF7B3E2ADA0CD45AA55FF285F2240CF924784CA04DE02630C641E
Chrome Cache Entry: 245	Java source, ASCII text	B552603AF17DE3215502E6A073324295	9B38C22B3F051BB654864368918B8410DD52AD35	1A75FB25F7F350232BE5DCC032D7B92B0B63BE751C6FC4515BA8021DBAA81DD8
Chrome Cache Entry: 246	Unicode text, UTF-8 text, with very long lines (65499), with no line terminators	2E2FA06485BB5BF799DE6A62E6C816D1	6721DF820163BE6E391EC6CAD8388C877C13CB68	7616FDC08BDCC736AFE9D5CF0A2B0D7F44D2A6DB8BA9B807093BA5CD5AFE03EF
Chrome Cache Entry: 247	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	C2654367FEEB186C83350FF6707BE393	7BB47797A1444C5ED4BB3F6A32194B18E37DF816	5739075108CC66A4953329BF55A90143FD520534546B9C714540EB2CAF62E731
Chrome Cache Entry: 250	JSON data	BC5BFA60BF5BEE7A3F0FDA0B63948CDD	ED8C8CCE5BC1BEEFE3C833C1E1BEBD1C62B490E5	D75D14F3B2760391A94CDEF682941C61201BEC99591DF2ECFFBE4849DE994CA0
Chrome Cache Entry: 251	ASCII text, with no line terminators	46DF3E5E2D15256CA16616EBFDA5427F	BE8F9B307E458075DA0D43585A05F1D451469182	AF3248D0B278571EFF9A22F8ED1CEB54B70D202B44FD70ECA4CA13A5771CECC3
Chrome Cache Entry: 254	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	9C52F0F29DDA6CC787CB8080283203FF	95885CC926DB680C54C9C801D5C2F2C6F1F8468E	66FC743B3AD3CB28A67E01D8A6AD485F9802A02453E620C8D422E81FC5A7FCCD
Chrome Cache Entry: 255	JSON data	4BC4929CD94DA80DE4E2EF3FE9A4A100	3D3892196715FE94970F014D752622D80312CAD2	D937A8E77EC025DE1DA485DBBFCDFAADF6883ECD631CF277C664EF4A6CEF8683
Chrome Cache Entry: 257	JSON data	EB174FC6856BE808766D4846A4B27E6E	6BADCF38C02EBFC95AA51435C517C7740F5E9B30	645ED59515CC61BA5F2BAC518A1BD6E65F59947E7EEB3C6746D0CB1FCFACF1BB
Chrome Cache Entry: 258	HTML document, ASCII text, with very long lines (26378)	D0958D704D4EA8A625A18126AA15C967	6590A29397B84BF179304AEAD9E6B153D4DC19F9	C93DD077A1DDC6CF961B7225CAB7C7E70B0F753885C2A44AF41196505E1436A8
Chrome Cache Entry: 260	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	4F5DC8ED11CC09B98437A51FB6F578BB	799F9A50B42D7C2E76F31D4635ECD42B056140BC	4001CE493C1DAEB0CF38EF3C7409FC442BA0EFBB7DB63A02DE9AA0F1EE7BCE1C
Chrome Cache Entry: 261	ASCII text, with very long lines (5945)	2C27094F84B57FD3DF457512701F3F62	D12950CEB4B58EE53F9815197B36A3C525E76724	CB9D80917289410AE2BF88AE6039EB678B4A29231A050E839A86BCBE9B90ACE6
Chrome Cache Entry: 265	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	0D86CBE56E97C2CA6AB9F16FDB003259	F7AE835E1A159698B0084D4E04A7AF01B835AED7	EDB7B3195DDBCBA3154E038A9682C91678A7B695DA3F5A1ED6210E5AE7CCEFCA
Chrome Cache Entry: 267	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	A31B44B8A097A46C2A8E4980060A3197	73488AABBBDB5D6DA114A6B15DB8B6289E2F39D3	628DD1B048AA417C42C3BDE26CA520AFC1B7E7D2890270F6C02EAB645C59DCB9
Chrome Cache Entry: 268	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "JPG edited with https://ezgif.com/optijpeg", baseline, precision 8, 165x220, components 3	46639ABB1EDF384B927969C6EEE62D05	8DFC0DA7A79AE83F7BA0F737A077A08A14F1C2BC	0989A8E8A221BBF9F30C41D1C4ADCDFF52C2FFAD4DCD6149CA4B4F30F798F105

Windows Analysis Report
http://www.5movierulz.mom

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://www.5movierulz.mom

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://www.5movierulz.mom