File scan report
Verdict Suspicious
Is Blur
No major detections, no malicious files it created, and prevalence is widely seen but new for an NSIS/Tauri installer.
Read the whole reasonShow less
Why Suspicious? One antivirus engine (APEX) flags it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Treat as suspicious; do not run on production systems until additional independent verification is obtained.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The single malicious result comes from a less reliable engine and is unsupported by any major antivirus engine. The file is unsigned and the import-table fingerprint matches prior mixed-verdict samples that share the same installer framework. Prevalence is high enough to rule out rare and risk, but the combination of unsigned status and offensive MITRE techniques keeps the file in mixed-signals territory.
What We Detected
75 engines scanned the sample; only APEX (less reliable) returned a malicious label. Sandbox execution recorded MITRE T1055 (Process Injection) and T1134 (Access Token Manipulation) plus access to the Windows password store. Ten files it created were inspected; none carried malicious verdicts. The file is unsigned and shows NSIS/Tauri installer artifacts.
Threat Behavior
No persistence mechanisms or registry modifications were recorded.
What To Do Now
Keep Windows Defender and other security software enabled. If the file is required, run it in a virtual machine or sandbox first and monitor for unexpected outbound connections or credential-store access.
- Only 1/70 engines flagged malicious
- No major detections
- No malicious files it created
- Common_new prevalence (344 submitters)
- Unsigned executable
- Sandbox observed and techniques
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 21sandbox rule tags
- 2spawned processes
- 0network contacts
- 23filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as setting up auto-start; no auto-start entry was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
BlurAutoClicker_3.9.6_x64-setup.exe
ef6679d76001656a8a896a2298a38a102e849569b50a856140af6ed243b5a0ea
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
BlurAutoClicker_3.9.6_x64-setup.exe
"C:\Users\<USER>\Desktop\BlurAutoClicker_3.9.6_x64-setup.exe"
Test run - Evidence 3 of 5: ProcessSeen in the test run
BlurAutoClicker_3.9.6_x64-setup.exe
"C:\Users\user\Desktop\BlurAutoClicker_3.9.6_x64-setup.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
nsgCDFF.tmp
C:\Users\<USER>\AppData\Local\Temp\nsgCDFF.tmp
Test run - Evidence 5 of 5: Written fileSeen in the test run
System.dll
C:\Users\<USER>\AppData\Local\Temp\nsgCE00.tmp\System.dll
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
21MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1115
- T1125
- T1129· Loads modules
- T1134
- T1222
- T1497.001· Sandbox evasion
- T1518· Checks your AV
- T1529
- T1547.009· Auto-start
- T1574· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
BlurAutoClicker_3.9.6_x64-setup.exe"C:\Users\<USER>\Desktop\BlurAutoClicker_3.9.6_x64-setup.exe"BlurAutoClicker_3.9.6_x64-setup.exe"C:\Users\user\Desktop\BlurAutoClicker_3.9.6_x64-setup.exe"
Files
21Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nsgCDFF.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsgCE00.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsgCE00.tmp\modern-wizard.bmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsgCE00.tmp\nsDialogs.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsgCE00.tmp\nsis_tauri_utils.dll - Written
C:\Users\<USER>\AppData\Local\BlurAutoClicker\BlurAutoClicker.exe
Show all 21 entries for files
- Written
C:\Users\<USER>\AppData\Local\BlurAutoClicker\.gitkeep - Written
C:\Users\<USER>\AppData\Local\BlurAutoClicker\concrt140.dll - Written
C:\Users\<USER>\AppData\Local\BlurAutoClicker\crashpad_handler.exe - Written
C:\Users\<USER>\AppData\Local\BlurAutoClicker\msvcp140.dll - Written
C:\Users\<USER>\AppData\Local\BlurAutoClicker\msvcp140_1.dll - Written
C:\Users\<USER>\AppData\Local\BlurAutoClicker\msvcp140_2.dll - Written
C:\Users\<USER>\AppData\Local\BlurAutoClicker\msvcp140_atomic_wait.dll - Written
C:\Users\<USER>\AppData\Local\BlurAutoClicker\msvcp140_codecvt_ids.dll - Written
C:\Users\<USER>\AppData\Local\BlurAutoClicker\vccorlib140.dll - Deleted
C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsiD9E6.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsoDAA4.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsl227.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nszE5C3.tmp
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
cversions.3.mGlobal\OneSettingQueryMutex+compat+encapsulation
Sandbox background — not the file
10The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
Show all 10 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM process
lsass.exeC:\Windows\system32\lsass.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 8 children at runtime. None are currently flagged malicious in our cache. 8 have no saved verdict and were not checked; that is missing coverage, not a finding.
- dccbeee00816cc95a905…144819Not checkedno saved verdict
- d1f4225df2cd877dbf13…fc9ce7Not checkedno saved verdict
- 6ba74597b41ed54f7576…50fa73Not checkedno saved verdict
- 2a85ba896ef9e5b56b1a…c35272Not checkedno saved verdict
- 54716f0738af891f283d…cf974eNot checkedno saved verdict
- a7146c08f89fe5b04541…03434eNot checkedno saved verdict
- 8a65c7596ef2e6938731…608d78Not checkedno saved verdict
- 3d0cbfaa1bf3eecf5a3f…f60e2bNot checkedno saved verdict
Chapter 04
Technical details
1 of the 70 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
- APEXMalicious
File fingerprint
- Last analyzed
- Sep 4, 2026, 3:47 PM UTC
- SHA-256
ef6679d76001656a8a896a2298a38a102e849569b50a856140af6ed243b5a0ea- SHA-1
0b868e5d80a62fe793af76d473b4a8a4471ff291- MD5
cc5bd5d3764d51955200f405d015c4ea
About this file
BlurAutoClicker_3.9.6_x64-setup.exe is a Win32 EXE file of 8.1 MB.
- Type and size
- Win32 EXE · 8.1 MB
- Signer
- UnsignedNo code signature.
- First seen
- Aug 24, 2026On VirusTotal.
- Submitted by
- 344 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned
Antivirus consensus
1 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- APEXMalicious: Malicious
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is BlurAutoClicker_3.9.6_x64-setup.exe safe, or is it malware?
What is BlurAutoClicker_3.9.6_x64-setup.exe?
How many antivirus engines detected BlurAutoClicker_3.9.6_x64-setup.exe?
What should I do if I already installed BlurAutoClicker_3.9.6_x64-setup.exe?
What is the SHA-256 hash of BlurAutoClicker_3.9.6_x64-setup.exe?
How up to date is this analysis of BlurAutoClicker_3.9.6_x64-setup.exe?
Community
Member reviews and reports for this exact file hash.