1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoClicker\redist\2022\vcomp140.exe
Size 1.1MB
Sample261113-n8gc5sbs8n
SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
MD5 913a423f66aa1c41e374e21a911a3c20
SHA1 449df612d0f02e868992faabfbf4d5d37c727936
SHA512 ee01f1a322e982bfd6618920e4ec9decf23317628f39dc9b771ff4f758fef3c9266cebbeaeb8ba1e4bbb1f0b683cba1aa3a533bce62a706e7dfd2a7d3bdd1f73
SSDEEP 24576:pRaZROMOm8FN7TjsPnzt2heeRhQbJpOQam1Mfu37d:zkxOm+7TjsPnztyDMBayMc
TLSH
T169455B5523A44199FE6AF0F68A52C106D6B17C4A12B6CB1F01B039B52F736B3DE1E31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3632	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1044	vcomp140.exe
3632	vlc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe
3632	vlc.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
3732	OpenWith.exe
1892	OpenWith.exe
2140	OpenWith.exe
2956	OpenWith.exe
3632	vlc.exe
3360	OpenWith.exe
2824	OpenWith.exe
220	OpenWith.exe
4736	OpenWith.exe
1348	OpenWith.exe
4344	OpenWith.exe
4600	OpenWith.exe
5020	OpenWith.exe
4600	OpenWith.exe
4520	OpenWith.exe
4648	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\AutoClicker\redist\2022\vcomp140.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker\redist\2022\vcomp140.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2140

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2956

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3632

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:3196

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:4944

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:4236

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:5076

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:4280

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:5020

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:4212

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:1236

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1348

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5020

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:4704

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:2332

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:3160

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:2756

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:1696

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:2448

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:1364

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:4348

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:2260

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:1924

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:2300

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnprotectLimit.mp4v"
1⤵
PID:4472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 80B
SHA256 e70e690c5e6ea220d8c10360b7f5cca2f5e480aae7648c2f47d2d6fe3e285570
MD5 06144f6480508fc475761104185863cb
SHA1 190e44e95bb8323d0b3e6adc529cee31dacecac8
SHA512 651272bd382f03ef9d9766585b1a111f8bab5873e47e6125b1324b4feef42bc32bcdbc8b4ec7d3d580fe96e61b4651258880749eea8b699af589b3680ce12684
TLSH
T1EBA012404014040782C00087522E651A1161E804586031617390D5410958D5101818B6
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini.lock

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock
Size 18B
SHA256 2cfdd33db91a08deb466f68681152802470f5dab4faca119147bef45be9ec4c2
MD5 5c1a40110f7de859068d77a33cd90cb5
SHA1 b7273cd20ca38559965ec98b4c6fcb46d5388e4a
SHA512 51d62740bce3b3dabd8a8a4dd9902c873edd7afc8bd4dc3d77e018c0157f7d3c73e4050c93b06f481a1d2e9d922cf15e531b5699191c012d6ad8ac100c8ec143
MD5 SHA1 SHA512

Submit Download

memory/3196-8-0x00007FFF15C30000-0x00007FFF15C64000-memory.dmp

Download

memory/3196-7-0x00007FF6AD210000-0x00007FF6AD308000-memory.dmp

Download

memory/3196-10-0x00007FFF235F0000-0x00007FFF23608000-memory.dmp

Download

memory/3196-12-0x00007FFF1C840000-0x00007FFF1C851000-memory.dmp

Download

memory/3196-11-0x00007FFF22E70000-0x00007FFF22E87000-memory.dmp

Download

memory/3196-9-0x00007FFF148A0000-0x00007FFF14B56000-memory.dmp

Download

memory/3632-39-0x00007FFF134E0000-0x00007FFF134F1000-memory.dmp

Download

memory/3632-33-0x00007FFF14860000-0x00007FFF14871000-memory.dmp

Download

memory/3632-32-0x00007FFF14880000-0x00007FFF1489D000-memory.dmp

Download

memory/3632-27-0x00007FFF235F0000-0x00007FFF23608000-memory.dmp

Download

memory/3632-30-0x00007FFF16FB0000-0x00007FFF16FC7000-memory.dmp

Download

memory/3632-29-0x00007FFF1C840000-0x00007FFF1C851000-memory.dmp

Download

memory/3632-34-0x00007FFF14650000-0x00007FFF1485B000-memory.dmp

Download

memory/3632-28-0x00007FFF22E70000-0x00007FFF22E87000-memory.dmp

Download

memory/3632-26-0x00007FFF148A0000-0x00007FFF14B56000-memory.dmp

Download

memory/3632-25-0x00007FFF15C30000-0x00007FFF15C64000-memory.dmp

Download

memory/3632-24-0x00007FF6AD210000-0x00007FF6AD308000-memory.dmp

Download

memory/3632-42-0x00007FFF13480000-0x00007FFF1349B000-memory.dmp

Download

memory/3632-46-0x00007FFF133A0000-0x00007FFF13407000-memory.dmp

Download

memory/3632-45-0x00007FFF13410000-0x00007FFF13440000-memory.dmp

Download

memory/3632-51-0x00007FFF128F0000-0x00007FFF12915000-memory.dmp

Download

memory/3632-50-0x00007FFF13270000-0x00007FFF13298000-memory.dmp

Download

memory/3632-49-0x00007FFF132A0000-0x00007FFF132F7000-memory.dmp

Download

memory/3632-48-0x00007FFF13300000-0x00007FFF13311000-memory.dmp

Download

memory/3632-47-0x00007FFF13320000-0x00007FFF1339C000-memory.dmp

Download

memory/3632-52-0x000002588B9E0000-0x000002588D24F000-memory.dmp

Download

memory/3632-44-0x00007FFF13440000-0x00007FFF13458000-memory.dmp

Download

memory/3632-43-0x00007FFF13460000-0x00007FFF13471000-memory.dmp

Download

memory/3632-41-0x00007FFF134A0000-0x00007FFF134B1000-memory.dmp

Download

memory/3632-40-0x00007FFF134C0000-0x00007FFF134D1000-memory.dmp

Download

memory/3632-31-0x00007FFF15C10000-0x00007FFF15C21000-memory.dmp

Download

memory/3632-38-0x00007FFF13500000-0x00007FFF13518000-memory.dmp

Download

memory/3632-37-0x00007FFF13520000-0x00007FFF13541000-memory.dmp

Download

memory/3632-36-0x00007FFF13550000-0x00007FFF13591000-memory.dmp

Download

memory/3632-35-0x00007FFF135A0000-0x00007FFF14650000-memory.dmp

Download

memory/4236-54-0x00007FFF15C30000-0x00007FFF15C64000-memory.dmp

Download

memory/4236-61-0x00007FFF22E70000-0x00007FFF22E87000-memory.dmp

Download

memory/4236-55-0x00007FFF148A0000-0x00007FFF14B56000-memory.dmp

Download

memory/4236-62-0x00007FFF1C840000-0x00007FFF1C851000-memory.dmp

Download

memory/4236-60-0x00007FFF235F0000-0x00007FFF23608000-memory.dmp

Download

memory/4236-53-0x00007FF6AD210000-0x00007FF6AD308000-memory.dmp

Download

memory/4280-79-0x00007FFF15C30000-0x00007FFF15C64000-memory.dmp

Download

memory/4280-81-0x00007FFF235F0000-0x00007FFF23608000-memory.dmp

Download

memory/4280-74-0x00007FF6AD210000-0x00007FF6AD308000-memory.dmp

Download

memory/4280-80-0x00007FFF148A0000-0x00007FFF14B56000-memory.dmp

Download

memory/4280-82-0x00007FFF22E70000-0x00007FFF22E87000-memory.dmp

Download

memory/4280-83-0x00007FFF1C840000-0x00007FFF1C851000-memory.dmp

Download

memory/4944-14-0x00007FFF15C30000-0x00007FFF15C64000-memory.dmp

Download

memory/4944-13-0x00007FF6AD210000-0x00007FF6AD308000-memory.dmp

Download

memory/4944-18-0x00007FFF1C840000-0x00007FFF1C851000-memory.dmp

Download

memory/4944-17-0x00007FFF22E70000-0x00007FFF22E87000-memory.dmp

Download

memory/4944-16-0x00007FFF235F0000-0x00007FFF23608000-memory.dmp

Download

memory/4944-15-0x00007FFF148A0000-0x00007FFF14B56000-memory.dmp

Download

memory/5020-86-0x00007FFF148A0000-0x00007FFF14B56000-memory.dmp

Download

memory/5020-85-0x00007FFF15C30000-0x00007FFF15C64000-memory.dmp

Download

memory/5020-88-0x00007FFF22E70000-0x00007FFF22E87000-memory.dmp

Download

memory/5020-87-0x00007FFF235F0000-0x00007FFF23608000-memory.dmp

Download

memory/5020-84-0x00007FF6AD210000-0x00007FF6AD308000-memory.dmp

Download

memory/5076-63-0x00007FF6AD210000-0x00007FF6AD308000-memory.dmp

Download

memory/5076-64-0x00007FFF15C30000-0x00007FFF15C64000-memory.dmp

Download

memory/5076-67-0x00007FFF22E70000-0x00007FFF22E87000-memory.dmp

Download

memory/5076-65-0x00007FFF148A0000-0x00007FFF14B56000-memory.dmp

Download

memory/5076-66-0x00007FFF235F0000-0x00007FFF23608000-memory.dmp

Download

memory/5076-68-0x00007FFF1C840000-0x00007FFF1C851000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads