11e329f394675a2cf12b6c20ccd696ba555838872e4ec93797186683fe68588e

Analysis

max time kernel
220s
max time network
239s
platform
windows10-2004_x64
resource
win10v2004-20220812-de
resource tags

arch:x64arch:x86image:win10v2004-20220812-delocale:de-deos:windows10-2004-x64systemwindows
submitted
03-11-2022 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vlc-3.0.17.4-win64.exe
Size

41.5MB
MD5

c72cb56788f32cd6df87611151336808
SHA1

1a9849cef017377f9dbf7d971bc4d6938421a1af
SHA256

fda8cbf2ee876be4eb14d7affca3a0746ef4ae78341dbb589cbdddcf912db85c
SHA512

4de78b34f50669e2c93e25c004d8cc9626663b5b38e88140136558e59a972b42e8df87d222dd951d5d31c9d58d2598c318af41fe31a61da8ab3fb5be977c5ad7
SSDEEP

786432:n9ZyOsYMCkuYbEFgLlK+Qe61Ubvcl+oKtRlf/dF1OX3bkccKP4u:n9GYMCk63e7b0l8Rlf/kLvcKQu

Score

8^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

vlc-cache-gen.exevlc.exe

pid process

3844 vlc-cache-gen.exe
1008 vlc.exe

pid	process
3844	vlc-cache-gen.exe
1008	vlc.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\axvlc.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Loads dropped DLL 64 IoCs

Processes:

vlc-3.0.17.4-win64.exevlc-cache-gen.exe

pid	process
1000	vlc-3.0.17.4-win64.exe
1000	vlc-3.0.17.4-win64.exe
1000	vlc-3.0.17.4-win64.exe
1000	vlc-3.0.17.4-win64.exe
1000	vlc-3.0.17.4-win64.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe
3844	vlc-cache-gen.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

vlc-3.0.17.4-win64.exe

description	ioc	process
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\libaudiobargraph_v_plugin.dll	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\npvlc.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libwall_plugin.dll	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblend_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmod_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d11\	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ka\	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll	vlc-3.0.17.4-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll	vlc-3.0.17.4-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo	vlc-3.0.17.4-win64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

vlc-3.0.17.4-win64.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.qcp\shell\Open\MultiSelectModel = "Player"	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.nsv\shell\Open\command	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rpl\shell	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.drc\shell\PlayWithVLC	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.adt\shell\Open\MultiSelectModel = "Player"	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpc\shell\PlayWithVLC\command	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aac\shell\Open\command	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.adt\shell\Open\command	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wvx\shell	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.caf\shell\AddToPlaylistVLC\command	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ape\shell\AddToPlaylistVLC\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --playlist-enqueue \"%1\""	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wma\shell\PlayWithVLC\command	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rec\shell\AddToPlaylistVLC\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --playlist-enqueue \"%1\""	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.2	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m3u8\shell\AddToPlaylistVLC\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --playlist-enqueue \"%1\""	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.snd\DefaultIcon	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ogv\shell\ = "Open"	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.adts\shell\AddToPlaylistVLC	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp2\shell\PlayWithVLC\MultiSelectModel = "Player"	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.zpl\shell\AddToPlaylistVLC	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aob\shell\Open\MultiSelectModel = "Player"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ra\shell\Open\MultiSelectModel = "Player"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.drc\shell\ = "Open"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpa\DefaultIcon\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49E0DBD1-9440-466C-9C97-95C67190C603}\TypeLib\ = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp2\shell\PlayWithVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.dvr-ms\ = "DVR-MS Video File (VLC)"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.nuv\DefaultIcon\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rm	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49E0DBD1-9440-466C-9C97-95C67190C603}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.amr\shell\PlayWithVLC\command	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.w64\shell\AddToPlaylistVLC\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --playlist-enqueue \"%1\""	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dv	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ram\shell\AddToPlaylistVLC\command	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.zpl\shell\PlayWithVLC\ = "Mit VLC media player wiedergeben"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.s3m\shell\ = "Open"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.voc\shell\Open\ = "Wiedergabe"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\TypeLib\ = "{DF2BBE39-40A8-433B-A279-073F48DA94B6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A4A20C2-93F3-44E8-8644-BEB2E3487E84}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xm\shell\Open	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpg\ = "MPG Video File (VLC)"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.thp\shell\Open\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.DVDMovie	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.cda\shell\PlayWithVLC\command	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\vlc.exe\shell\Open	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mov\shell\Open\ = "Wiedergabe"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ogx\shell\Open\MultiSelectModel = "Player"	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sdp	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.amv\shell\AddToPlaylistVLC\ = "Zur VLC media player Wiedergabeliste hinzufügen"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp4\shell\ = "Open"	vlc-3.0.17.4-win64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.2\ = "VLC ActiveX Plugin and IE Web Plugin v2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg1\shell\AddToPlaylistVLC\ = "Zur VLC media player Wiedergabeliste hinzufügen"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tts\shell\AddToPlaylistVLC\ = "Zur VLC media player Wiedergabeliste hinzufügen"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aiff\ = "AIFF Audio File (VLC)"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D719729-5333-406C-BF12-8DE787FD65E3}\ = "IVLCControl2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.SVCDMovie\DefaultIcon	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m4a\DefaultIcon	vlc-3.0.17.4-win64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D719729-5333-406C-BF12-8DE787FD65E3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ts\shell\PlayWithVLC\ = "Mit VLC media player wiedergeben"	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xesc\DefaultIcon\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.3g2\shell\AddToPlaylistVLC\command	vlc-3.0.17.4-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rec\shell\PlayWithVLC\MultiSelectModel = "Player"	vlc-3.0.17.4-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.iso	vlc-3.0.17.4-win64.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

1008 vlc.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

vlc-3.0.17.4-win64.exe

pid process

1000 vlc-3.0.17.4-win64.exe
1000 vlc-3.0.17.4-win64.exe
1000 vlc-3.0.17.4-win64.exe
1000 vlc-3.0.17.4-win64.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

1008 vlc.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

vlc.exe

pid process

1008 vlc.exe
1008 vlc.exe
1008 vlc.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

vlc.exe

pid process

1008 vlc.exe
1008 vlc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

1008 vlc.exe

pid	process
1008	vlc.exe

pid	process
1008	vlc.exe

pid	process
1008	vlc.exe
1008	vlc.exe
1008	vlc.exe

pid	process
1008	vlc.exe
1008	vlc.exe

pid	process
1008	vlc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

vlc-3.0.17.4-win64.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1000 wrote to memory of 3844	1000	vlc-3.0.17.4-win64.exe	vlc-cache-gen.exe
PID 1000 wrote to memory of 3844	1000	vlc-3.0.17.4-win64.exe	vlc-cache-gen.exe
PID 1000 wrote to memory of 1532	1000	vlc-3.0.17.4-win64.exe	regsvr32.exe
PID 1000 wrote to memory of 1532	1000	vlc-3.0.17.4-win64.exe	regsvr32.exe
PID 1000 wrote to memory of 1532	1000	vlc-3.0.17.4-win64.exe	regsvr32.exe
PID 1532 wrote to memory of 3400	1532	regsvr32.exe	regsvr32.exe
PID 1532 wrote to memory of 3400	1532	regsvr32.exe	regsvr32.exe
PID 1000 wrote to memory of 3272	1000	vlc-3.0.17.4-win64.exe	explorer.exe
PID 1000 wrote to memory of 3272	1000	vlc-3.0.17.4-win64.exe	explorer.exe
PID 1388 wrote to memory of 1008	1388	explorer.exe	vlc.exe
PID 1388 wrote to memory of 1008	1388	explorer.exe	vlc.exe

C:\Users\Admin\AppData\Local\Temp\vlc-3.0.17.4-win64.exe
"C:\Users\Admin\AppData\Local\Temp\vlc-3.0.17.4-win64.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1000

C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
"C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe" C:\Program Files\VideoLAN\VLC\plugins
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3844

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files\VideoLAN\VLC\axvlc.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files\VideoLAN\VLC\axvlc.dll"
3⤵
- Registers COM server for autorun
- Modifies registry class
PID:3400

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" "C:\Program Files\VideoLAN\VLC\vlc.exe"
2⤵
PID:3272

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\VideoLAN\VLC\libvlc.dll
Filesize
181KB

MD5
e0c1b861cb3b172a143a19505ccd0e46

SHA1
2c20789fe3366c9d5220f395562b7c4079d21f7f

SHA256
222d3152f3fef51afe7e077a080481d15c9bbd89095342d04f61bcabfee56bb3

SHA512
1aa024d9842ba8c355f8fcb18bd78943142759d5dfc420d9497c6cc67887078e02975fe3fb8a2ff62beae94191782da0a8794acc0073dfedf98f069fc277ba06

Download Submit
C:\Program Files\VideoLAN\VLC\libvlc.dll
Filesize
181KB

MD5
e0c1b861cb3b172a143a19505ccd0e46

SHA1
2c20789fe3366c9d5220f395562b7c4079d21f7f

SHA256
222d3152f3fef51afe7e077a080481d15c9bbd89095342d04f61bcabfee56bb3

SHA512
1aa024d9842ba8c355f8fcb18bd78943142759d5dfc420d9497c6cc67887078e02975fe3fb8a2ff62beae94191782da0a8794acc0073dfedf98f069fc277ba06

Download Submit
C:\Program Files\VideoLAN\VLC\libvlccore.dll
Filesize
2.7MB

MD5
cd9552621faa8f7e60cdc79b004f7423

SHA1
7da604e54a15d73c813e425278d5af28cc8c855a

SHA256
7494fc712ee3639b73cc2a30c9ab6bdf378159adf760051c63b077e4a74b63b3

SHA512
48c0884a129f3ff883fe4b906f8fbc672b901dd5b6ea855a198900e099ae220e63741ecf62b4058be4c400c8a3ccff8f1a082f71b875d0551dd75000830e964b

Download Submit
C:\Program Files\VideoLAN\VLC\libvlccore.dll
Filesize
2.7MB

MD5
cd9552621faa8f7e60cdc79b004f7423

SHA1
7da604e54a15d73c813e425278d5af28cc8c855a

SHA256
7494fc712ee3639b73cc2a30c9ab6bdf378159adf760051c63b077e4a74b63b3

SHA512
48c0884a129f3ff883fe4b906f8fbc672b901dd5b6ea855a198900e099ae220e63741ecf62b4058be4c400c8a3ccff8f1a082f71b875d0551dd75000830e964b

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll
Filesize
37KB

MD5
85c268bd58a180928358418b1083717b

SHA1
c2b934e6f90e0eac3c16e11a5793755f5aa8aaba

SHA256
ccfcb9b022b8c84d9ae718ab4ff77c786de655d4a360839d380a5fb3b30e82e5

SHA512
afb23f4e9a92e03ad04f8a090701207f494fd4fc2f80fa290e4240b9fc576637c38aedc58676d12bc5088bdc4169b6477ad0c5827aa864d0d0618bcf58d00e6b

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll
Filesize
37KB

MD5
85c268bd58a180928358418b1083717b

SHA1
c2b934e6f90e0eac3c16e11a5793755f5aa8aaba

SHA256
ccfcb9b022b8c84d9ae718ab4ff77c786de655d4a360839d380a5fb3b30e82e5

SHA512
afb23f4e9a92e03ad04f8a090701207f494fd4fc2f80fa290e4240b9fc576637c38aedc58676d12bc5088bdc4169b6477ad0c5827aa864d0d0618bcf58d00e6b

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll
Filesize
66KB

MD5
3c53951414872ff5559c7e1ec042d1cf

SHA1
b2ce9b5c3fd22101dc0ef22622b96e091338388b

SHA256
e35c8a6a47be5a451131bb4d130d75e70afd6812f801ec00cf7e1a5b2c68a7e4

SHA512
a9dd77ae488cd16970ce2dcda4ff1a4fb3c0cd75ca2f486f1486b54f420965406376aca0cfaf72b65cdeb7fbde64697ca0f95aa8bbaf69d856cec68aea0b7669

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll
Filesize
66KB

MD5
3c53951414872ff5559c7e1ec042d1cf

SHA1
b2ce9b5c3fd22101dc0ef22622b96e091338388b

SHA256
e35c8a6a47be5a451131bb4d130d75e70afd6812f801ec00cf7e1a5b2c68a7e4

SHA512
a9dd77ae488cd16970ce2dcda4ff1a4fb3c0cd75ca2f486f1486b54f420965406376aca0cfaf72b65cdeb7fbde64697ca0f95aa8bbaf69d856cec68aea0b7669

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll
Filesize
100KB

MD5
8d7725bace0898ad2ec7dbe5887ab64c

SHA1
127efb3d8ca63d20925aaba2ececfb290354204c

SHA256
74c4df7b3bc29fcbcac83913d26a0ea3d6238a6f3dc86e1dd1343005a8ac5794

SHA512
fb447f6b05b584782ed34e1212dd0fc6ec1f7d6f0cffcfbf9842b8428ec2539883eeeec16338552fa62b0f4e829b32ea0ec711a6af1e512323afd6543adc4c0b

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll
Filesize
100KB

MD5
8d7725bace0898ad2ec7dbe5887ab64c

SHA1
127efb3d8ca63d20925aaba2ececfb290354204c

SHA256
74c4df7b3bc29fcbcac83913d26a0ea3d6238a6f3dc86e1dd1343005a8ac5794

SHA512
fb447f6b05b584782ed34e1212dd0fc6ec1f7d6f0cffcfbf9842b8428ec2539883eeeec16338552fa62b0f4e829b32ea0ec711a6af1e512323afd6543adc4c0b

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll
Filesize
141KB

MD5
fa43e3e78f3c2f681dc43a9e791e457e

SHA1
244b10ab82b1e03ae44b5a009e1a80a9df7eccd2

SHA256
d7ee315bc6e1e17554094eb06e9f2d13db4b389df5e66535672640af5beb630a

SHA512
85f4d799ffdd2b6a54ec7a9f142f554747d9eb18d5e5580a956bb1a4a5230fc0dd39d55a496cbaf680fe93cd498beb434f0adad2cabdecc830409a2611b8dd19

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll
Filesize
141KB

MD5
fa43e3e78f3c2f681dc43a9e791e457e

SHA1
244b10ab82b1e03ae44b5a009e1a80a9df7eccd2

SHA256
d7ee315bc6e1e17554094eb06e9f2d13db4b389df5e66535672640af5beb630a

SHA512
85f4d799ffdd2b6a54ec7a9f142f554747d9eb18d5e5580a956bb1a4a5230fc0dd39d55a496cbaf680fe93cd498beb434f0adad2cabdecc830409a2611b8dd19

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll
Filesize
3.5MB

MD5
6d0d3d3b82e8a63fb9c676d485522b71

SHA1
29a194a38cb290bb729f97fbda3d912abd23e3e7

SHA256
7b88c2d1896cb474bb8c7478979633ad9148040df588ba9e6dee69be3b10e55e

SHA512
2608b569f4f5efcb486d276d292d43bdc16cef28b4071a6b3bb4b2712df26d80a5441f0c39f34581779d90f4a9ee1d34ba7a95437b9667ff7d2e339f4489faf0

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll
Filesize
3.5MB

MD5
6d0d3d3b82e8a63fb9c676d485522b71

SHA1
29a194a38cb290bb729f97fbda3d912abd23e3e7

SHA256
7b88c2d1896cb474bb8c7478979633ad9148040df588ba9e6dee69be3b10e55e

SHA512
2608b569f4f5efcb486d276d292d43bdc16cef28b4071a6b3bb4b2712df26d80a5441f0c39f34581779d90f4a9ee1d34ba7a95437b9667ff7d2e339f4489faf0

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll
Filesize
53KB

MD5
b5f3adc8ad71993c13fefd620d3d9d24

SHA1
ad1f09aaa08ecba47fb0b83e1f13f62a75f90c20

SHA256
95cc2c1a8b3468a46e21e6cee9b193653c1ef9e3cec43a0831d0f997c20503d2

SHA512
48d5626f97964360dd0746fcf873e4f535857eff711d457ba007c74bdf62d698675291877549d060ec73a35f2625d05488c34b9df7decb48a0624a50f6ec6c9f

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll
Filesize
53KB

MD5
b5f3adc8ad71993c13fefd620d3d9d24

SHA1
ad1f09aaa08ecba47fb0b83e1f13f62a75f90c20

SHA256
95cc2c1a8b3468a46e21e6cee9b193653c1ef9e3cec43a0831d0f997c20503d2

SHA512
48d5626f97964360dd0746fcf873e4f535857eff711d457ba007c74bdf62d698675291877549d060ec73a35f2625d05488c34b9df7decb48a0624a50f6ec6c9f

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll
Filesize
35KB

MD5
dba2f5a667f47533906359925d4cfb2d

SHA1
47cbe6c5c2c690df495c9b7099667317549c9d45

SHA256
69e9dcdca059c14b599b9115e7301595a9faa9bd95a9140bb6cb98240a1e2bc3

SHA512
d82c62fc94a65bd686959b34e38e10b5e0e440dce676259705ff71c628b6672c81bbb79c5f355420700bda07810c5c2f772b555eb02878aec7037499ba64e52d

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll
Filesize
35KB

MD5
dba2f5a667f47533906359925d4cfb2d

SHA1
47cbe6c5c2c690df495c9b7099667317549c9d45

SHA256
69e9dcdca059c14b599b9115e7301595a9faa9bd95a9140bb6cb98240a1e2bc3

SHA512
d82c62fc94a65bd686959b34e38e10b5e0e440dce676259705ff71c628b6672c81bbb79c5f355420700bda07810c5c2f772b555eb02878aec7037499ba64e52d

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll
Filesize
802KB

MD5
731dbde11033e06ac7d8a2c56df17279

SHA1
1adcfbdf003fbbc787a6591a0e968ae5f71944e7

SHA256
66c037d81b5bb9e8f2726ed2e4fceef5bbac3084973477d6ecf3e167be788592

SHA512
8e4944a4d2469a1ad1cc509ea4eb64f4d15954c8010f35d6d6a1a8d6aacff6ba2da9ef101e38270e0a84dffd627c1dbfaea0e90b59fb8745fd74456d5ea35a8e

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll
Filesize
802KB

MD5
731dbde11033e06ac7d8a2c56df17279

SHA1
1adcfbdf003fbbc787a6591a0e968ae5f71944e7

SHA256
66c037d81b5bb9e8f2726ed2e4fceef5bbac3084973477d6ecf3e167be788592

SHA512
8e4944a4d2469a1ad1cc509ea4eb64f4d15954c8010f35d6d6a1a8d6aacff6ba2da9ef101e38270e0a84dffd627c1dbfaea0e90b59fb8745fd74456d5ea35a8e

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll
Filesize
2.4MB

MD5
adee7d602a6041e453d9decb92b6d0ff

SHA1
d3754a19dc57ee585971f4bed177d4b8704c94d2

SHA256
60f7ea096002a642b7178a307f098ce6484cb3cd0b08b5b946a0cf8ab4bd99ba

SHA512
d0b1a55510b7c99b0957f4b2c2d84fa82c5dbfd798fc505a6447367f958c85574426f0485c64ccc749d357e85511a07426640b4f90cfc30c35cfed8a10e690e4

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll
Filesize
2.4MB

MD5
adee7d602a6041e453d9decb92b6d0ff

SHA1
d3754a19dc57ee585971f4bed177d4b8704c94d2

SHA256
60f7ea096002a642b7178a307f098ce6484cb3cd0b08b5b946a0cf8ab4bd99ba

SHA512
d0b1a55510b7c99b0957f4b2c2d84fa82c5dbfd798fc505a6447367f958c85574426f0485c64ccc749d357e85511a07426640b4f90cfc30c35cfed8a10e690e4

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll
Filesize
896KB

MD5
628a182a6f4f608da19db6d60dcbb1cb

SHA1
124d4fabb1f23684c0802fda3794ea374a4b137a

SHA256
eb6c7c94c8484c3c770d474d09a7289bac7b60e900faa1219157aa243add2135

SHA512
f689dd2a7592321b6f8b98f95b4f90c64b90e6ace0be6033e816abf78e67030980c2da07713edbff89d54cd23f13241f428e8ddbe7114822662149eda1d6458f

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll
Filesize
896KB

MD5
628a182a6f4f608da19db6d60dcbb1cb

SHA1
124d4fabb1f23684c0802fda3794ea374a4b137a

SHA256
eb6c7c94c8484c3c770d474d09a7289bac7b60e900faa1219157aa243add2135

SHA512
f689dd2a7592321b6f8b98f95b4f90c64b90e6ace0be6033e816abf78e67030980c2da07713edbff89d54cd23f13241f428e8ddbe7114822662149eda1d6458f

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll
Filesize
878KB

MD5
a1cae12a013ebae0bdf1bc48be10c1b4

SHA1
a63572fbc1370efdfdef269f5315a9bd53f8de6b

SHA256
75c57c4efb140f10967f0db71d84841f4bc18e49063f14f7217181caddddd664

SHA512
3cdbc65aebc68a3f8fb3bb6abdae359b8deb4fe67a9e6d68842802a9eb872ec2cb7fc51b1179911a71249ccef99a8f0944844c75e934a20e9212814eef8c5638

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll
Filesize
878KB

MD5
a1cae12a013ebae0bdf1bc48be10c1b4

SHA1
a63572fbc1370efdfdef269f5315a9bd53f8de6b

SHA256
75c57c4efb140f10967f0db71d84841f4bc18e49063f14f7217181caddddd664

SHA512
3cdbc65aebc68a3f8fb3bb6abdae359b8deb4fe67a9e6d68842802a9eb872ec2cb7fc51b1179911a71249ccef99a8f0944844c75e934a20e9212814eef8c5638

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll
Filesize
222KB

MD5
0de04e74f3464d13ae80878e4b746002

SHA1
fe00771ae5266b82d9dee08e1760b6dbc68ababc

SHA256
ebb50d0a7af7725fe359c664a72cfb3869fea2467ff7240028cff26151b9320e

SHA512
5da9179947945c25b96264e23c049b53a6b6b4a64adab814c2f57a2dc7b38445fd7aed2f87dd5814a435ef5637c7c33794eebbf570f1dc5f07b9e9789f62a3de

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll
Filesize
222KB

MD5
0de04e74f3464d13ae80878e4b746002

SHA1
fe00771ae5266b82d9dee08e1760b6dbc68ababc

SHA256
ebb50d0a7af7725fe359c664a72cfb3869fea2467ff7240028cff26151b9320e

SHA512
5da9179947945c25b96264e23c049b53a6b6b4a64adab814c2f57a2dc7b38445fd7aed2f87dd5814a435ef5637c7c33794eebbf570f1dc5f07b9e9789f62a3de

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll
Filesize
156KB

MD5
b6b7a00d8d30b2de62a74bf900ed3556

SHA1
6c2a4d85189b1cf9331abe22c70726b7f83e2dc5

SHA256
92a6e4a767d80872875451f3829dd58bc014eddcbfe3baa70f91b893c62a8d10

SHA512
8a20a32079d36f77f6aa3f93d7ae28ad00e1d451e3203fbaf8a974651b8c32e8c2d073ae32feb1427b734962bb3b72b121b003a75aceca695d5a52889844e961

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll
Filesize
156KB

MD5
b6b7a00d8d30b2de62a74bf900ed3556

SHA1
6c2a4d85189b1cf9331abe22c70726b7f83e2dc5

SHA256
92a6e4a767d80872875451f3829dd58bc014eddcbfe3baa70f91b893c62a8d10

SHA512
8a20a32079d36f77f6aa3f93d7ae28ad00e1d451e3203fbaf8a974651b8c32e8c2d073ae32feb1427b734962bb3b72b121b003a75aceca695d5a52889844e961

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll
Filesize
64KB

MD5
1fb097ade75953d26cf2c8189522e9da

SHA1
031ab916065e58b3b9c0fbdfa37b650d20863ec7

SHA256
0b9bb96809e49f24ac0eb43c40dd54b5cdb31328c9cb4b74ca6efb2b40b99d7b

SHA512
cdb2ee4c41b69dfe69724d32ee288264c86bb70d1f1ea3935bb36a06d3512321fb7d36a1d84556ba9f80a95aeb7157ef21bd2a61d296151b6e4db8fc1dfebda7

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll
Filesize
64KB

MD5
1fb097ade75953d26cf2c8189522e9da

SHA1
031ab916065e58b3b9c0fbdfa37b650d20863ec7

SHA256
0b9bb96809e49f24ac0eb43c40dd54b5cdb31328c9cb4b74ca6efb2b40b99d7b

SHA512
cdb2ee4c41b69dfe69724d32ee288264c86bb70d1f1ea3935bb36a06d3512321fb7d36a1d84556ba9f80a95aeb7157ef21bd2a61d296151b6e4db8fc1dfebda7

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll
Filesize
118KB

MD5
d0098f9895169ab3b6de5787ac2cab60

SHA1
97d86d6a69e44565c161f0a20dde1ab3975d579f

SHA256
f31e1107644aba06daaee8684439b5c6a970bb22c27eae7aa361b66f216b4bf7

SHA512
b52343319529a5ee5a5cfe232366f7b276024e33f20252f04a37345567a0e09fe4c9154fb5d2fb8e089b81e5348c478f67baef86e0453aeb3402fa1fc20a5f9f

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll
Filesize
118KB

MD5
d0098f9895169ab3b6de5787ac2cab60

SHA1
97d86d6a69e44565c161f0a20dde1ab3975d579f

SHA256
f31e1107644aba06daaee8684439b5c6a970bb22c27eae7aa361b66f216b4bf7

SHA512
b52343319529a5ee5a5cfe232366f7b276024e33f20252f04a37345567a0e09fe4c9154fb5d2fb8e089b81e5348c478f67baef86e0453aeb3402fa1fc20a5f9f

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll
Filesize
69KB

MD5
be1c7b81b1d68a7711ed4b184896bbb3

SHA1
3ac3c032634000b5a23af6f6dc037543ad6f6e25

SHA256
ec311366d63b2013c2bd841e8210c3bf0c1a332798892343ce5881b96a0e0958

SHA512
b7fdbf54d55fb9c46d14215ae4e0a7d270afe6912b970d9056beb4e55313c0cb1a4ec12edf442d2d9659d8f6a3d853e954b2427efda1c1546e350d42f41c8678

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll
Filesize
69KB

MD5
be1c7b81b1d68a7711ed4b184896bbb3

SHA1
3ac3c032634000b5a23af6f6dc037543ad6f6e25

SHA256
ec311366d63b2013c2bd841e8210c3bf0c1a332798892343ce5881b96a0e0958

SHA512
b7fdbf54d55fb9c46d14215ae4e0a7d270afe6912b970d9056beb4e55313c0cb1a4ec12edf442d2d9659d8f6a3d853e954b2427efda1c1546e350d42f41c8678

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll
Filesize
146KB

MD5
6f72c6a219cec570d5bb56f711bf9f02

SHA1
71901a397dd3c432fd66d9e38a0ceea7ddfcb208

SHA256
d376a0a85611dcb43bf3569b75074e9f84c2919f878ea323650d7e6dbff0a0de

SHA512
537131bfa7ca7f74f19443b2c1cd95831395320125d2f3db937ed346d3de80368ea60bea495446a6ffbec0b571cea9082959296e3c0efc5d0fb26b8ec94a214f

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll
Filesize
146KB

MD5
6f72c6a219cec570d5bb56f711bf9f02

SHA1
71901a397dd3c432fd66d9e38a0ceea7ddfcb208

SHA256
d376a0a85611dcb43bf3569b75074e9f84c2919f878ea323650d7e6dbff0a0de

SHA512
537131bfa7ca7f74f19443b2c1cd95831395320125d2f3db937ed346d3de80368ea60bea495446a6ffbec0b571cea9082959296e3c0efc5d0fb26b8ec94a214f

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll
Filesize
35KB

MD5
0d197a0d01b0f42960a0583efe6d545b

SHA1
a891251f841f66dbe2d9ce768b2042a84668a7cf

SHA256
5ca02c30f312582233856d3c6680f0c82835e555a6438d62b8e26d00e2cf0f74

SHA512
3d86b3df92561a6991a8457de97e1f369bedf37b72900ab7de709ab9a13f5cf42aedf7c58a8ffdb760e590fdeaf01c9484434b484d45fcbd2eeb53e5c4984284

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll
Filesize
35KB

MD5
0d197a0d01b0f42960a0583efe6d545b

SHA1
a891251f841f66dbe2d9ce768b2042a84668a7cf

SHA256
5ca02c30f312582233856d3c6680f0c82835e555a6438d62b8e26d00e2cf0f74

SHA512
3d86b3df92561a6991a8457de97e1f369bedf37b72900ab7de709ab9a13f5cf42aedf7c58a8ffdb760e590fdeaf01c9484434b484d45fcbd2eeb53e5c4984284

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll
Filesize
35KB

MD5
8597c490c886ab72511eaad1cd990fcb

SHA1
e48416ee850e94cdd642aaf613e656e606530d0c

SHA256
aec416b76b408209e7895b482e5e2f32c7687ac561f18430be8a1bc2f3573b69

SHA512
973e57432cdd9b64907724f1203460018e1d887eb9dcdd9a970330d6d0fb66b34b32ba6645fe41066b5e334574daff9b6e784fa0e4880614b87df8c2aa45ba6a

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll
Filesize
35KB

MD5
8597c490c886ab72511eaad1cd990fcb

SHA1
e48416ee850e94cdd642aaf613e656e606530d0c

SHA256
aec416b76b408209e7895b482e5e2f32c7687ac561f18430be8a1bc2f3573b69

SHA512
973e57432cdd9b64907724f1203460018e1d887eb9dcdd9a970330d6d0fb66b34b32ba6645fe41066b5e334574daff9b6e784fa0e4880614b87df8c2aa45ba6a

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll
Filesize
2.0MB

MD5
4297e8d196a1f2b2140bccf3def2de32

SHA1
e736a5fb3284ab42e56bedb75b3e7f77b87dd434

SHA256
0180212ce6a5bdf21ab4cef6798eb50c2b1893e23085972c9bd1d2e4cc462292

SHA512
d412ca67b7f816f6593b3c8da308730f49d40fd8df86b669cf3895ccec55b22f62043b7881a65959c6d9413750021b955581367f6db1dbfbd7a2e4d33993deee

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll
Filesize
2.0MB

MD5
4297e8d196a1f2b2140bccf3def2de32

SHA1
e736a5fb3284ab42e56bedb75b3e7f77b87dd434

SHA256
0180212ce6a5bdf21ab4cef6798eb50c2b1893e23085972c9bd1d2e4cc462292

SHA512
d412ca67b7f816f6593b3c8da308730f49d40fd8df86b669cf3895ccec55b22f62043b7881a65959c6d9413750021b955581367f6db1dbfbd7a2e4d33993deee

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll
Filesize
577KB

MD5
9910e72f75edd6c3a87837e290312f03

SHA1
e0881c129bcf51326bc2853f0ec235192f906e19

SHA256
dceea9ec37b6372cfb92d93b3c104e267257afa30c57630450bc376c2502ef39

SHA512
3df965aabcbc201ef9c6cc3fda3033ea423295c56ce45ffaaf23f57e0a72ab86c7cfd3f8917e943b17e706d28449b9d438f3e252a7011b770fc831857e913fe6

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll
Filesize
577KB

MD5
9910e72f75edd6c3a87837e290312f03

SHA1
e0881c129bcf51326bc2853f0ec235192f906e19

SHA256
dceea9ec37b6372cfb92d93b3c104e267257afa30c57630450bc376c2502ef39

SHA512
3df965aabcbc201ef9c6cc3fda3033ea423295c56ce45ffaaf23f57e0a72ab86c7cfd3f8917e943b17e706d28449b9d438f3e252a7011b770fc831857e913fe6

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll
Filesize
280KB

MD5
272800648ea3eb35282d67deaa566d2d

SHA1
212229f0811ba5790c96b100b36daa1dc501a7d8

SHA256
704d3e4b1886387af12481cad1beeb433fa3eeb7a1879b1ed3f9086fcca9beaa

SHA512
ad4c50f7c7a5e75a2bcc34452e134f42af0b2d8a9cdc5c95edf6e05e491419cb88f6f78ba28aa951ad3c0e3daf1bb41a9287e3be6300c0ae4b9e514e1ad75ec4

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll
Filesize
280KB

MD5
272800648ea3eb35282d67deaa566d2d

SHA1
212229f0811ba5790c96b100b36daa1dc501a7d8

SHA256
704d3e4b1886387af12481cad1beeb433fa3eeb7a1879b1ed3f9086fcca9beaa

SHA512
ad4c50f7c7a5e75a2bcc34452e134f42af0b2d8a9cdc5c95edf6e05e491419cb88f6f78ba28aa951ad3c0e3daf1bb41a9287e3be6300c0ae4b9e514e1ad75ec4

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\librist_plugin.dll
Filesize
110KB

MD5
378cbb2e35431c52feea416436713e0d

SHA1
db3206e44e775c818e16e62957712164607b2845

SHA256
a60e256a870a7f34f5e84f9c7b6c0b436cdb881856a58f0743d01da3734effe8

SHA512
1ff87b038ede0b050a7f52106f598071fabadd5dc3e064c0d16baa0c85d7eb1895b5d9e11f0493322df628026611ab70622ab111dce5a03fa617a2680036e5e2

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\librist_plugin.dll
Filesize
110KB

MD5
378cbb2e35431c52feea416436713e0d

SHA1
db3206e44e775c818e16e62957712164607b2845

SHA256
a60e256a870a7f34f5e84f9c7b6c0b436cdb881856a58f0743d01da3734effe8

SHA512
1ff87b038ede0b050a7f52106f598071fabadd5dc3e064c0d16baa0c85d7eb1895b5d9e11f0493322df628026611ab70622ab111dce5a03fa617a2680036e5e2

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll
Filesize
654KB

MD5
613915de0d6aea4308501689b0f26430

SHA1
c9e9968cf5893331fc58a3c907f5958f807f825f

SHA256
93dc1cb35a905cca215f0f4d14d3a3716dea5dd37f43fec91c72ab6cc69c43be

SHA512
aa50cfb5644c7fc9d29fa6921c1a83ffb347cfc39b88c3adfb2980168ac1e1c80c80dd3a5f629040c417b230e227eb8963631322f176f1c7a4bf0439897be137

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll
Filesize
654KB

MD5
613915de0d6aea4308501689b0f26430

SHA1
c9e9968cf5893331fc58a3c907f5958f807f825f

SHA256
93dc1cb35a905cca215f0f4d14d3a3716dea5dd37f43fec91c72ab6cc69c43be

SHA512
aa50cfb5644c7fc9d29fa6921c1a83ffb347cfc39b88c3adfb2980168ac1e1c80c80dd3a5f629040c417b230e227eb8963631322f176f1c7a4bf0439897be137

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll
Filesize
69KB

MD5
c7b5105cdf0047dd811a9a1ae9e57873

SHA1
9f4cab9199fbe2289a5f657fc51d236fe422e164

SHA256
3a9124d0816a9d404ece997abebec1e809f3b2940638419d6f7eb215ce24f9ea

SHA512
3ef0723db538ebcb7e157dee07dd9813346cee6631458afe870f12aeabcf299eff2aad48ebf0ad99a715100922b93e4f15e012bcbc0c373839b54f5d7d9f2d77

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll
Filesize
69KB

MD5
c7b5105cdf0047dd811a9a1ae9e57873

SHA1
9f4cab9199fbe2289a5f657fc51d236fe422e164

SHA256
3a9124d0816a9d404ece997abebec1e809f3b2940638419d6f7eb215ce24f9ea

SHA512
3ef0723db538ebcb7e157dee07dd9813346cee6631458afe870f12aeabcf299eff2aad48ebf0ad99a715100922b93e4f15e012bcbc0c373839b54f5d7d9f2d77

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libscreen_plugin.dll
Filesize
42KB

MD5
6206071c68be067a5c7faa16c23025c3

SHA1
c4ca294cf405bc306c0c67559cfc8e351bf7742a

SHA256
42c034421a6b52471fc5e2b3cc5e4d267c4b082f545db86279cffea5d25edb91

SHA512
18a21a59047a77e2a35e313d0f7512e911c6efe7eb9e483ddaa145eb522b6d7c47af673f96f805294a8dd819c5650d269ad1b929ec406b5c5310a3a65451d543

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libscreen_plugin.dll
Filesize
42KB

MD5
6206071c68be067a5c7faa16c23025c3

SHA1
c4ca294cf405bc306c0c67559cfc8e351bf7742a

SHA256
42c034421a6b52471fc5e2b3cc5e4d267c4b082f545db86279cffea5d25edb91

SHA512
18a21a59047a77e2a35e313d0f7512e911c6efe7eb9e483ddaa145eb522b6d7c47af673f96f805294a8dd819c5650d269ad1b929ec406b5c5310a3a65451d543

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll
Filesize
34KB

MD5
95c00ef49593a3cabbb91c63cf9465e0

SHA1
432cf2bbca09f89255c2f31d0e18fb8c16579ffc

SHA256
bac9de5e42766a0fc112c8b9632f87feddd8091c8508f92801f2ce05b4721a9c

SHA512
83139436fe46d1d4cc71d825e0f80c317d650301edc7dcb6a1b14aab7968d5c69c9e47b227d479a07cbcea9742241d0d02569007b25bb48465ca13b61d303e86

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll
Filesize
34KB

MD5
95c00ef49593a3cabbb91c63cf9465e0

SHA1
432cf2bbca09f89255c2f31d0e18fb8c16579ffc

SHA256
bac9de5e42766a0fc112c8b9632f87feddd8091c8508f92801f2ce05b4721a9c

SHA512
83139436fe46d1d4cc71d825e0f80c317d650301edc7dcb6a1b14aab7968d5c69c9e47b227d479a07cbcea9742241d0d02569007b25bb48465ca13b61d303e86

Download Submit
C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
Filesize
135KB

MD5
a2d34d1ffe163d7ff80ba6f8b10bf179

SHA1
a7bb649a1490d463afce5e84e347439d82177959

SHA256
1f1b522d4a0e7596e9f329d7dfb2baafcf498c37cf1df91f95411527050d6942

SHA512
e1bdc28c736fc8f72673749d0401fefff61b777991cc7d6f63807ca9389bd97407472cad686790cac30e652cc7db9e21b6ad3d8322b2d129022a0c82aa269a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB58B.tmp\LangDLL.dll
Filesize
7KB

MD5
20850d4d5416fbfd6a02e8a120f360fc

SHA1
ac34f3a34aaa4a21efd6a32bc93102639170e219

SHA256
860b409b065b747aab2a9937f02d08b6fd7309993b50d8e4b53983c8c2b56b61

SHA512
c8048b9ae0ced72a384c5ab781083a76b96ae08d5c8a5c7797f75a7e54e9cd9192349f185ee88c9cf0514fc8d59e37e01d88b9c8106321c0581659ebe1d1c276

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB58B.tmp\System.dll
Filesize
26KB

MD5
4f25d99bf1375fe5e61b037b2616695d

SHA1
958fad0e54df0736ddab28ff6cb93e6ed580c862

SHA256
803931797d95777248dee4f2a563aed51fe931d2dd28faec507c69ed0f26f647

SHA512
96a8446f322cd62377a93d2088c0ce06087da27ef95a391e02c505fb4eb1d00419143d67d89494c2ef6f57ae2fd7f049c86e00858d1b193ec6dde4d0fe0e3130

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB58B.tmp\nsDialogs.dll
Filesize
12KB

MD5
2029c44871670eec937d1a8c1e9faa21

SHA1
e8d53b9e8bc475cc274d80d3836b526d8dd2747a

SHA256
a4ae6d33f940a80e8fe34537c5cc1f8b8679c979607969320cfb750c15809ac2

SHA512
6f151c9818ac2f3aef6d4cabd8122c7e22ccf0b84fa5d4bcc951f8c3d00e8c270127eac1e9d93c5f4594ac90de8aff87dc6e96562f532a3d19c0da63a28654b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB58B.tmp\nsExec.dll
Filesize
10KB

MD5
dcaaa39e47a9144ae10ee67b3183f4e1

SHA1
2af87fcebff57411e929dd2fce767e9a1e4d98e1

SHA256
da30c0f57a8a412bdc0fca182702f568bd91007475d1823464658fa523a4af9f

SHA512
d56997d74d841d01c62b7db4150729f395b57d065a1182249483640f80720fb6dc7a457cc3a23367982f92f85e9274507d6157f698a2e22ea11266866fb1bc2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB58B.tmp\nsProcess.dll
Filesize
30KB

MD5
455c36efa23f430cc5a28af635e2c091

SHA1
e007be0d67ecf79f06be27ffbdbd5396f0ab1c1a

SHA256
411907cd676313fab94c4765bb6eec0d736fba7f9ce50cbc1dbc0fcd953f832d

SHA512
3b75bf8c4e8c6cf84ec367e2a2b45b50c3f45070a77c672c68f88ec67a93ce24eac4fec00443f90ac57d1143595dc70284db3e6f8f0104f21ba408e1ffaacdf8

Download Submit
memory/1008-200-0x0000000000000000-mapping.dmp

Download
memory/1532-197-0x0000000000000000-mapping.dmp

Download
memory/3272-199-0x0000000000000000-mapping.dmp

Download
memory/3400-198-0x0000000000000000-mapping.dmp

Download
memory/3844-137-0x0000000000000000-mapping.dmp

Download