Overview
overview
8Static
static
3spvod_player.exe
windows7-x64
8spvod_player.exe
windows10-2004-x64
8$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$SYSDIR/pncrt.dll
windows7-x64
3$SYSDIR/pncrt.dll
windows10-2004-x64
3Codecs/Rea...er.dll
windows7-x64
1Codecs/Rea...er.dll
windows10-2004-x64
1Codecs/WMFDemux.dll
windows7-x64
1Codecs/WMFDemux.dll
windows10-2004-x64
1Codecs/asyncflt.dll
windows7-x64
1Codecs/asyncflt.dll
windows10-2004-x64
1Codecs/atrc.dll
windows7-x64
1Codecs/atrc.dll
windows10-2004-x64
1Codecs/cook.dll
windows7-x64
1Codecs/cook.dll
windows10-2004-x64
1Codecs/drvc.dll
windows7-x64
3Codecs/drvc.dll
windows10-2004-x64
3Codecs/msvcr71.dll
windows7-x64
3Codecs/msvcr71.dll
windows10-2004-x64
3Codecs/raac.dll
windows7-x64
1Codecs/raac.dll
windows10-2004-x64
1GifShower.dll
windows7-x64
1GifShower.dll
windows10-2004-x64
1Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7vjocx.dll
windows7-x64
8vjocx.dll
windows10-2004-x64
8新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 00:28
Static task
static1
Behavioral task
behavioral1
Sample
spvod_player.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
spvod_player.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$SYSDIR/pncrt.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
$SYSDIR/pncrt.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Codecs/RealMediaSplitter.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
Codecs/RealMediaSplitter.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Codecs/WMFDemux.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral10
Sample
Codecs/WMFDemux.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Codecs/asyncflt.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
Codecs/asyncflt.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Codecs/atrc.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
Codecs/atrc.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Codecs/cook.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
Codecs/cook.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Codecs/drvc.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
Codecs/drvc.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Codecs/msvcr71.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
Codecs/msvcr71.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Codecs/raac.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
Codecs/raac.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
GifShower.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral24
Sample
GifShower.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Uninstall.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral26
Sample
Uninstall.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
vjocx.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral28
Sample
vjocx.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
新云软件.url
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
新云软件.url
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
spvod_player.exe
-
Size
1.7MB
-
MD5
29cde3b138c0146acb08adf6e1728bae
-
SHA1
5b7885fc49b7dc121a89b2764da05d66a3595617
-
SHA256
f7ebbcb19286e0845344e9e9ba09533ce3990071040244e96f2c9623c06604c2
-
SHA512
eb6c2b9b1e67658caefe3635507a6926b60b90b2118a1ed89081ca13dc3789ad84410cd1683f420405ab89670c53d98232f9bfde0727709a3ef3e038304cefab
-
SSDEEP
49152:OIVRXtlkEQua3XaADxjKEZ3rpU84H6ZuwJhSLrnF:OIrB/a3XaWxT7p6uFornF
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\vvdsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Nagasoft\\vjocx.dll" spvod_player.exe -
Loads dropped DLL 5 IoCs
pid Process 2032 spvod_player.exe 2032 spvod_player.exe 2032 spvod_player.exe 2032 spvod_player.exe 2032 spvod_player.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 23 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Nagasoft\Codecs\msvcr71.dll spvod_player.exe File opened for modification C:\Windows\SysWOW64\Nagasoft\vjocx.dll spvod_player.exe File opened for modification C:\Windows\SysWOW64\Nagasoft\Codecs\asyncflt.ax spvod_player.exe File created C:\Windows\SysWOW64\Nagasoft\Codecs\drvc.dll spvod_player.exe File opened for modification C:\Windows\SysWOW64\Nagasoft\Codecs\atrc.dll spvod_player.exe File created C:\Windows\SysWOW64\Nagasoft\Codecs\cook.dll spvod_player.exe File opened for modification C:\Windows\SysWOW64\Nagasoft\Codecs\raac.dll spvod_player.exe File opened for modification C:\Windows\SysWOW64\pncrt.dll spvod_player.exe File created C:\Windows\SysWOW64\Nagasoft\vjocx.dll spvod_player.exe File opened for modification C:\Windows\SysWOW64\Nagasoft\Codecs\WMFDemux.dll spvod_player.exe File created C:\Windows\SysWOW64\Nagasoft\Codecs\WMFDemux.dll spvod_player.exe File opened for modification C:\Windows\SysWOW64\Nagasoft\Codecs\drvc.dll spvod_player.exe File created C:\Windows\SysWOW64\Nagasoft\Codecs\msvcr71.dll spvod_player.exe File created C:\Windows\SysWOW64\Nagasoft\Codecs\raac.dll spvod_player.exe File created C:\Windows\SysWOW64\Nagasoft\GifShower.dll spvod_player.exe File created C:\Windows\SysWOW64\Nagasoft\Codecs\asyncflt.ax spvod_player.exe File opened for modification C:\Windows\SysWOW64\Nagasoft\Codecs\cook.dll spvod_player.exe File created C:\Windows\SysWOW64\Nagasoft\Codecs\atrc.dll spvod_player.exe File created C:\Windows\SysWOW64\pncrt.dll spvod_player.exe File created C:\Windows\SysWOW64\Nagasoft\Uninstall.exe spvod_player.exe File opened for modification C:\Windows\SysWOW64\Nagasoft\GifShower.dll spvod_player.exe File opened for modification C:\Windows\SysWOW64\Nagasoft\Codecs\RealMediaSplitter.ax spvod_player.exe File created C:\Windows\SysWOW64\Nagasoft\Codecs\RealMediaSplitter.ax spvod_player.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F} spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\InprocServer32\ = "C:\\Windows\\SysWow64\\Nagasoft\\vjocx.dll" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\InprocServer32\ThreadingModel = "apartment" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2BAD2D8E-2B5C-4E1C-BDFE-D4D561D986E2}\Version\ = "1.0" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{05C43810-244F-4630-A9A2-F4CB5D2FB6D1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32 spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\ProgID spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1D416E10-79D7-4F06-9ED8-C4DF23AA6DF6}\1.0\FLAGS spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{071825D4-FA84-45A6-A82F-B492DD197E3B} spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05C43810-244F-4630-A9A2-F4CB5D2FB6D1}\TypeLib\Version = "1.0" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\InprocServer32 spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{071825D4-FA84-45A6-A82F-B492DD197E3B}\ = "ICVodClient" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{071825D4-FA84-45A6-A82F-B492DD197E3B}\TypeLib\Version = "1.0" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{85087867-B23C-4425-864A-88AE60CD924D} spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}\Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769} spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E} spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{071825D4-FA84-45A6-A82F-B492DD197E3B}\TypeLib\Version = "1.0" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2BAD2D8E-2B5C-4E1C-BDFE-D4D561D986E2}\ToolboxBitmap32 spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{05C43810-244F-4630-A9A2-F4CB5D2FB6D1}\TypeLib\ = "{85087867-B23C-4425-864A-88AE60CD924D}" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{05C43810-244F-4630-A9A2-F4CB5D2FB6D1}\NumMethods spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{85087867-B23C-4425-864A-88AE60CD924D}\1.0\ = "GifShower 1.0 ÀàÐÍ¿â" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\InprocServer32\ = "C:\\Windows\\SysWow64\\Nagasoft\\Codecs\\RealMediaSplitter.ax" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}\FriendlyName = "RealAudio Decoder" spvod_player.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}\FilterData = 020000000000600002000000000000003070693300000000000000000900000000000000000000003074793300000000e0000000f00000003174793300000000e0000000000100003274793300000000e0000000100100003374793300000000e0000000200100003474793300000000e0000000300100003574793300000000e0000000400100003674793300000000e0000000500100003774793300000000e0000000600100003874793300000000e0000000700100003170693308000000000000000100000000000000000000003074793300000000e0000000800100006175647300001000800000aa00389b7131345f3400001000800000aa00389b7132385f3800001000800000aa00389b714154524300001000800000aa00389b71434f4f4b00001000800000aa00389b71444e455400001000800000aa00389b715349505200001000800000aa00389b71ff00000000001000800000aa00389b715241414300001000800000aa00389b715241435000001000800000aa00389b710100000000001000800000aa00389b71 spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\VersionIndependentProgID spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\AppID spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GifShower.DLL spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2BAD2D8E-2B5C-4E1C-BDFE-D4D561D986E2}\MiscStatus\ = "0" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05C43810-244F-4630-A9A2-F4CB5D2FB6D1} spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05C43810-244F-4630-A9A2-F4CB5D2FB6D1}\ = "PSFactoryBuffer" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}\0 = "0,4,,2E524D46" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}\CLSID = "{941A4793-A705-4312-8DFC-C11CA05F397E}" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\TypeLib\ = "{1D416E10-79D7-4F06-9ED8-C4DF23AA6DF6}" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2BAD2D8E-2B5C-4E1C-BDFE-D4D561D986E2}\MiscStatus\1 spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{05C43810-244F-4630-A9A2-F4CB5D2FB6D1}\TypeLib spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1D416E10-79D7-4F06-9ED8-C4DF23AA6DF6}\1.0\ = "vodClient 1.0 ÀàÐÍ¿â" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E} spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32\ = "C:\\Windows\\SysWow64\\Nagasoft\\Codecs\\RealMediaSplitter.ax" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}\CLSID = "{765035B3-5944-4A94-806B-20EE3415F26F}" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1932C124-77DA-4151-99AA-234FEA09F463} spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\VersionIndependentProgID\ = "VJ.VodClient" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\Version\ = "1.0" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GifShower.GifShow.1\CLSID\ = "{2BAD2D8E-2B5C-4E1C-BDFE-D4D561D986E2}" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GifShower.GifShow\CLSID\ = "{2BAD2D8E-2B5C-4E1C-BDFE-D4D561D986E2}" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{05C43810-244F-4630-A9A2-F4CB5D2FB6D1}\ = "IGifShow" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1932C124-77DA-4151-99AA-234FEA09F463}\FriendlyName = "GDCL WMV/WMA Parser" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{071825D4-FA84-45A6-A82F-B492DD197E3B}\ProxyStubClsid32 spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2BAD2D8E-2B5C-4E1C-BDFE-D4D561D986E2}\AppID = "{B6188993-A07B-40E9-ADF8-CB3E53305870}" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}\FriendlyName = "RealMedia Source" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1932C124-77DA-4151-99AA-234FEA09F463} spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1932C124-77DA-4151-99AA-234FEA09F463}\InprocServer32\ = "C:\\Windows\\SysWow64\\Nagasoft\\Codecs\\WMFDemux.dll" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2BAD2D8E-2B5C-4E1C-BDFE-D4D561D986E2}\VersionIndependentProgID\ = "GifShower.GifShow" spvod_player.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\FilterData = 02000000000060000200000000000000307069330000000000000000040000000000000000000000307479330000000090000000a0000000317479330000000090000000b0000000327479330000000090000000c0000000337479330000000090000000d0000000317069330800000000000000010000000000000000000000307479330000000090000000e00000007669647300001000800000aa00389b715256323000001000800000aa00389b715256333000001000800000aa00389b715256343000001000800000aa00389b715256343100001000800000aa00389b7100000000000000000000000000000000 spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1932C124-77DA-4151-99AA-234FEA09F463}\CLSID = "{1932C124-77DA-4151-99AA-234FEA09F463}" spvod_player.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4003189-95B1-4A2F-9A87-F2B03665960D}\MiscStatus\1 spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GifShower.GifShow.1\ = "GifShow Class" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{85087867-B23C-4425-864A-88AE60CD924D}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\Nagasoft\\" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\ = "RealMedia Source" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\ = "RealAudio Decoder" spvod_player.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{1932C124-77DA-4151-99AA-234FEA09F463}\FilterData = 02000000000060000300000000000000307069330000000000000000010000000000000000000000307479330000000088000000980000003170693308000000000000000100000000000000000000003074793300000000a8000000b80000003270693308000000000000000100000000000000000000003074793300000000c8000000b800000083eb36e44f52ce119f530020af0ba77001086d6bda9ad011a52000a0d10129c07669647300001000800000aa00389b71000000000000000000000000000000006175647300001000800000aa00389b71 spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{071825D4-FA84-45A6-A82F-B492DD197E3B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" spvod_player.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{071825D4-FA84-45A6-A82F-B492DD197E3B}\TypeLib\ = "{1D416E10-79D7-4F06-9ED8-C4DF23AA6DF6}" spvod_player.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
MD53c262235c90b600be5ff457bc9c8cccb
SHA17ebd941bd26c8f7b64c3784602ef1a49c9ced8cc
SHA256d10e22a9198fc6d35ccd19512b03c00614300a13f7deb2e2abf383fc61075235
SHA512cff32ad228eb672c8048486992dcd0f7a30b9b1f237a054e4d5287e49298480c780295d5f41325b86e95b368a679567ab6e2dbb5d03c04f2ef69ac65b10b4eff
-
Filesize
104KB
MD55e06cd629712576a32fbcd8a0c62b4dd
SHA1fd5cb2ce5e8d9010715b57b0c8a939e58697afc6
SHA25658eb294d7fa3907dee24647aaf0a9ccc409f8f39aa9e03269cc8ea381c012feb
SHA51209fc01869f59c1583d25d5aee6dbfcd4e3443fddcd751b3eade2447c6220263f7f83aafb174a026a0cebea904b67b9a256a02fa152f29d847c3993737642282a
-
Filesize
52KB
MD576283f65a79b37afd28b05cd7a3bf51b
SHA12a5ef2a6cc21229d34b32c961b27018f89a1cd67
SHA256f5fd0b79c0f6938e287b803ad8c86663befcdaf280391e25550ec5aad32f604a
SHA512d223aa86ddbb56a1bce91e0108c7ab0476f2879d8eba704291994d4bc0487c47b2def1f51f061c8801743d874b1f14a48a701923795eaa3ce21231d34b397749
-
Filesize
132KB
MD5407ca7065f10a6397db208ad28b2990e
SHA1574d120ff00d8204e159ef4372e7e9675330288f
SHA2560e2b461e74409bd6d7a4f6f6cac153310d3b03aafc4d394c757aa3f26345ca14
SHA512d4dce120d19bf0ceca38aeba4b08329ec9adac27c1b0e796709351971b923d6a88017bfa7a74fc09833f3bd15c803352f30c6a1b6692f80fb73150881cb36671
-
Filesize
1.5MB
MD5da162564646da62c40238153a1cbf268
SHA1b0314c89f0060d69f82d1bd057cc0cec84694794
SHA256cfd9e9cd51d43f2366191ff5fefa4446b44961b37f203b943454f228d827d00c
SHA51251c5c881395f516e9f670148e9853ef2ed3583270847cc32d66b39ae4cb72020dc8546ba845da8c8c132d24e489987987f8c0dae5b858c70dbc0e7bef5612393