30c504fa6b5390b798c95717720a99dbeab87740ac85932812eb94a371428685

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_vlc-0.9.8a-win32.exe
Size 15.6MB
Sample260910-ebzzjsyves
SHA256 30c504fa6b5390b798c95717720a99dbeab87740ac85932812eb94a371428685
MD5 d18c0bc161a35d2b60640ae34c57c16a
SHA1 15e6bfe3dda037e6229be279db93fbb778b80ce2
SHA512 4fed16276b892d948365e8242af56e5d694b75002247c0d1f9b984319a29f9c9ec5e40a03287916045ed6746546c28852e4206dfd3291e1f793eb0479ee9a0d9
SSDEEP 393216:sm/5GuErmzqriQMAQoPMgdnKw2k4qPUmSMsO5PXJEXG5:B/HEo8itAvPMgbZMTMsOPEXa
TLSH
T105F63353F8484482F2DCA7704F4AC75941626634A7A8B9A3AB173EF47DB3591ED183CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4260	vlc.exe

Loads dropped DLL 64 IoCs

pid	Process
880	jaffacakes118_vlc-0.9.8a-win32.exe
880	jaffacakes118_vlc-0.9.8a-win32.exe
880	jaffacakes118_vlc-0.9.8a-win32.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe
4260	vlc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\VideoLAN\VLC\COPYING.txt	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libid3tag_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\dialogs\playlist	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\images\empty.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libpanoramix_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libstream_out_dummy_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libstream_out_duplicate_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\dvd\volume\volume05.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libmotionblur_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libpacketizer_h264_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libwaveout_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\dialogs\browse	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\js\mosaic.js	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libdolby_surround_decoder_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libi420_ymga_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52tofloat32_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libi422_yuy2_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libqt4_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\js\vlm.js	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\README.txt	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libmux_mpjpeg_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\librawvid_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\dvd\selection\mute.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\images\volume_up.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libtheora_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libwall_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libyuy2_i422_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libcanvas_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libi420_ymga_mmx_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libstream_out_description_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\liblogo_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libmpeg_audio_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libps_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_vlm.h	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\default\selected\bw.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\images\help.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\old\vlm\edit.html	jaffacakes118_vlc-0.9.8a-win32.exe
File opened for modification	C:\Program Files (x86)\VideoLAN\VLC\uninstall.log	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_rtmp_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libgrain_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_01.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\requests\vlm.xml	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\dialogs\browse	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libi420_rgb_sse2_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libglwin32_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libts_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_modules.h	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libpacketizer_mpeg4video_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libstream_out_bridge_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libtelnet_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\dialogs\vlm	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\images\slider_point.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\images\vlc16x16.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\intf\modules\host.lua	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libpacketizer_mpeg4audio_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libquicktime_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libskins2_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_rand.h	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\images\volume_up.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_realrtsp_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_vlc-0.9.8a-win32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.oma\shell\Play\command\ = "\"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.spx\shell\Play\command	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.m2v	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2v\shell\ = "Play"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mkv\shell\AddToPlaylistVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ts\shell\Play\ = "Play"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.m3u\ = "VLC.m3u"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp3\shell\PlayWithVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --no-playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.dts\shell\ = "Play"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wav	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.gxf\shell	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.dv\shell\PlayWithVLC	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.vob\shell\PlayWithVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --no-playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.mp3	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.bin\shell	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xspf\ = "VLC media file (.xspf)"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mkv\ = "VLC media file (.mkv)"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\vlc.exe\SupportedTypes\.mpeg1	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ac3\shell\Play\command	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp4\DefaultIcon	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg1\shell\Play\ = "Play"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ts\shell\Play	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\vlc.exe\shell\Play	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\vlc.exe\SupportedTypes\.mp4	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\vlc.exe\SupportedTypes\.mpeg	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m1v\shell\Play\command\ = "\"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2v\DefaultIcon	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mkv\shell\Play\command\ = "\"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mod\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mkv\shell\AddToPlaylistVLC\command	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp3	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.asf\ = "VLC.asf"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg4\shell\Play\command	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2v\shell\AddToPlaylistVLC	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg\shell\AddToPlaylistVLC	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp1\shell	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.avi\shell	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mov\shell\AddToPlaylistVLC	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp1\shell\ = "Play"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vob\ = "VLC.vob"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aac\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wma\shell\AddToPlaylistVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.a52\shell\Play	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xm\shell\Play\command\ = "\"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mts\shell\Play	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mov\shell\AddToPlaylistVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mxf\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\vlc.exe\SupportedTypes\.mov	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2ts\shell	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.mkv\ = "VLC.mkv"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mov\shell\PlayWithVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --no-playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ac3\shell\Play\ = "Play"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xm\shell\Play\ = "Play"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mxf\DefaultIcon	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.dts\shell\PlayWithVLC	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2v\shell\AddToPlaylistVLC\command	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp1\ = "VLC media file (.mp1)"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ac3\shell\PlayWithVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --no-playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xm\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.dv\shell\PlayWithVLC\ = "Play with VLC media player"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.flv\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ts\shell\AddToPlaylistVLC	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m3u\shell\PlayWithVLC\command	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mka\shell\Play\ = "Play"	jaffacakes118_vlc-0.9.8a-win32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4260	880	jaffacakes118_vlc-0.9.8a-win32.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_vlc-0.9.8a-win32.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_vlc-0.9.8a-win32.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:880
- C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
  "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libvlc.dll

Path C:\Program Files (x86)\VideoLAN\VLC\libvlc.dll
Size 102KB
SHA256 c405f8b19d7c5c2b3f6831148c9619eb501d1faf1a36a395c239e31bb55221d3
MD5 f51b965671a653f3d633a95baa3d29a2
SHA1 27577cad07de2004d9cb76319d1dd1fc95c5c768
SHA512 cd4e86e4a3813ac05c58b867ae0886136b3fd8388bae120a8599a8e395b46e3d1ed1168692741e37bfb2919e21d894e59cf342c49b7a2e7a39d753cf84f34188
SSDEEP 1536:+amToiHNIWEgVjWOWrlFZf548rOwqOjjnAhFiIOvxOqOicY/Tcju:+qK7EgpWLFZf54UODOjzaDrqO6
TLSH
T142A30B81BBCB85F1E9A34C72D093B77FAB21AB005014CB68DB14DE1ED877616613E29D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libvlccore.dll

Path C:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll
Size 2.0MB
SHA256 52a6b655fa0998443293bca354774e3e49162e62dd157a6fc254bbb1718e27db
MD5 744564e9c09c3eda4180b3e251278184
SHA1 c95426f77de251b72e189583a262cd0288a28031
SHA512 211cc3d4b0cb69a08c6a810c530ec018562c554dd7edf6c716313862a60e377079763b5aabae39c045d046b9a3afaddb896f3c7026ee75874d038a2956b3ae90
SSDEEP 49152:y6iPILIO+dscBbYmyp057rjseo9bkRGfqKCBAUZLYv9MxGaXYQKuPm:y6kI0DdscBbYmypu7/Jo9bkUCBAUZLX
TLSH
T19D95BE41F3C781F3E42344B09256E77B9B21DF224126C1A6FFA8BE4ADE33791525D226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liba52_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52_plugin.dll
Size 10KB
SHA256 c8a5143220259d3ef892249981c49cbdfbca095e4a05390263b5151d09d9b689
MD5 27d03787c1cad0810031da81b230df52
SHA1 cf1607d1e6c29bed2ed9dae9088312436618bd0b
SHA512 cde2b64b0f4db6d7d703330027cdd0c6f2e90a090e9c681a1c630036c4e1be7e38506ad97d981c74d349e2322c517ab4e1d42ae9a5cad44a07b6cb7f9917e8e0
SSDEEP 96:G0k/sauOkoyNffZaVia8MkdJ5wlhdR8kAyIZVjuVOGL/y4jZhpoEALauJH/:jvau1oyNfZ4e7wro/yIAOGL64HmEAT
TLSH
T14022B8C3B64A14F1C04B44705193A67FA77E812B069BC681D7BC8D5DEA73E516F1E20E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liba52sys_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52sys_plugin.dll
Size 8KB
SHA256 6f42cb6bba6d4a91f2721117641880c4f0d0ab2d2dcfc0a51b16173ae2efa053
MD5 62e7ca1d5e4fdecaf86f5b6790ab6e00
SHA1 265f6bce95c60acffba32fba728c1af169b637c3
SHA512 bd62e0495cfc351cf63343f3c6f4891e8c10c86d67fbf6cd7bbbfa5d96e6af299854ed0347dcd0bb1859aa93103bb4875babf7b24abfdbab5531c8272d8a181f
SSDEEP 96:mWMaogh5g+sh3xyWAisX6db9YqU4wbyU4YLnvDbHjmhCqSHEf8pEALxlJ:DFHYxn3ZSLsYLnvDbHjCCJhpEAL
TLSH
T1DBF1D886759608F3C94F0438A8DA1A3FE6B5F36357068012E7A8E94FD8374647B4E347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liba52tofloat32_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52tofloat32_plugin.dll
Size 41KB
SHA256 e99eb56259e3c24b7dc1118281144d93122cba2539ac7459d879511b16b9d604
MD5 19b87a2d432497278d29fb55c03340fc
SHA1 2b3e5b6efabf633375bf068e9d03d567b2ec2d35
SHA512 088c1bbfa27ca0f3ffb106dd642c2524b466ef43c89cb44746176f1e0db77a1ea888a9c8e4ed1d42dc006c39ab1906363b95a2458bd2691ee5d58f13bc8e7a59
SSDEEP 768:efLtYe5kbW1UdBQBckl3xaVvlYYQUA3iDXTgWBiviJe2sRPFW:YOzQB3aVveUCAe2x
TLSH
T105134A0DA5C191D1F42E05B8109657BA503D5B2D0EDDB433EF6A02BEEDF421E917A38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liba52tospdif_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52tospdif_plugin.dll
Size 6KB
SHA256 d95475fa9eff5dff0cc32219fb6eb691b7879a550c6deddf07c9849a32b30db3
MD5 63351b978b303ada7b33eb3b200eeed7
SHA1 1acf3d4434962d60232313a87c56ea7b0cbc9c17
SHA512 1d2d1a9e82f75587f3476039ed8b5145d76525ff4427146a8f1b2ca650aae1def9b096400d60d86fbcc2e5ddd1ea83def485e1f00526ecbfcf795d1da0e6b8c5
SSDEEP 48:62ECmEADBv5IyrZkZwIaNqNQXjhSBe9hS4YmRAL4JtNrco:iushRjcwhLYEAL4J3j
TLSH
T17BC161833A480DF3D89B037040D77A7FA2B19101854B95198394F1BFE67B9307E2EA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_directory_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_directory_plugin.dll
Size 13KB
SHA256 446177829681d382915078f0e01bcbe3a1e627333975f412378f8633844e7dcc
MD5 951ffb6173e507ba668ad41ea3c83332
SHA1 ef54868e74170d3bcd5cb5d719357a8c48e893b6
SHA512 abba48dba1b162081abdda2860b1a2dae3d5a777e2ca87c7a0d7f59ebc083d965b12689de15d6b50eca3322d26153b5b7bd960cc3335e32966c6147bc888f7bc
SSDEEP 192:1e5CHn+2Cg4tfuyotyPszzU6ItBDxNKVATssKEAHdFpQuLD:s4Hn+2CgWot06qBDzg8ssydFrL
TLSH
T1F45208C1794F29F6D85B00716181E23F96397692840FC509CB50EE8DD63B98EBB2E74B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_fake_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_fake_plugin.dll
Size 8KB
SHA256 d68793c605aa569a92de352eab85a0cbf1d241cfd06e78ba3321b5827b5de89f
MD5 2ec7e34027b6a1c6da1e356c15c266d2
SHA1 6cd51023762c5833d60ee2a728a9b85f67d8c98e
SHA512 a0b24ff2b4a4c841a2b67774690a39376342b18d1dc61232979c883470a6fa5ff5e020b15f0995127ff0ddbe4c74e5aa8d001b84830bf61af1a8c7db7c633972
SSDEEP 48:62bkR1UvOErilZkuv/uKI55ztq0ee+M6dHbgihuqBuFSfRA4c0DXKcdlujO/5hb4:t5DKI55e6G7uhc5ujO/5hbACT2EALGJ
TLSH
T140F1C7C3354C88F2C45B087064E3D93EBF38621696968166CB10E95ED43B6397E2F6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_file_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_file_plugin.dll
Size 8KB
SHA256 51069e60ab4bb5c2623450c42c7f6e7207f893f06aa0144388398862a1d8706d
MD5 48dfb4829cf898d25bc5d46c537192eb
SHA1 1d5fbc7cbe1ea5159b2924656ff77c49870e4489
SHA512 a1f2fbcf93a81322ece7700af535e7d63068b3f3d55ba3551642d02446f4755de6d0b8abb63993857b021ecad4a575eaaea9f5f109d045136d30e7c54a5cc651
SSDEEP 96:czBuFwdWZHz1R88Z3/Wc9L6uhWrGmfVEALhgiD0Fk:wIwdw6uvWcsq/mNEAlgRk
TLSH
T1CBF1C7823D8945F6CC5B08B4549F663F3B31B016844B9317DF90DD8AFA3B425395EACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_filter_bandwidth_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_filter_bandwidth_plugin.dll
Size 7KB
SHA256 fae3799e5b3449368084b2374ad8633f158cd94c4913f43637b4b046681725d8
MD5 255665b6a4404f0f44c4ffe55c2cb4c7
SHA1 f11bbb9da6a8190fa806d11f452df0544697c216
SHA512 dac8bd5223de6e2ff55974364c7bd2b29ed699cecaf974dea6b1f98c504ef72e9c09f94d5b5739f3d102a89ff339dd7ddbfdf533999ee6687d906d4b24a212f1
SSDEEP 96:DYiQBmcJshsCdXB3gnuz4N4wbyU4u1h/ElfNsEAL/J:6BRshfua4NLsu32GEA7
TLSH
T11DF1A587325849F3D86B88310495713FF3B0F1025A4F9221CB98E54BCA7B5373A2E28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_filter_dump_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_filter_dump_plugin.dll
Size 8KB
SHA256 c57f1eca543651e44418cf1ef52afdfaa0fa87f0713aca67692c1c3c2cabce91
MD5 9a8a44965d3344904ad4b114af303b41
SHA1 818cba9d24ee82d87ed2c8c9a479bb9186ec8e72
SHA512 af3706a756e1cc8836e2328c9e95f5001b59c6a1dda4276d44944190f9a122e2472d1655fd11bcf03d70d53e85e85cbba5352d9208cbf61346468399faf30853
SSDEEP 96:n9Xd2reSkJzqLA+RsoTQOSyQQuIzVhVpEALuYY5L:n2il9+CohrzXfEA/KL
TLSH
T174029487724905F3C48B1138A0A7E53FBB70B60790594112CB64EA7BE9374393A6DA9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_filter_record_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_filter_record_plugin.dll
Size 27KB
SHA256 45f7244829da11ca386abb2efc5b9f6a427f2372fa38d171ecf17e63b74ecfa5
MD5 4d48e460e30d02a781bfa937a548adc4
SHA1 f0d5225c4e3305d0078447b952c1e35f0649d7e2
SHA512 f005383ab2a4a232057d9f6973e16c09859e4f226d6519348f85ee749a171804123b6b1fa003fa844e3ee95c55afd6ac74467371430dded05660573c446c8b8c
SSDEEP 384:Ukhox55phm17goBAdYpRbLUzuXkvXBECUPTpetB7+UNuF9R4KuIpiKWYc:UkhoThK7xBV7fUYQepQDQF4IiT
TLSH
T18DC25C47FAC7C8F1C5574578106BE73F2936BA118028DA4CEF58A97AD873621F13A28D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_filter_timeshift_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_filter_timeshift_plugin.dll
Size 28KB
SHA256 9121b39b8fed77c63444ae2e6fe4a46bf7eac0967333bd0c86daa18456b627c9
MD5 3f2a2d71e0230994910fe6a3b3a140c5
SHA1 9092129541565633c56e83ac1346aadeedd09a43
SHA512 1b98ea5277490c9d6cda5d7171869f9b3b8003cb2fbd5a2d2a4e73589cd31e0a89ba6af2e38177a5c24d297d09fda8eeb97ebfdadb07acbb72c7fe1ee2bf8b36
SSDEEP 384:dxsLU6pZqp5sx7goBWdYpBFbLEIn6XkHXBEC3MTpetr3tNuF9R442E/6p6TiAB3:dxsLFO5E7xBbL9E4YoMpQTtQF4WyIT
TLSH
T1D6D24B46FBC7D8F2C59A4570205BF77B2E32E9138024CA5CDB64A925D477622E63F18C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_ftp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_ftp_plugin.dll
Size 33KB
SHA256 46f236ad8cccb33f6c47b659b8e1ef82f04cf2a874bf468b046cad650eaa6287
MD5 89e5cd733b2da23403342f2fcca4561d
SHA1 0eca631d3abde9e6dd143f2798b37e7fc38f9022
SHA512 7367aad919ea7ae530001002703ed27c307f0bd18264c9812794ea2500753848672e24157875a92f298dace9088978a22295f901daa0574514a729cb1eedecc6
SSDEEP 768:5S2vsQQAVVTfKhN7xBSDd4gkCvpQ3RNQF4ojkK:I+sQQkF7ioOojkK
TLSH
T14DF21B42FBCBD8F2C56659306067B73B6A31A9218424C79CEFA46D67D833612A13F1CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_http_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_http_plugin.dll
Size 83KB
SHA256 8a488e166d9b9dfe0f34195ff2387ae1674ca82b3b44c29adad1bb90efc6f593
MD5 fcd1d500050524447189378a232d0cba
SHA1 996a61d4c42c2eb26fe14b4ae23c46b9d908610d
SHA512 053a9b1e4d3ceb5daf4e7120547da44eb10bd41311e837120564a714e9d5a86742c8d60c6cbbee60936b2e5ee0acc693fc0b9839e9a9c02d324cd43647216118
SSDEEP 1536:fmr3nYDjzRSlXTvtFRsKVo6zgdi0O3+AHzSOIOXXnToIf:fq3nYD0lkfw+4dXXTBf
TLSH
T1FA836B65F6C7C5F2D42305B4A08AE77F5B21F6218008C14AFF989D6BD977612B12E2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_mms_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_mms_plugin.dll
Size 68KB
SHA256 a3c2e8c2c642b939aa34f011e83ef00dde2f630437a81926eb36dbde43e32a1b
MD5 90968db01c263fefd95db82560fe333a
SHA1 cb0edcf8036023bf24439592db5d2890b7107aba
SHA512 7d7d4cfe9a0683bb2a768ea56bd2de1f8093962b41bca1d88db37a067157230d95b13eee9c395859d0f56aaaea783ff447bbd1b0ab44863f57eb5b82be49e803
SSDEEP 1536:6IHxNJPg2OVV57wXK3inyQMAciiDOWgH:6IRPjOVV57Nwyboo
TLSH
T1CC633B51BACB84F2C90B4930905BF3BF9B61E6064134C7A9EFA49D2BD873742563A1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_output_dummy_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_output_dummy_plugin.dll
Size 5KB
SHA256 e7e40e3c7aad446f253d230bb7b565108c99f6f476ef0f0c6407b0590c3b72c2
MD5 b9df8b2fc1b2d9f85a6d02b9bf182216
SHA1 6606bdeae3b1f7122258e82e80ed1e0e34c409c9
SHA512 bff5aa2df45c79d67c1e21ac3ccbe6dce316ecd178425dbba74fea196d4c2285f002177e1905e42552f3b3020414c93329f2f48cdb87d48366836c3ec26ba579
SSDEEP 48:62BWi64vc9HMhrRbZbEIaLsl1TrsagDY8ZhXUmcfimRALgSJa/:XTtO01oDhkbqEALgSJ
TLSH
T15EB14193721D1CF2D48B413094D66F3EA3B1A117019A41618B70E98FE97B438797EA8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_output_file_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_output_file_plugin.dll
Size 7KB
SHA256 d485265de00437020ff1674d35bcfba4f82fb2b16da3dd9bd4a213fcfee44723
MD5 455d20a11b74d200f0ddc75b9c1e5848
SHA1 b5402b0f74268015a5d33207cfc6a03c83946869
SHA512 ed227ebd3319d52613ba6b134f39b3cc0d6e7f3fc4ff927708b6c5c26643e85018f983ec0cf7f0cff76ad9715b6c179bf448d4fd4b4ea876d1c5edaeae9bdc69
SSDEEP 96:FUyvxgRzLfHBT7yr51zhbpPbkEAL7pnWTc:vyBhyr5L1PgEAgT
TLSH
T1B6E1B583315D09F2D40B863D5CC7B57E7FF5E00255AA4D25CB54F84EE92703A296F289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_output_http_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_output_http_plugin.dll
Size 9KB
SHA256 d9dcf0b5a8948e17ba1927445185e4f8b038b068f63f90d8a05286df974e8b1b
MD5 9dc9452182cf700e7d7f1d965e6c55bc
SHA1 6ff37cb559eb14ebd3f13b643a39dc0b673c1af8
SHA512 7030b3418541427f66a03674f6b76a8ff419b6c0187be3ba1240e39fc4136d89dba2bfffc70fa1b712bab551e889e30a287b80fb30617bf93c431730a012ba5c
SSDEEP 96:A5//UfsgW2SmcabwK80crF4yGZ8XzIhfAYZXLgwvCEALNAjL2oye5:MUtQg8XrF4yGZ8XzEfAYZXLNCEAyLR
TLSH
T16E12B5CB794D14F1C4474430A1C3E67BEB36B02F81968202CB98898DFAF7656672A6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_output_shout_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_output_shout_plugin.dll
Size 364KB
SHA256 703d2a951c503f000791f31cc07882110533bcec093527c310a4031ed4639640
MD5 f6322ae7fbb9c1c90953b9d60902b153
SHA1 a5cb44e1ab54d19de7dca030a4deb45f4fc8bfda
SHA512 6d66cda78a34e2d539bf7989c27ca65fc283178029cab8b5fe76b7d4afc5efc49bfd540284571f0fd0678e839475bc475b26834a0a603409d2a5857c211df094
SSDEEP 6144:HFEyuluI0ZyMWy6mX3WBJCL2jZX1IH9wdLivoNqjI8oQpR0TS:HFEBs396FK2X0eyoNqjIy3SS
TLSH
T1BF849F42DA9284BEC0E201F1121AF7B6E930D73D4020DC67EBD4A9FDA971F929D5931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_output_udp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_output_udp_plugin.dll
Size 12KB
SHA256 4a1d9eb950dde84c2e30ef65e7159dcfbde9099e699b1f5d1a4233f1e537d042
MD5 433444a01a75671a992ee25f463420a4
SHA1 f1b559b74342080d3ac03921ab61ae77bbcb2fd0
SHA512 5e268f14c604e0103a0c4cf44d220f3d8a52a8a499c418dbc9e6e3bda396be493f18596486e18094a6e91ca4fd034a7775446de634a89716c0630f3908c7759d
SSDEEP 192:DviUhr10G2mn2dFPfA2OmgksbN1EAvtnMz:DHh21mn242OmWNRA
TLSH
T1C142D5C1778A28F2D54F067190A2E73F9A39A10540529158DB545CCED73FB0FEF2AD4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_realrtsp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_realrtsp_plugin.dll
Size 40KB
SHA256 9125c7fb39d92328b579d21363571a282db48a98a31f0676860932bd7d1a62f8
MD5 86ca66be3faac71e59269d14e3499cab
SHA1 c32ec568f6d1fa880c77f810a4226b69e84b8027
SHA512 7b77162980fa477bb1a784742cad08660da0e0d9c6f70f60fc2db48da59606391d5ef116591e3430c925e7a4888442b2cd1b54ab471c3dd48468431d10a49e45
SSDEEP 768:HRaq/cshtyPBB0KiZjiWeC3IZ1S+Hbb2CyweihTWi3GLFSkmrQoYBCY2:HRaq/cAtyPHWAC3InHbbTeALWLTQICY
TLSH
T1BA133BC167CB00F5D8070474B149B27EC7A1A70E4529E99EEBA8EF4CDA37525783E24E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_rtmp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_rtmp_plugin.dll
Size 41KB
SHA256 580903e04a434fd5142d400be5a3a21fdadc25a5cb6bb0354d684b1e87007648
MD5 8d80fb45e25a3f54f43e2fd8f63a86ae
SHA1 a216db02209d95b58ea4adef25393f7c7e885bdd
SHA512 0bb8bd0c137b37a132e96458353a3a492cffbc8a78831d011150daa612935e070cae8281b036ccc985f22a77b687184f3dbc110b310f6de69cc71bd2b2472165
SSDEEP 768:QwECPUl0OPvS6Gj4lb48Znq0OJnTiv8ZMSJ:/bPmnS2lb4N+gJ
TLSH
T199132A40BF8B40F6E81708B084D5E23FEF3092459624A1DDDFDA4E58D67BE627A1F14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_smb_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_smb_plugin.dll
Size 27KB
SHA256 16c8f5d29fb6327618b06c4fd6545317fc42acb7ac394543047a2de962070b23
MD5 67f2822e54bfeeb299b04c3d5a831ce4
SHA1 fab5a31f7fce82cf0952947e56748d42750c51b7
SHA512 42474703f4afa12c10bc18dc7fea7ee4685b420a28a0f3c49fb89e61c6d712fd3f2909c36700eea413bf256dc1b77945df293e7ab97a44531904d532143dcf01
SSDEEP 384:BI+1pEVuRktPZsB7goBWdYpAjLZgTXkWXBECgLTpet7XNuF9R4IlefOVnkT89M:OzVuRkVZ07xBb+3ZqdGpQzQF4YkP
TLSH
T13BC20956FECB96F1C65689701067F37F2A31E9119024CB9CDF54A935D827612A23F28C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_tcp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_tcp_plugin.dll
Size 6KB
SHA256 409c6d4e3276ccb960f28d337ac4906ee5e134c38cf88944bf500ca928147ce1
MD5 fc3f77540044b7c1f62bddebd80625e3
SHA1 e7a43394cb06b7c56ed15d6bccb2e3ed494a5a2c
SHA512 aee7f1516363f4ea0865caf1950029012cc8ceb3c5b6b6eb2728a6a7d499eef5dadce72239868ebf6e3107bb104987713b42fe57ac5c1eeee5c3fd721baaa9a3
SSDEEP 96:OHvR0lrO/r/63VP0yxZLRhC/hT/EALcR2/f:gEGL63h0UADEAK
TLSH
T113D1B49336444CF6D84B053986D3E63EBB3092194AC68052D744A6AFC9331B7697F7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_udp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_udp_plugin.dll
Size 7KB
SHA256 f7891024dd392070ad4a4fdcb7c4d60c3c6fe9e146590ee3c686371bccdeae89
MD5 b3a87f4cce54aa5395d2742e4feee1f0
SHA1 7dd073e832e55bb2a4008ee8136b4cb31cab0eb6
SHA512 e832d46689af339b876a30845c9988e89f77b019789dd0fe0076ecfabd9775925b2c8f20699814bf511956dbd44b205b32ccabb856af91fa0c45d143c5b926fd
SSDEEP 96:zv15RpUxgIgqqXntBAZo8xG4/NhfArEAL/X82i:TDRog/q8BWxRHfGEAo
TLSH
T104F1848776080AF3D48F047868C3A63EBF35911994C64595CBBAE6DED83B026393F5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libadjust_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libadjust_plugin.dll
Size 21KB
SHA256 b2530ed269ce83dec5ebb7053fbff50991b74067051ad28e523c1a6765ddf60c
MD5 1c7995d35c0f102de563146617c6381a
SHA1 15add72e6150739ad2cfde8ce4105a982cd8e578
SHA512 36b4d410b4ef6f1c67e1312a70f069cfff87db63d3145725493466226c0e3373759ad25333f33efca582aed709f2a5bdcdf6e22cb9309ef1be92c7ee566517c6
SSDEEP 384:tUz35NJKgQy/CSJHQpePcCZq79y6wHveBdYJ3:tUZO9eFZW9GHvWI3
TLSH
T1ADA2C586F0DB05E5C05F0DF42254F6BBC9754E2B6009B3A4CB5AE2A5F932B02D877B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libadpcm_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libadpcm_plugin.dll
Size 16KB
SHA256 c33ab6bd81e6488c43c8b7ea5ca5ce517729e5ca0e815b96380880f221eb08a2
MD5 1d85612663ee82d3869ca8459d0f5c06
SHA1 ec4caf0bb34e31c115083eb2dce9053c9f679836
SHA512 98ad7bc3ad67472d8c0f638e6ab37f4f3c89d576956b731917eb8a7a8cd2a5debac706291191868796b0de79591079ff02a4a7791202bb7a6a2f68d4e91b85e3
SSDEEP 192:G89FBazpnpOpHn7F1HGMhp70WD+YVDuLuOZ/TxmtNq3v1WeaA2JnCuJbg4vDCVvN:zBMhIZ7XV6SMuOZrxma9psJ/lxbfFO
TLSH
T11772E8E1E5D7C3F2C88246F101A9D9722EBAC54FD436C995D3B3BA1890B6313618D70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaiff_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaiff_plugin.dll
Size 9KB
SHA256 197bfa73358355bd7f3925fa942a9037b4e51d402c4ab5e8f6831610653d349b
MD5 a3baec9b67f6df54fc6b054d1adeafe7
SHA1 08738611f244780553ddd12665f017c57e6737a6
SHA512 37f414ca07d547b023e21e64abb16a196a6124b370c410b65fc15682e2abb33ac70889d213a4094ac25ebb2a74e4f581ca2a8c9aa793a26d2fbe324f387a3cf7
SSDEEP 96:nM/7p6HDlKn+nrjhN7EBm5E/UujGqkUJWLjzE4wbyU4IhUseGrjVEALSJrl:2p65KnwroBm5E/UuJJWLjQLsEUsPEAu
TLSH
T1F912A2C1328958F2C853087094A6B63FD77EA9278219C612DF6DD68FE83B911322E347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe

Path C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
Size 112KB
SHA256 3906f0ea07922b0b6edb34909595a55f18cad8eee8344462ee8eba00a4ee58d4
MD5 0c803988240f482d287e960e6a98e620
SHA1 2a51519b2e57b17907bd6e0840c755f32eedc1fb
SHA512 bb68e99d1b802f390088e7079bce8ee864bbc08eca706367f0503fa1d959449a07aa6d250dd5e66d2aff734f54174e4fb06cc40a25da021d84717516f37334d8
SSDEEP 1536:vfxJisgEX6YaSd4Psq0PXpmWu79B1ArPUco9FLdS1EAd4kkVIIOQSONinB:vfniQraBIpPQMPozgEAQIIOwinB
TLSH
T185B3C69579844D43D66C053CC8B7C271133ABDF14A660F076468BEBA3A72A472DAB70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjF9D.tmp\InstallOptions.dll
Size 17KB
SHA256 f9a6f49778db1887e4cc96729fa3758693d281bed70174adf55fb322e3fedc00
MD5 d43d84790c559b71f8e64fd0ef7e0692
SHA1 296e09f4887fdda25cc854119df736f739b330c8
SHA512 bceda184719fc91ab047698df0c2999c58d062b25e390cce92d408a53dd29c123467cde901d5152773a646095717aeb0c181ee0f857f8ff803271ac9b5e75dfc
SSDEEP 192:Zi0AiuaA7BBBVll9g2tbpfELj4+bjEk3RAq9naEyOz3xxhxaHxJ6fxSUsvkk:MaAXtftlff2EuRR3BEn6JSVv
TLSH
T19A72F6CEA7616C73D96703343016662276B09872B07995C26BC67F8CB8E0676F24C39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjF9D.tmp\LangDLL.dll
Size 6KB
SHA256 d3cc40ce2eb465be5f9c58f5196c567533ebe6452399193c781210755c5a414f
MD5 8699f12218b88c83e8f74228ce56535e
SHA1 6de86ab9f74451d0fc1654c83ebce4dd3abfacd7
SHA512 7d27178100d32c75b02ac3989ed78da12416fbebc9032ac757d316f9a9b6a259c3f9cbd3ccb994b5fabdb204de3ea7cbd6eb5fd68e26614b549e6846c2bb94db
SSDEEP 48:68WelgEt0CsSS94TVZivz1Pjs2wF5bD4AfKgPJ5fMSVddRlQQG0w+UwB6UoXsofW:ZWeQSa4TVZ6dFU5H4MK+V/HQQGhM
TLSH
T1CED141B7BB5309B2E15515B522B16F07BEB1E1251A2DC50BBB5062FE9808113AD0D7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjF9D.tmp\ioSpecial.ini
Size 713B
SHA256 7cd777f8978db9f31681819d9f674f396463ee6e2a0aa762cea1863c0e598c9e
MD5 28c02f33280af488239ca8dab968ba6c
SHA1 c09c433242fc62962fd4e1a746a9f38c4cc7ba03
SHA512 4caf46b9d54bc601d181c64157de78bbff66936b99da819ab823df72bb7d95ffd90013c998647db4b36e3d708fc9419ea849be13d0fd672817119a15721edeb9
TLSH
T18601C088856FA358082054E660F93BA1A7E12C3C47113DF2F46388C6634DDC38BE9DE2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjF9D.tmp\ioSpecial.ini
Size 922B
SHA256 f493c1a076d999d853ff2cd4ec9d77731674499c2d15e3ceb9fe4f4a3355ef99
MD5 c34a09e642b9850e156c61437002968d
SHA1 bde3e9eea5fffeaf54e1eac3938d177ce18fdd68
SHA512 782c41918849afca4a5319639752f46eee3f7591cf127025ab91b1db789eac0428f3e27e2818131361522500fd28f04061adbd0e3519f8f3dd801a5a6145caeb
TLSH
T1EF119C88911942194C2096A665FB7E9167E02C70870537B0F9B34CC7A74ECD599EC9D2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsjF9D.tmp\ioSpecial.ini
Size 970B
SHA256 0bcb09aeba838832204beef0ea7c2ba6c88680568bda51fe714dd4f49e57718c
MD5 334d2cbdbea47e293f0ecb560faa1ce9
SHA1 9118a685d07ae5f5c31c9e39a8d70a8cf39d5575
SHA512 b1f3a9dbbca46fbef8305f6689a243dbc1450fa14f9f4c8540cc1032b7290ab2195ef2e56bcb2da7de5759efba59c99f23f46d85b2b7dd5cf2e35f3f9edab077
TLSH
T1B51197889109421A4C2086A6A1FF3EA16BE02C34871A3AF0F5B35CC7E74ECD599EC9C5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/880-82-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/880-83-0x000000006AF00000-0x000000006AF0D000-memory.dmp

Download

memory/880-86-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/880-87-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/880-746-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/880-0-0x0000000000426000-0x0000000000427000-memory.dmp

Download

memory/880-947-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/4260-980-0x0000000004360000-0x0000000004370000-memory.dmp

Download

memory/4260-1008-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-911-0x0000000000C00000-0x0000000000C0F000-memory.dmp

Download

memory/4260-965-0x0000000002810000-0x0000000002F70000-memory.dmp

Download

memory/4260-966-0x0000000002F70000-0x0000000002F80000-memory.dmp

Download

memory/4260-967-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-969-0x0000000002F80000-0x0000000003240000-memory.dmp

Download

memory/4260-970-0x0000000003260000-0x0000000003273000-memory.dmp

Download

memory/4260-972-0x00000000032C0000-0x0000000003578000-memory.dmp

Download

memory/4260-971-0x00000000032A0000-0x00000000032BB000-memory.dmp

Download

memory/4260-973-0x00000000035B0000-0x00000000036F4000-memory.dmp

Download

memory/4260-975-0x0000000003700000-0x00000000037C2000-memory.dmp

Download

memory/4260-976-0x0000000003A00000-0x0000000003A13000-memory.dmp

Download

memory/4260-977-0x0000000003A40000-0x0000000003A6B000-memory.dmp

Download

memory/4260-978-0x0000000003A70000-0x0000000004335000-memory.dmp

Download

memory/4260-981-0x0000000004370000-0x000000000437D000-memory.dmp

Download

memory/4260-901-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-983-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-982-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-984-0x0000000004390000-0x00000000043A7000-memory.dmp

Download

memory/4260-990-0x0000000004650000-0x000000000466C000-memory.dmp

Download

memory/4260-989-0x0000000004630000-0x0000000004648000-memory.dmp

Download

memory/4260-993-0x00000000046F0000-0x00000000046FF000-memory.dmp

Download

memory/4260-994-0x0000000004720000-0x0000000004773000-memory.dmp

Download

memory/4260-998-0x0000000004890000-0x00000000048B7000-memory.dmp

Download

memory/4260-1002-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-1004-0x0000000004A30000-0x0000000004B55000-memory.dmp

Download

memory/4260-1003-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-1001-0x00000000048F0000-0x0000000004A12000-memory.dmp

Download

memory/4260-1000-0x00000000048D0000-0x00000000048E2000-memory.dmp

Download

memory/4260-996-0x0000000004790000-0x000000000488F000-memory.dmp

Download

memory/4260-992-0x0000000004680000-0x00000000046E5000-memory.dmp

Download

memory/4260-988-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-987-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-985-0x00000000043D0000-0x0000000004627000-memory.dmp

Download

memory/4260-1006-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-1007-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-953-0x0000000000C10000-0x0000000000C20000-memory.dmp

Download

memory/4260-1010-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-1009-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-1011-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-1012-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4260-1014-0x000000006A300000-0x000000006A31E000-memory.dmp

Download

memory/4260-1015-0x000000006A540000-0x000000006A73A000-memory.dmp

Download

memory/4260-1045-0x0000000064DC0000-0x0000000064DC8000-memory.dmp

Download

memory/4260-1044-0x000000006B240000-0x000000006B24A000-memory.dmp

Download

memory/4260-1043-0x00000000699C0000-0x00000000699C8000-memory.dmp

Download

memory/4260-1042-0x0000000067500000-0x0000000067509000-memory.dmp

Download

memory/4260-1041-0x00000000712C0000-0x00000000712CA000-memory.dmp

Download

memory/4260-1040-0x0000000065E00000-0x0000000065E0C000-memory.dmp

Download

memory/4260-1039-0x000000006E780000-0x000000006E788000-memory.dmp

Download

memory/4260-1038-0x00000000634C0000-0x00000000634C8000-memory.dmp

Download

memory/4260-1037-0x0000000061CC0000-0x0000000061CCD000-memory.dmp

Download

memory/4260-1036-0x0000000000C10000-0x0000000000C20000-memory.dmp

Download

memory/4260-1035-0x000000006BC80000-0x000000006BC8F000-memory.dmp

Download

memory/4260-1034-0x0000000069800000-0x0000000069809000-memory.dmp

Download

memory/4260-1033-0x0000000064BC0000-0x0000000064C20000-memory.dmp

Download

memory/4260-1032-0x0000000065780000-0x0000000065789000-memory.dmp

Download

memory/4260-1031-0x000000006EB80000-0x000000006EB88000-memory.dmp

Download

memory/4260-1030-0x000000006C000000-0x000000006C008000-memory.dmp

Download

memory/4260-1029-0x000000006BE80000-0x000000006BE97000-memory.dmp

Download

memory/4260-1028-0x00000000661C0000-0x00000000661DB000-memory.dmp

Download

memory/4260-1027-0x0000000070080000-0x000000007008E000-memory.dmp

Download

memory/4260-1026-0x0000000069740000-0x000000006974D000-memory.dmp

Download

memory/4260-1025-0x0000000067AC0000-0x0000000067ACD000-memory.dmp

Download

memory/4260-1024-0x0000000062E40000-0x0000000062E48000-memory.dmp

Download

memory/4260-1023-0x000000006E880000-0x000000006E888000-memory.dmp

Download

memory/4260-1022-0x0000000067C40000-0x0000000067C48000-memory.dmp

Download

memory/4260-1021-0x000000006AB40000-0x000000006AB48000-memory.dmp

Download

memory/4260-1020-0x0000000069A00000-0x0000000069A09000-memory.dmp

Download

memory/4260-1019-0x0000000065480000-0x0000000065489000-memory.dmp

Download

memory/4260-1018-0x0000000069940000-0x0000000069948000-memory.dmp

Download

memory/4260-1017-0x0000000000C00000-0x0000000000C0F000-memory.dmp

Download

memory/4260-1103-0x0000000000400000-0x0000000000425000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads