691b137ae974fdc240a22be26696ffe90468bf13fca23a0924ca71e4c9d03ab5

Analysis

user interaction
yes
max time kernel
55s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FUCK.exe
Size 2.3MB
Sample260730-t3mkvscc68
SHA256 691b137ae974fdc240a22be26696ffe90468bf13fca23a0924ca71e4c9d03ab5
MD5 7effbdabc1e7d976f8483020664f312d
SHA1 dc58c5d65963f9773f0cbd4681181bf5350c9b90
SHA512 78053e280cb0986bb55f729b849f2f6040bb9602d3cad7a99d82e44cd1497773d7b0152b28dc748c261f6e147c9f6bd9f98f4b436a3da67aaf2fbb94772d5c6a
SSDEEP 49152:z3z11C2O6MtGKiK6bmviJ+2tQjG6P9WcafwL5KyR8mX0oNRX6o1K+ijq:zR1+kKjf2tZ611afwKyR8KHNRXfQ3jq
TLSH
T1B8B5334467F29610C2E6EABC4AA2FF0915BDFCD2C344DB1F0EA70C7A5B3B2295C15A45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	FUCK.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	FUCK.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	FUCK.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FarlandPlayer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FUCK.exe"	FUCK.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	FUCK.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	FUCK.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	FUCK.exe

Suspicious behavior: AddClipboardFormatListener 31 IoCs

pid	Process
2580	vlc.exe
4040	vlc.exe
4564	vlc.exe
4660	vlc.exe
3420	vlc.exe
4952	vlc.exe
1452	vlc.exe
3520	vlc.exe
2004	vlc.exe
3252	vlc.exe
2808	vlc.exe
5052	vlc.exe
4208	vlc.exe
304	vlc.exe
4800	vlc.exe
3220	vlc.exe
4048	vlc.exe
2828	vlc.exe
1104	vlc.exe
548	vlc.exe
3696	vlc.exe
2868	vlc.exe
2236	vlc.exe
4688	vlc.exe
4552	vlc.exe
3864	vlc.exe
4404	vlc.exe
544	vlc.exe
4164	vlc.exe
1612	vlc.exe
4792	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2112	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
3432	FUCK.exe
3432	FUCK.exe
3432	FUCK.exe
3432	FUCK.exe
388	FUCK.exe
388	FUCK.exe
388	FUCK.exe
388	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
3432	FUCK.exe
388	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
388	FUCK.exe
3432	FUCK.exe
388	FUCK.exe
3432	FUCK.exe
388	FUCK.exe
3432	FUCK.exe
388	FUCK.exe
3432	FUCK.exe
388	FUCK.exe
3432	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
388	FUCK.exe
388	FUCK.exe
388	FUCK.exe
388	FUCK.exe
3432	FUCK.exe
3432	FUCK.exe
3432	FUCK.exe
3432	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
3432	FUCK.exe
2112	FUCK.exe
388	FUCK.exe
388	FUCK.exe
388	FUCK.exe
388	FUCK.exe
3432	FUCK.exe
3432	FUCK.exe
3432	FUCK.exe
3432	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
2112	FUCK.exe
3432	FUCK.exe
2112	FUCK.exe
388	FUCK.exe
388	FUCK.exe

Suspicious behavior: GetForegroundWindowSpam 29 IoCs

pid	Process
4564	vlc.exe
4660	vlc.exe
3420	vlc.exe
4952	vlc.exe
1452	vlc.exe
3520	vlc.exe
2004	vlc.exe
3252	vlc.exe
2808	vlc.exe
5052	vlc.exe
4208	vlc.exe
304	vlc.exe
4800	vlc.exe
3220	vlc.exe
4048	vlc.exe
2828	vlc.exe
1104	vlc.exe
548	vlc.exe
3696	vlc.exe
2868	vlc.exe
2236	vlc.exe
4688	vlc.exe
4552	vlc.exe
3864	vlc.exe
4404	vlc.exe
544	vlc.exe
4164	vlc.exe
1612	vlc.exe
4792	vlc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	FUCK.exe
Token: SeDebugPrivilege	3432	FUCK.exe
Token: SeDebugPrivilege	388	FUCK.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4660	vlc.exe
4660	vlc.exe
4660	vlc.exe
4660	vlc.exe
4660	vlc.exe
4660	vlc.exe
4660	vlc.exe
4660	vlc.exe
4660	vlc.exe
4660	vlc.exe
4660	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
4952	vlc.exe
4952	vlc.exe
4952	vlc.exe
4952	vlc.exe
4952	vlc.exe
4952	vlc.exe
4952	vlc.exe
4952	vlc.exe
4952	vlc.exe
4952	vlc.exe
4952	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4660	vlc.exe
4660	vlc.exe
4660	vlc.exe
4660	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
4952	vlc.exe
4952	vlc.exe
4952	vlc.exe
4952	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
3520	vlc.exe
3520	vlc.exe
3520	vlc.exe
3520	vlc.exe
2004	vlc.exe
2004	vlc.exe
2004	vlc.exe
2004	vlc.exe
3252	vlc.exe
3252	vlc.exe
3252	vlc.exe
3252	vlc.exe
2808	vlc.exe
2808	vlc.exe
2808	vlc.exe
2808	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
5052	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
304	vlc.exe
304	vlc.exe
304	vlc.exe
304	vlc.exe
4800	vlc.exe
4800	vlc.exe
4800	vlc.exe
4800	vlc.exe
3220	vlc.exe
3220	vlc.exe
3220	vlc.exe
3220	vlc.exe
4048	vlc.exe
4048	vlc.exe
4048	vlc.exe
4048	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe
2828	vlc.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2580	vlc.exe
4040	vlc.exe
4564	vlc.exe
4564	vlc.exe
4564	vlc.exe
4660	vlc.exe
4660	vlc.exe
3420	vlc.exe
3420	vlc.exe
3420	vlc.exe
4952	vlc.exe
4952	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
1452	vlc.exe
3520	vlc.exe
3520	vlc.exe
2004	vlc.exe
2004	vlc.exe
2004	vlc.exe
2004	vlc.exe
3252	vlc.exe
2808	vlc.exe
2808	vlc.exe
2808	vlc.exe
5052	vlc.exe
5052	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
4208	vlc.exe
304	vlc.exe
4800	vlc.exe
4800	vlc.exe
4800	vlc.exe
4800	vlc.exe
3220	vlc.exe
4048	vlc.exe
4048	vlc.exe
4048	vlc.exe
4048	vlc.exe
2828	vlc.exe
1104	vlc.exe
1104	vlc.exe
1104	vlc.exe
1104	vlc.exe
548	vlc.exe
3696	vlc.exe
3696	vlc.exe
3696	vlc.exe
3696	vlc.exe
2868	vlc.exe
2236	vlc.exe
2236	vlc.exe
2236	vlc.exe
2236	vlc.exe
4688	vlc.exe
4552	vlc.exe
4552	vlc.exe
4552	vlc.exe
4552	vlc.exe
3864	vlc.exe
4404	vlc.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 3432	2112	FUCK.exe	87
PID 2112 wrote to memory of 2104	2112	FUCK.exe	89
PID 3432 wrote to memory of 1724	3432	FUCK.exe	91
PID 388 wrote to memory of 2984	388	FUCK.exe	93
PID 2112 wrote to memory of 2580	2112	FUCK.exe	94
PID 3432 wrote to memory of 4332	3432	FUCK.exe	97
PID 388 wrote to memory of 4040	388	FUCK.exe	98
PID 2112 wrote to memory of 4564	2112	FUCK.exe	99
PID 388 wrote to memory of 4660	388	FUCK.exe	100
PID 3432 wrote to memory of 1388	3432	FUCK.exe	101
PID 2112 wrote to memory of 3420	2112	FUCK.exe	102
PID 388 wrote to memory of 4952	388	FUCK.exe	103
PID 3432 wrote to memory of 3968	3432	FUCK.exe	104
PID 2112 wrote to memory of 1452	2112	FUCK.exe	105
PID 388 wrote to memory of 3520	388	FUCK.exe	106
PID 3432 wrote to memory of 1168	3432	FUCK.exe	116
PID 2112 wrote to memory of 2004	2112	FUCK.exe	108
PID 388 wrote to memory of 3252	388	FUCK.exe	109
PID 3432 wrote to memory of 2604	3432	FUCK.exe	110
PID 2112 wrote to memory of 2808	2112	FUCK.exe	111
PID 388 wrote to memory of 5052	388	FUCK.exe	112
PID 3432 wrote to memory of 1916	3432	FUCK.exe	113
PID 2112 wrote to memory of 4208	2112	FUCK.exe	114
PID 388 wrote to memory of 304	388	FUCK.exe	115
PID 3432 wrote to memory of 1168	3432	FUCK.exe	116
PID 2112 wrote to memory of 4800	2112	FUCK.exe	117
PID 388 wrote to memory of 3220	388	FUCK.exe	119
PID 3432 wrote to memory of 2068	3432	FUCK.exe	177
PID 2112 wrote to memory of 4048	2112	FUCK.exe	124
PID 388 wrote to memory of 2828	388	FUCK.exe	127
PID 3432 wrote to memory of 4380	3432	FUCK.exe	128
PID 2112 wrote to memory of 1104	2112	FUCK.exe	130
PID 388 wrote to memory of 548	388	FUCK.exe	131
PID 3432 wrote to memory of 2124	3432	FUCK.exe	132
PID 2112 wrote to memory of 3696	2112	FUCK.exe	134
PID 388 wrote to memory of 2868	388	FUCK.exe	135
PID 3432 wrote to memory of 4708	3432	FUCK.exe	136
PID 2112 wrote to memory of 2236	2112	FUCK.exe	139
PID 388 wrote to memory of 4688	388	FUCK.exe	141
PID 3432 wrote to memory of 812	3432	FUCK.exe	142
PID 2112 wrote to memory of 4552	2112	FUCK.exe	143
PID 388 wrote to memory of 3864	388	FUCK.exe	144
PID 3432 wrote to memory of 4352	3432	FUCK.exe	160
PID 2112 wrote to memory of 4404	2112	FUCK.exe	146
PID 388 wrote to memory of 544	388	FUCK.exe	147
PID 3432 wrote to memory of 432	3432	FUCK.exe	148
PID 2112 wrote to memory of 4164	2112	FUCK.exe	149
PID 388 wrote to memory of 1612	388	FUCK.exe	150
PID 3432 wrote to memory of 4424	3432	FUCK.exe	151
PID 2112 wrote to memory of 4792	2112	FUCK.exe	152
PID 388 wrote to memory of 840	388	FUCK.exe	153

C:\Users\Admin\AppData\Local\Temp\FUCK.exe
"C:\Users\Admin\AppData\Local\Temp\FUCK.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\FUCK.exe
  "C:\Users\Admin\AppData\Local\Temp\FUCK.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1724
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4332
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1388
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:3968
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1168
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2604
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1916
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1168
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2068
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4380
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2124
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4708
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:812
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4352
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:432
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4424
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1420
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4480
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4352
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4892
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2400
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4128
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:640
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2240
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:5108
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4072
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4980
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2904
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2804
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2340
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1744
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:3408
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4288
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2988
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4308
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2264
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4808
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2988
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4100
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:1708
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4436
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4992
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:4304
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:5108
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:2764
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
    3⤵
    PID:408
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2104
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2580
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4564
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3420
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1452
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2004
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2808
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4208
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4800
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4048
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1104
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3696
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2236
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4552
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4404
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4164
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4792
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4812
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3348
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3304
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4932
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4604
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4700
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4720
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3184
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1828
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:508
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1784
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4152
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1180
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1552
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3048
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:736
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3560
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3872
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2908
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4568
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1932
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2468
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3660
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4324
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2740
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3844
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1424
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2788
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4176
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:528

C:\Users\Admin\AppData\Local\Temp\FUCK.exe
C:\Users\Admin\AppData\Local\Temp\FUCK.exe
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2984
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4040
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4660
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4952
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3520
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3252
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5052
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:304
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3220
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2828
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:548
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2868
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4688
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3864
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:544
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1612
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:840
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:624
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2904
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4536
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1996
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1500
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3128
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1252
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2068
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2568
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3272
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4920
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4796
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2748
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:1800
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:8
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:2116
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3232
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4212
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4332
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3620
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:628
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4536
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4664
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3524
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4936
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4576
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3612
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:3112
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\farland.mp4"
  2⤵
  PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

farland.mp4

Path C:\Users\Admin\AppData\Local\Temp\farland.mp4
Size 2.3MB
SHA256 856ef6d91215ce1ecba31f3995063914eee341428b4ca8ad3350eae6f98027d8
MD5 18263a0da7ef770725a4cbe1f840b45b
SHA1 5654a55545334e4f806f43df62d776fdd7266dd6
SHA512 7557695b62a86744a62398dd2955bcf250f6a3cd6122d681038d21f143fc6c81c43f6ce7e8c417d3c2476a461fbba993eb48f16bbe1358b6da01b15c777d2844
SSDEEP 49152:83z11C2O6MtGKiK6bmviJ+2tQjG6P9WcafwL5KyR8mX0oNRX6o1K+ijqG:8R1+kKjf2tZ611afwKyR8KHNRXfQ3jqG
TLSH
T14BB5334467F29610C2E6EABC4AA2FF0915BDFCE2C344DB1F0EA30D765B3B2295C15A45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 84B
SHA256 d75179a34f8914791414a4e26b15c34bd94c2bea722d6bb1e60e4bfed9d9bd55
MD5 91c15cde2c7dcc11b5e26b862383d01e
SHA1 02b3c52ae6fb3eb2262625fe9e4a25a54b2cec13
SHA512 36252a3378e5041ade79b95ff24c5fc5b49fd7193af015309ec1718e10b59e8415aebf941cd7f98cea6cc2798a5b262e2bacb9e3a39f2a44fc0234a96b1c5296
TLSH
T185A01200E0469326C6C404631158110F0031E40458843260AB75B0440310C5F73C1234
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini.lock

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock
Size 17B
SHA256 624f0b51e31f91bd90463bf4202f7f802e138a721cf087f214973bcc23bcad6b
MD5 911c0593284345d1ec71b89c3e149d8e
SHA1 dac786691ac2cdf5b7074cc54e0a767902321985
SHA512 cd1d517f191b5d046e4e643109c3ef1d016428bc87a00a5df1eff6151f5230b388aaaa704e0b32bea24d9f19d43b044a83ec036ce7b67bcd5206524f247c368f
MD5 SHA1 SHA512

Submit Download

memory/1724-16-0x00007FFE143A0000-0x00007FFE143CB000-memory.dmp

Download

memory/1724-12-0x00007FFE04140000-0x00007FFE043F6000-memory.dmp

Download

memory/1724-8-0x00007FF6CF0C0000-0x00007FF6CF1B8000-memory.dmp

Download

memory/1724-24-0x00007FFE144C0000-0x00007FFE144D1000-memory.dmp

Download

memory/1724-9-0x00007FFE144E0000-0x00007FFE14514000-memory.dmp

Download

memory/1724-13-0x00007FFE1A550000-0x00007FFE1A561000-memory.dmp

Download

memory/1724-14-0x00007FFE194A0000-0x00007FFE194B9000-memory.dmp

Download

memory/1724-65-0x0000019182110000-0x00000191823EB000-memory.dmp

Download

memory/1724-64-0x00007FFE13360000-0x00007FFE13372000-memory.dmp

Download

memory/1724-63-0x00007FFE13550000-0x00007FFE1356B000-memory.dmp

Download

memory/1724-62-0x00007FFE034D0000-0x00007FFE0357B000-memory.dmp

Download

memory/1724-61-0x00007FFE0D6F0000-0x00007FFE0D715000-memory.dmp

Download

memory/1724-60-0x00007FFE0D720000-0x00007FFE0D76F000-memory.dmp

Download

memory/1724-59-0x00007FFE03580000-0x00007FFE03618000-memory.dmp

Download

memory/1724-48-0x00007FFE03620000-0x00007FFE0382B000-memory.dmp

Download

memory/1724-15-0x00007FFE143D0000-0x00007FFE143F2000-memory.dmp

Download

memory/1724-22-0x00007FFE03BC0000-0x00007FFE03F50000-memory.dmp

Download

memory/1724-38-0x00007FFE14130000-0x00007FFE1415F000-memory.dmp

Download

memory/1724-23-0x00007FFE146B0000-0x00007FFE146C4000-memory.dmp

Download

memory/1724-25-0x00007FFE13570000-0x00007FFE13642000-memory.dmp

Download

memory/1724-30-0x00007FFE03920000-0x00007FFE03BB6000-memory.dmp

Download

memory/1724-31-0x00007FFE07530000-0x00007FFE07618000-memory.dmp

Download

memory/1724-34-0x00007FFE03830000-0x00007FFE03913000-memory.dmp

Download

memory/1724-35-0x00007FFE14350000-0x00007FFE14391000-memory.dmp

Download

memory/1724-40-0x00007FFE13CD0000-0x00007FFE13CF6000-memory.dmp

Download

memory/1724-47-0x00007FFE13670000-0x00007FFE13681000-memory.dmp

Download

memory/1724-46-0x00007FFE138A0000-0x00007FFE138B1000-memory.dmp

Download

memory/1724-45-0x00007FFE13BF0000-0x00007FFE13C0A000-memory.dmp

Download

memory/1724-41-0x00007FFE138C0000-0x00007FFE138ED000-memory.dmp

Download

memory/1724-39-0x00007FFE14110000-0x00007FFE14128000-memory.dmp

Download

memory/2104-55-0x00007FFE0D6F0000-0x00007FFE0D715000-memory.dmp

Download

memory/2104-56-0x00007FFE034D0000-0x00007FFE0357B000-memory.dmp

Download

memory/2104-42-0x00007FFE14110000-0x00007FFE14128000-memory.dmp

Download

memory/2104-43-0x00007FFE13CD0000-0x00007FFE13CF6000-memory.dmp

Download

memory/2104-44-0x00007FFE138C0000-0x00007FFE138ED000-memory.dmp

Download

memory/2104-49-0x00007FFE13BF0000-0x00007FFE13C0A000-memory.dmp

Download

memory/2104-36-0x00007FFE14350000-0x00007FFE14391000-memory.dmp

Download

memory/2104-33-0x00007FFE03830000-0x00007FFE03913000-memory.dmp

Download

memory/2104-50-0x00007FFE138A0000-0x00007FFE138B1000-memory.dmp

Download

memory/2104-51-0x00007FFE13670000-0x00007FFE13681000-memory.dmp

Download

memory/2104-32-0x00007FFE07530000-0x00007FFE07618000-memory.dmp

Download

memory/2104-52-0x00007FFE03620000-0x00007FFE0382B000-memory.dmp

Download

memory/2104-53-0x00007FFE03580000-0x00007FFE03618000-memory.dmp

Download

memory/2104-28-0x00007FFE13570000-0x00007FFE13642000-memory.dmp

Download

memory/2104-27-0x00007FFE144C0000-0x00007FFE144D1000-memory.dmp

Download

memory/2104-26-0x00007FFE146B0000-0x00007FFE146C4000-memory.dmp

Download

memory/2104-54-0x00007FFE0D720000-0x00007FFE0D76F000-memory.dmp

Download

memory/2104-37-0x00007FFE14130000-0x00007FFE1415F000-memory.dmp

Download

memory/2104-7-0x00007FF6CF0C0000-0x00007FF6CF1B8000-memory.dmp

Download

memory/2104-20-0x00007FFE143A0000-0x00007FFE143CB000-memory.dmp

Download

memory/2104-18-0x00007FFE194A0000-0x00007FFE194B9000-memory.dmp

Download

memory/2104-17-0x00007FFE1A550000-0x00007FFE1A561000-memory.dmp

Download

memory/2104-57-0x00007FFE13550000-0x00007FFE1356B000-memory.dmp

Download

memory/2104-58-0x00007FFE13360000-0x00007FFE13372000-memory.dmp

Download

memory/2104-21-0x00007FFE03BC0000-0x00007FFE03F50000-memory.dmp

Download

memory/2104-11-0x00007FFE04140000-0x00007FFE043F6000-memory.dmp

Download

memory/2104-10-0x00007FFE144E0000-0x00007FFE14514000-memory.dmp

Download

memory/2104-29-0x00007FFE03920000-0x00007FFE03BB6000-memory.dmp

Download

memory/2104-19-0x00007FFE143D0000-0x00007FFE143F2000-memory.dmp

Download

memory/2112-0-0x00000263BF850000-0x00000263BFAAC000-memory.dmp

Download

memory/2580-69-0x00007FF6CF0C0000-0x00007FF6CF1B8000-memory.dmp

Download

memory/2580-70-0x00007FFE144E0000-0x00007FFE14514000-memory.dmp

Download

memory/2984-68-0x00007FFE04140000-0x00007FFE043F6000-memory.dmp

Download

memory/2984-67-0x00007FFE144E0000-0x00007FFE14514000-memory.dmp

Download

memory/2984-66-0x00007FF6CF0C0000-0x00007FF6CF1B8000-memory.dmp

Download