30c504fa6b5390b798c95717720a99dbeab87740ac85932812eb94a371428685

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_vlc-0.9.8a-win32.exe
Size 15.6MB
Sample260910-ebzzjsyves
SHA256 30c504fa6b5390b798c95717720a99dbeab87740ac85932812eb94a371428685
MD5 d18c0bc161a35d2b60640ae34c57c16a
SHA1 15e6bfe3dda037e6229be279db93fbb778b80ce2
SHA512 4fed16276b892d948365e8242af56e5d694b75002247c0d1f9b984319a29f9c9ec5e40a03287916045ed6746546c28852e4206dfd3291e1f793eb0479ee9a0d9
SSDEEP 393216:sm/5GuErmzqriQMAQoPMgdnKw2k4qPUmSMsO5PXJEXG5:B/HEo8itAvPMgbZMTMsOPEXa
TLSH
T105F63353F8484482F2DCA7704F4AC75941626634A7A8B9A3AB173EF47DB3591ED183CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4824	vlc.exe

Loads dropped DLL 64 IoCs

pid	Process
3936	jaffacakes118_vlc-0.9.8a-win32.exe
3936	jaffacakes118_vlc-0.9.8a-win32.exe
3936	jaffacakes118_vlc-0.9.8a-win32.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe
4824	vlc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libextract_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_bits.h	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\images\sout.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\images\shuffle.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52sys_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_file_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_codec.h	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\minimal\fs_panel_simple.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\images\speaker_mute.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\liblpcm_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libh264_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libmjpeg_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\default\selected\volume.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libi422_i420_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libmux_mpjpeg_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\images\vlc16x16.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\dialogs\browse	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\requests\vlm.xml	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libmemcpy3dn_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libogg_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libpacketizer_h264_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\images\volume_down.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libasf_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libsap_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libstats_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_06.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\dvd\volume\volume00.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\vlm.html	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libcdda_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\playlist\README.txt	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libmotionblur_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_meta.h	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\default\selection\play_pause.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\default\volume\volume_05.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\dvd\volume\volume05.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\vlm_export.html	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\requests\browse.xml	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libi420_ymga_mmx_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\osdmenu\default\selected\fw.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\js\vlm.js	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\vlm_export.html	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libxtag_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\favicon.ico	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\intf\modules\host.lua	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\liberase_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\requests\status.xml	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\images\delete_small.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_filter_timeshift_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libpacketizer_copy_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libvout_directx_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_modules.h	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\sdk\include\vlc\plugins\vlc_threads.h	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\http\images\repeat.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\http\images\volume_down.png	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\lua\playlist\france2.lua	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libdemuxdump_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libdvdread_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libosd_parser_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\plugins\libvoc_plugin.dll	jaffacakes118_vlc-0.9.8a-win32.exe
File created	C:\Program Files (x86)\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo	jaffacakes118_vlc-0.9.8a-win32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_vlc-0.9.8a-win32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.vlc\ = "VLC media file (.vlc)"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mka\shell\PlayWithVLC	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.asf\shell\PlayWithVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --no-playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.flac\shell\Play\command	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp3\DefaultIcon\ = "\"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe\",0"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.flac\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2v\shell\AddToPlaylistVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.flv\shell\Play	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m3u\DefaultIcon	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pls\ = "VLC.pls"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.oma\shell\PlayWithVLC\ = "Play with VLC media player"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wav\shell\PlayWithVLC\ = "Play with VLC media player"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mxf\shell\PlayWithVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --no-playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ts\shell\PlayWithVLC\ = "Play with VLC media player"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aac\DefaultIcon\ = "\"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe\",0"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mka\shell\Play	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wav\ = "VLC media file (.wav)"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mts\shell	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m4p\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.avi\shell\ = "Play"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.divx\shell\Play\command\ = "\"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp3\shell\AddToPlaylistVLC	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.spx\shell\AddToPlaylistVLC	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpg\shell\PlayWithVLC\ = "Play with VLC media player"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m4p\shell\Play\command	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mov\DefaultIcon	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.asx\ = "VLC.asx"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mov\shell\AddToPlaylistVLC\command	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg1\shell\PlayWithVLC\ = "Play with VLC media player"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\vlc.exe\SupportedTypes\.vlc	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xm	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xspf\shell\Play	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mod\shell\AddToPlaylistVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.AAC\ = "VLC.aac"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m1v\DefaultIcon\ = "\"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe\",0"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m4v\ = "VLC media file (.m4v)"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mkv\DefaultIcon\ = "\"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe\",0"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ac3\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp1\shell\AddToPlaylistVLC\command	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.asf\shell\AddToPlaylistVLC\command	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.a52\ = "VLC media file (.a52)"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mod\shell\Play	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp1\ = "VLC.mp1"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\vlc.exe\SupportedTypes\.ts	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wav\ = "VLC.wav"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg2\shell\Play	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.bin\shell\Play\command	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m4a\shell\AddToPlaylistVLC	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.asf\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mts\shell\AddToPlaylistVLC\ = "Add to VLC media player's Playlist"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wmv\shell\PlayWithVLC	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp1	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wav\DefaultIcon\ = "\"C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe\",0"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wma\shell\ = "Play"	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ts\shell\AddToPlaylistVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mka\shell\Play\command	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.flv\ = "VLC.flv"	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.gxf\shell\Play\command	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xspf\shell\Play\command	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp2\shell\PlayWithVLC\command	jaffacakes118_vlc-0.9.8a-win32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.avi\shell\PlayWithVLC\command	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.flv\shell\AddToPlaylistVLC\command\ = "C:\\Program Files (x86)\\VideoLAN\\VLC\\vlc.exe --started-from-file --playlist-enqueue \"%1\""	jaffacakes118_vlc-0.9.8a-win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\vlc.exe\SupportedTypes\.cue	jaffacakes118_vlc-0.9.8a-win32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 4824	3936	jaffacakes118_vlc-0.9.8a-win32.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_vlc-0.9.8a-win32.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_vlc-0.9.8a-win32.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
  "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libvlc.dll

Path C:\Program Files (x86)\VideoLAN\VLC\libvlc.dll
Size 102KB
SHA256 c405f8b19d7c5c2b3f6831148c9619eb501d1faf1a36a395c239e31bb55221d3
MD5 f51b965671a653f3d633a95baa3d29a2
SHA1 27577cad07de2004d9cb76319d1dd1fc95c5c768
SHA512 cd4e86e4a3813ac05c58b867ae0886136b3fd8388bae120a8599a8e395b46e3d1ed1168692741e37bfb2919e21d894e59cf342c49b7a2e7a39d753cf84f34188
SSDEEP 1536:+amToiHNIWEgVjWOWrlFZf548rOwqOjjnAhFiIOvxOqOicY/Tcju:+qK7EgpWLFZf54UODOjzaDrqO6
TLSH
T142A30B81BBCB85F1E9A34C72D093B77FAB21AB005014CB68DB14DE1ED877616613E29D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libvlccore.dll

Path C:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll
Size 2.0MB
SHA256 52a6b655fa0998443293bca354774e3e49162e62dd157a6fc254bbb1718e27db
MD5 744564e9c09c3eda4180b3e251278184
SHA1 c95426f77de251b72e189583a262cd0288a28031
SHA512 211cc3d4b0cb69a08c6a810c530ec018562c554dd7edf6c716313862a60e377079763b5aabae39c045d046b9a3afaddb896f3c7026ee75874d038a2956b3ae90
SSDEEP 49152:y6iPILIO+dscBbYmyp057rjseo9bkRGfqKCBAUZLYv9MxGaXYQKuPm:y6kI0DdscBbYmypu7/Jo9bkUCBAUZLX
TLSH
T19D95BE41F3C781F3E42344B09256E77B9B21DF224126C1A6FFA8BE4ADE33791525D226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liba52_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52_plugin.dll
Size 10KB
SHA256 c8a5143220259d3ef892249981c49cbdfbca095e4a05390263b5151d09d9b689
MD5 27d03787c1cad0810031da81b230df52
SHA1 cf1607d1e6c29bed2ed9dae9088312436618bd0b
SHA512 cde2b64b0f4db6d7d703330027cdd0c6f2e90a090e9c681a1c630036c4e1be7e38506ad97d981c74d349e2322c517ab4e1d42ae9a5cad44a07b6cb7f9917e8e0
SSDEEP 96:G0k/sauOkoyNffZaVia8MkdJ5wlhdR8kAyIZVjuVOGL/y4jZhpoEALauJH/:jvau1oyNfZ4e7wro/yIAOGL64HmEAT
TLSH
T14022B8C3B64A14F1C04B44705193A67FA77E812B069BC681D7BC8D5DEA73E516F1E20E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liba52sys_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52sys_plugin.dll
Size 8KB
SHA256 6f42cb6bba6d4a91f2721117641880c4f0d0ab2d2dcfc0a51b16173ae2efa053
MD5 62e7ca1d5e4fdecaf86f5b6790ab6e00
SHA1 265f6bce95c60acffba32fba728c1af169b637c3
SHA512 bd62e0495cfc351cf63343f3c6f4891e8c10c86d67fbf6cd7bbbfa5d96e6af299854ed0347dcd0bb1859aa93103bb4875babf7b24abfdbab5531c8272d8a181f
SSDEEP 96:mWMaogh5g+sh3xyWAisX6db9YqU4wbyU4YLnvDbHjmhCqSHEf8pEALxlJ:DFHYxn3ZSLsYLnvDbHjCCJhpEAL
TLSH
T1DBF1D886759608F3C94F0438A8DA1A3FE6B5F36357068012E7A8E94FD8374647B4E347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liba52tofloat32_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52tofloat32_plugin.dll
Size 41KB
SHA256 e99eb56259e3c24b7dc1118281144d93122cba2539ac7459d879511b16b9d604
MD5 19b87a2d432497278d29fb55c03340fc
SHA1 2b3e5b6efabf633375bf068e9d03d567b2ec2d35
SHA512 088c1bbfa27ca0f3ffb106dd642c2524b466ef43c89cb44746176f1e0db77a1ea888a9c8e4ed1d42dc006c39ab1906363b95a2458bd2691ee5d58f13bc8e7a59
SSDEEP 768:efLtYe5kbW1UdBQBckl3xaVvlYYQUA3iDXTgWBiviJe2sRPFW:YOzQB3aVveUCAe2x
TLSH
T105134A0DA5C191D1F42E05B8109657BA503D5B2D0EDDB433EF6A02BEEDF421E917A38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liba52tospdif_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52tospdif_plugin.dll
Size 6KB
SHA256 d95475fa9eff5dff0cc32219fb6eb691b7879a550c6deddf07c9849a32b30db3
MD5 63351b978b303ada7b33eb3b200eeed7
SHA1 1acf3d4434962d60232313a87c56ea7b0cbc9c17
SHA512 1d2d1a9e82f75587f3476039ed8b5145d76525ff4427146a8f1b2ca650aae1def9b096400d60d86fbcc2e5ddd1ea83def485e1f00526ecbfcf795d1da0e6b8c5
SSDEEP 48:62ECmEADBv5IyrZkZwIaNqNQXjhSBe9hS4YmRAL4JtNrco:iushRjcwhLYEAL4J3j
TLSH
T17BC161833A480DF3D89B037040D77A7FA2B19101854B95198394F1BFE67B9307E2EA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_directory_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_directory_plugin.dll
Size 13KB
SHA256 446177829681d382915078f0e01bcbe3a1e627333975f412378f8633844e7dcc
MD5 951ffb6173e507ba668ad41ea3c83332
SHA1 ef54868e74170d3bcd5cb5d719357a8c48e893b6
SHA512 abba48dba1b162081abdda2860b1a2dae3d5a777e2ca87c7a0d7f59ebc083d965b12689de15d6b50eca3322d26153b5b7bd960cc3335e32966c6147bc888f7bc
SSDEEP 192:1e5CHn+2Cg4tfuyotyPszzU6ItBDxNKVATssKEAHdFpQuLD:s4Hn+2CgWot06qBDzg8ssydFrL
TLSH
T1F45208C1794F29F6D85B00716181E23F96397692840FC509CB50EE8DD63B98EBB2E74B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_fake_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_fake_plugin.dll
Size 8KB
SHA256 d68793c605aa569a92de352eab85a0cbf1d241cfd06e78ba3321b5827b5de89f
MD5 2ec7e34027b6a1c6da1e356c15c266d2
SHA1 6cd51023762c5833d60ee2a728a9b85f67d8c98e
SHA512 a0b24ff2b4a4c841a2b67774690a39376342b18d1dc61232979c883470a6fa5ff5e020b15f0995127ff0ddbe4c74e5aa8d001b84830bf61af1a8c7db7c633972
SSDEEP 48:62bkR1UvOErilZkuv/uKI55ztq0ee+M6dHbgihuqBuFSfRA4c0DXKcdlujO/5hb4:t5DKI55e6G7uhc5ujO/5hbACT2EALGJ
TLSH
T140F1C7C3354C88F2C45B087064E3D93EBF38621696968166CB10E95ED43B6397E2F6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_file_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_file_plugin.dll
Size 8KB
SHA256 51069e60ab4bb5c2623450c42c7f6e7207f893f06aa0144388398862a1d8706d
MD5 48dfb4829cf898d25bc5d46c537192eb
SHA1 1d5fbc7cbe1ea5159b2924656ff77c49870e4489
SHA512 a1f2fbcf93a81322ece7700af535e7d63068b3f3d55ba3551642d02446f4755de6d0b8abb63993857b021ecad4a575eaaea9f5f109d045136d30e7c54a5cc651
SSDEEP 96:czBuFwdWZHz1R88Z3/Wc9L6uhWrGmfVEALhgiD0Fk:wIwdw6uvWcsq/mNEAlgRk
TLSH
T1CBF1C7823D8945F6CC5B08B4549F663F3B31B016844B9317DF90DD8AFA3B425395EACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_filter_bandwidth_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_filter_bandwidth_plugin.dll
Size 7KB
SHA256 fae3799e5b3449368084b2374ad8633f158cd94c4913f43637b4b046681725d8
MD5 255665b6a4404f0f44c4ffe55c2cb4c7
SHA1 f11bbb9da6a8190fa806d11f452df0544697c216
SHA512 dac8bd5223de6e2ff55974364c7bd2b29ed699cecaf974dea6b1f98c504ef72e9c09f94d5b5739f3d102a89ff339dd7ddbfdf533999ee6687d906d4b24a212f1
SSDEEP 96:DYiQBmcJshsCdXB3gnuz4N4wbyU4u1h/ElfNsEAL/J:6BRshfua4NLsu32GEA7
TLSH
T11DF1A587325849F3D86B88310495713FF3B0F1025A4F9221CB98E54BCA7B5373A2E28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_filter_dump_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_filter_dump_plugin.dll
Size 8KB
SHA256 c57f1eca543651e44418cf1ef52afdfaa0fa87f0713aca67692c1c3c2cabce91
MD5 9a8a44965d3344904ad4b114af303b41
SHA1 818cba9d24ee82d87ed2c8c9a479bb9186ec8e72
SHA512 af3706a756e1cc8836e2328c9e95f5001b59c6a1dda4276d44944190f9a122e2472d1655fd11bcf03d70d53e85e85cbba5352d9208cbf61346468399faf30853
SSDEEP 96:n9Xd2reSkJzqLA+RsoTQOSyQQuIzVhVpEALuYY5L:n2il9+CohrzXfEA/KL
TLSH
T174029487724905F3C48B1138A0A7E53FBB70B60790594112CB64EA7BE9374393A6DA9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_filter_record_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_filter_record_plugin.dll
Size 27KB
SHA256 45f7244829da11ca386abb2efc5b9f6a427f2372fa38d171ecf17e63b74ecfa5
MD5 4d48e460e30d02a781bfa937a548adc4
SHA1 f0d5225c4e3305d0078447b952c1e35f0649d7e2
SHA512 f005383ab2a4a232057d9f6973e16c09859e4f226d6519348f85ee749a171804123b6b1fa003fa844e3ee95c55afd6ac74467371430dded05660573c446c8b8c
SSDEEP 384:Ukhox55phm17goBAdYpRbLUzuXkvXBECUPTpetB7+UNuF9R4KuIpiKWYc:UkhoThK7xBV7fUYQepQDQF4IiT
TLSH
T18DC25C47FAC7C8F1C5574578106BE73F2936BA118028DA4CEF58A97AD873621F13A28D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_filter_timeshift_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_filter_timeshift_plugin.dll
Size 28KB
SHA256 9121b39b8fed77c63444ae2e6fe4a46bf7eac0967333bd0c86daa18456b627c9
MD5 3f2a2d71e0230994910fe6a3b3a140c5
SHA1 9092129541565633c56e83ac1346aadeedd09a43
SHA512 1b98ea5277490c9d6cda5d7171869f9b3b8003cb2fbd5a2d2a4e73589cd31e0a89ba6af2e38177a5c24d297d09fda8eeb97ebfdadb07acbb72c7fe1ee2bf8b36
SSDEEP 384:dxsLU6pZqp5sx7goBWdYpBFbLEIn6XkHXBEC3MTpetr3tNuF9R442E/6p6TiAB3:dxsLFO5E7xBbL9E4YoMpQTtQF4WyIT
TLSH
T1D6D24B46FBC7D8F2C59A4570205BF77B2E32E9138024CA5CDB64A925D477622E63F18C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_ftp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_ftp_plugin.dll
Size 33KB
SHA256 46f236ad8cccb33f6c47b659b8e1ef82f04cf2a874bf468b046cad650eaa6287
MD5 89e5cd733b2da23403342f2fcca4561d
SHA1 0eca631d3abde9e6dd143f2798b37e7fc38f9022
SHA512 7367aad919ea7ae530001002703ed27c307f0bd18264c9812794ea2500753848672e24157875a92f298dace9088978a22295f901daa0574514a729cb1eedecc6
SSDEEP 768:5S2vsQQAVVTfKhN7xBSDd4gkCvpQ3RNQF4ojkK:I+sQQkF7ioOojkK
TLSH
T14DF21B42FBCBD8F2C56659306067B73B6A31A9218424C79CEFA46D67D833612A13F1CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_http_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_http_plugin.dll
Size 83KB
SHA256 8a488e166d9b9dfe0f34195ff2387ae1674ca82b3b44c29adad1bb90efc6f593
MD5 fcd1d500050524447189378a232d0cba
SHA1 996a61d4c42c2eb26fe14b4ae23c46b9d908610d
SHA512 053a9b1e4d3ceb5daf4e7120547da44eb10bd41311e837120564a714e9d5a86742c8d60c6cbbee60936b2e5ee0acc693fc0b9839e9a9c02d324cd43647216118
SSDEEP 1536:fmr3nYDjzRSlXTvtFRsKVo6zgdi0O3+AHzSOIOXXnToIf:fq3nYD0lkfw+4dXXTBf
TLSH
T1FA836B65F6C7C5F2D42305B4A08AE77F5B21F6218008C14AFF989D6BD977612B12E2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_mms_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_mms_plugin.dll
Size 68KB
SHA256 a3c2e8c2c642b939aa34f011e83ef00dde2f630437a81926eb36dbde43e32a1b
MD5 90968db01c263fefd95db82560fe333a
SHA1 cb0edcf8036023bf24439592db5d2890b7107aba
SHA512 7d7d4cfe9a0683bb2a768ea56bd2de1f8093962b41bca1d88db37a067157230d95b13eee9c395859d0f56aaaea783ff447bbd1b0ab44863f57eb5b82be49e803
SSDEEP 1536:6IHxNJPg2OVV57wXK3inyQMAciiDOWgH:6IRPjOVV57Nwyboo
TLSH
T1CC633B51BACB84F2C90B4930905BF3BF9B61E6064134C7A9EFA49D2BD873742563A1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_output_dummy_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_output_dummy_plugin.dll
Size 5KB
SHA256 e7e40e3c7aad446f253d230bb7b565108c99f6f476ef0f0c6407b0590c3b72c2
MD5 b9df8b2fc1b2d9f85a6d02b9bf182216
SHA1 6606bdeae3b1f7122258e82e80ed1e0e34c409c9
SHA512 bff5aa2df45c79d67c1e21ac3ccbe6dce316ecd178425dbba74fea196d4c2285f002177e1905e42552f3b3020414c93329f2f48cdb87d48366836c3ec26ba579
SSDEEP 48:62BWi64vc9HMhrRbZbEIaLsl1TrsagDY8ZhXUmcfimRALgSJa/:XTtO01oDhkbqEALgSJ
TLSH
T15EB14193721D1CF2D48B413094D66F3EA3B1A117019A41618B70E98FE97B438797EA8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_output_file_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_output_file_plugin.dll
Size 7KB
SHA256 d485265de00437020ff1674d35bcfba4f82fb2b16da3dd9bd4a213fcfee44723
MD5 455d20a11b74d200f0ddc75b9c1e5848
SHA1 b5402b0f74268015a5d33207cfc6a03c83946869
SHA512 ed227ebd3319d52613ba6b134f39b3cc0d6e7f3fc4ff927708b6c5c26643e85018f983ec0cf7f0cff76ad9715b6c179bf448d4fd4b4ea876d1c5edaeae9bdc69
SSDEEP 96:FUyvxgRzLfHBT7yr51zhbpPbkEAL7pnWTc:vyBhyr5L1PgEAgT
TLSH
T1B6E1B583315D09F2D40B863D5CC7B57E7FF5E00255AA4D25CB54F84EE92703A296F289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_output_http_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_output_http_plugin.dll
Size 9KB
SHA256 d9dcf0b5a8948e17ba1927445185e4f8b038b068f63f90d8a05286df974e8b1b
MD5 9dc9452182cf700e7d7f1d965e6c55bc
SHA1 6ff37cb559eb14ebd3f13b643a39dc0b673c1af8
SHA512 7030b3418541427f66a03674f6b76a8ff419b6c0187be3ba1240e39fc4136d89dba2bfffc70fa1b712bab551e889e30a287b80fb30617bf93c431730a012ba5c
SSDEEP 96:A5//UfsgW2SmcabwK80crF4yGZ8XzIhfAYZXLgwvCEALNAjL2oye5:MUtQg8XrF4yGZ8XzEfAYZXLNCEAyLR
TLSH
T16E12B5CB794D14F1C4474430A1C3E67BEB36B02F81968202CB98898DFAF7656672A6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_output_shout_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_output_shout_plugin.dll
Size 364KB
SHA256 703d2a951c503f000791f31cc07882110533bcec093527c310a4031ed4639640
MD5 f6322ae7fbb9c1c90953b9d60902b153
SHA1 a5cb44e1ab54d19de7dca030a4deb45f4fc8bfda
SHA512 6d66cda78a34e2d539bf7989c27ca65fc283178029cab8b5fe76b7d4afc5efc49bfd540284571f0fd0678e839475bc475b26834a0a603409d2a5857c211df094
SSDEEP 6144:HFEyuluI0ZyMWy6mX3WBJCL2jZX1IH9wdLivoNqjI8oQpR0TS:HFEBs396FK2X0eyoNqjIy3SS
TLSH
T1BF849F42DA9284BEC0E201F1121AF7B6E930D73D4020DC67EBD4A9FDA971F929D5931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_output_udp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_output_udp_plugin.dll
Size 12KB
SHA256 4a1d9eb950dde84c2e30ef65e7159dcfbde9099e699b1f5d1a4233f1e537d042
MD5 433444a01a75671a992ee25f463420a4
SHA1 f1b559b74342080d3ac03921ab61ae77bbcb2fd0
SHA512 5e268f14c604e0103a0c4cf44d220f3d8a52a8a499c418dbc9e6e3bda396be493f18596486e18094a6e91ca4fd034a7775446de634a89716c0630f3908c7759d
SSDEEP 192:DviUhr10G2mn2dFPfA2OmgksbN1EAvtnMz:DHh21mn242OmWNRA
TLSH
T1C142D5C1778A28F2D54F067190A2E73F9A39A10540529158DB545CCED73FB0FEF2AD4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_realrtsp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_realrtsp_plugin.dll
Size 40KB
SHA256 9125c7fb39d92328b579d21363571a282db48a98a31f0676860932bd7d1a62f8
MD5 86ca66be3faac71e59269d14e3499cab
SHA1 c32ec568f6d1fa880c77f810a4226b69e84b8027
SHA512 7b77162980fa477bb1a784742cad08660da0e0d9c6f70f60fc2db48da59606391d5ef116591e3430c925e7a4888442b2cd1b54ab471c3dd48468431d10a49e45
SSDEEP 768:HRaq/cshtyPBB0KiZjiWeC3IZ1S+Hbb2CyweihTWi3GLFSkmrQoYBCY2:HRaq/cAtyPHWAC3InHbbTeALWLTQICY
TLSH
T1BA133BC167CB00F5D8070474B149B27EC7A1A70E4529E99EEBA8EF4CDA37525783E24E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_rtmp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_rtmp_plugin.dll
Size 41KB
SHA256 580903e04a434fd5142d400be5a3a21fdadc25a5cb6bb0354d684b1e87007648
MD5 8d80fb45e25a3f54f43e2fd8f63a86ae
SHA1 a216db02209d95b58ea4adef25393f7c7e885bdd
SHA512 0bb8bd0c137b37a132e96458353a3a492cffbc8a78831d011150daa612935e070cae8281b036ccc985f22a77b687184f3dbc110b310f6de69cc71bd2b2472165
SSDEEP 768:QwECPUl0OPvS6Gj4lb48Znq0OJnTiv8ZMSJ:/bPmnS2lb4N+gJ
TLSH
T199132A40BF8B40F6E81708B084D5E23FEF3092459624A1DDDFDA4E58D67BE627A1F14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_smb_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_smb_plugin.dll
Size 27KB
SHA256 16c8f5d29fb6327618b06c4fd6545317fc42acb7ac394543047a2de962070b23
MD5 67f2822e54bfeeb299b04c3d5a831ce4
SHA1 fab5a31f7fce82cf0952947e56748d42750c51b7
SHA512 42474703f4afa12c10bc18dc7fea7ee4685b420a28a0f3c49fb89e61c6d712fd3f2909c36700eea413bf256dc1b77945df293e7ab97a44531904d532143dcf01
SSDEEP 384:BI+1pEVuRktPZsB7goBWdYpAjLZgTXkWXBECgLTpet7XNuF9R4IlefOVnkT89M:OzVuRkVZ07xBb+3ZqdGpQzQF4YkP
TLSH
T13BC20956FECB96F1C65689701067F37F2A31E9119024CB9CDF54A935D827612A23F28C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_tcp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_tcp_plugin.dll
Size 6KB
SHA256 409c6d4e3276ccb960f28d337ac4906ee5e134c38cf88944bf500ca928147ce1
MD5 fc3f77540044b7c1f62bddebd80625e3
SHA1 e7a43394cb06b7c56ed15d6bccb2e3ed494a5a2c
SHA512 aee7f1516363f4ea0865caf1950029012cc8ceb3c5b6b6eb2728a6a7d499eef5dadce72239868ebf6e3107bb104987713b42fe57ac5c1eeee5c3fd721baaa9a3
SSDEEP 96:OHvR0lrO/r/63VP0yxZLRhC/hT/EALcR2/f:gEGL63h0UADEAK
TLSH
T113D1B49336444CF6D84B053986D3E63EBB3092194AC68052D744A6AFC9331B7697F7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_udp_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_udp_plugin.dll
Size 7KB
SHA256 f7891024dd392070ad4a4fdcb7c4d60c3c6fe9e146590ee3c686371bccdeae89
MD5 b3a87f4cce54aa5395d2742e4feee1f0
SHA1 7dd073e832e55bb2a4008ee8136b4cb31cab0eb6
SHA512 e832d46689af339b876a30845c9988e89f77b019789dd0fe0076ecfabd9775925b2c8f20699814bf511956dbd44b205b32ccabb856af91fa0c45d143c5b926fd
SSDEEP 96:zv15RpUxgIgqqXntBAZo8xG4/NhfArEAL/X82i:TDRog/q8BWxRHfGEAo
TLSH
T104F1848776080AF3D48F047868C3A63EBF35911994C64595CBBAE6DED83B026393F5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libadjust_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libadjust_plugin.dll
Size 21KB
SHA256 b2530ed269ce83dec5ebb7053fbff50991b74067051ad28e523c1a6765ddf60c
MD5 1c7995d35c0f102de563146617c6381a
SHA1 15add72e6150739ad2cfde8ce4105a982cd8e578
SHA512 36b4d410b4ef6f1c67e1312a70f069cfff87db63d3145725493466226c0e3373759ad25333f33efca582aed709f2a5bdcdf6e22cb9309ef1be92c7ee566517c6
SSDEEP 384:tUz35NJKgQy/CSJHQpePcCZq79y6wHveBdYJ3:tUZO9eFZW9GHvWI3
TLSH
T1ADA2C586F0DB05E5C05F0DF42254F6BBC9754E2B6009B3A4CB5AE2A5F932B02D877B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libadpcm_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libadpcm_plugin.dll
Size 16KB
SHA256 c33ab6bd81e6488c43c8b7ea5ca5ce517729e5ca0e815b96380880f221eb08a2
MD5 1d85612663ee82d3869ca8459d0f5c06
SHA1 ec4caf0bb34e31c115083eb2dce9053c9f679836
SHA512 98ad7bc3ad67472d8c0f638e6ab37f4f3c89d576956b731917eb8a7a8cd2a5debac706291191868796b0de79591079ff02a4a7791202bb7a6a2f68d4e91b85e3
SSDEEP 192:G89FBazpnpOpHn7F1HGMhp70WD+YVDuLuOZ/TxmtNq3v1WeaA2JnCuJbg4vDCVvN:zBMhIZ7XV6SMuOZrxma9psJ/lxbfFO
TLSH
T11772E8E1E5D7C3F2C88246F101A9D9722EBAC54FD436C995D3B3BA1890B6313618D70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaiff_plugin.dll

Path C:\Program Files (x86)\VideoLAN\VLC\plugins\libaiff_plugin.dll
Size 9KB
SHA256 197bfa73358355bd7f3925fa942a9037b4e51d402c4ab5e8f6831610653d349b
MD5 a3baec9b67f6df54fc6b054d1adeafe7
SHA1 08738611f244780553ddd12665f017c57e6737a6
SHA512 37f414ca07d547b023e21e64abb16a196a6124b370c410b65fc15682e2abb33ac70889d213a4094ac25ebb2a74e4f581ca2a8c9aa793a26d2fbe324f387a3cf7
SSDEEP 96:nM/7p6HDlKn+nrjhN7EBm5E/UujGqkUJWLjzE4wbyU4IhUseGrjVEALSJrl:2p65KnwroBm5E/UuJJWLjQLsEUsPEAu
TLSH
T1F912A2C1328958F2C853087094A6B63FD77EA9278219C612DF6DD68FE83B911322E347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe

Path C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
Size 112KB
SHA256 3906f0ea07922b0b6edb34909595a55f18cad8eee8344462ee8eba00a4ee58d4
MD5 0c803988240f482d287e960e6a98e620
SHA1 2a51519b2e57b17907bd6e0840c755f32eedc1fb
SHA512 bb68e99d1b802f390088e7079bce8ee864bbc08eca706367f0503fa1d959449a07aa6d250dd5e66d2aff734f54174e4fb06cc40a25da021d84717516f37334d8
SSDEEP 1536:vfxJisgEX6YaSd4Psq0PXpmWu79B1ArPUco9FLdS1EAd4kkVIIOQSONinB:vfniQraBIpPQMPozgEAQIIOwinB
TLSH
T185B3C69579844D43D66C053CC8B7C271133ABDF14A660F076468BEBA3A72A472DAB70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7B14.tmp\InstallOptions.dll
Size 17KB
SHA256 f9a6f49778db1887e4cc96729fa3758693d281bed70174adf55fb322e3fedc00
MD5 d43d84790c559b71f8e64fd0ef7e0692
SHA1 296e09f4887fdda25cc854119df736f739b330c8
SHA512 bceda184719fc91ab047698df0c2999c58d062b25e390cce92d408a53dd29c123467cde901d5152773a646095717aeb0c181ee0f857f8ff803271ac9b5e75dfc
SSDEEP 192:Zi0AiuaA7BBBVll9g2tbpfELj4+bjEk3RAq9naEyOz3xxhxaHxJ6fxSUsvkk:MaAXtftlff2EuRR3BEn6JSVv
TLSH
T19A72F6CEA7616C73D96703343016662276B09872B07995C26BC67F8CB8E0676F24C39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc7B14.tmp\LangDLL.dll
Size 6KB
SHA256 d3cc40ce2eb465be5f9c58f5196c567533ebe6452399193c781210755c5a414f
MD5 8699f12218b88c83e8f74228ce56535e
SHA1 6de86ab9f74451d0fc1654c83ebce4dd3abfacd7
SHA512 7d27178100d32c75b02ac3989ed78da12416fbebc9032ac757d316f9a9b6a259c3f9cbd3ccb994b5fabdb204de3ea7cbd6eb5fd68e26614b549e6846c2bb94db
SSDEEP 48:68WelgEt0CsSS94TVZivz1Pjs2wF5bD4AfKgPJ5fMSVddRlQQG0w+UwB6UoXsofW:ZWeQSa4TVZ6dFU5H4MK+V/HQQGhM
TLSH
T1CED141B7BB5309B2E15515B522B16F07BEB1E1251A2DC50BBB5062FE9808113AD0D7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7B14.tmp\ioSpecial.ini
Size 714B
SHA256 4e66fa2cc5c64bc5447eaf429d90e97775304db0acd332fdbca635b7a0027039
MD5 18f0286082db234c6a44f2c51647d751
SHA1 125504d5da0c69a4f7c6e2d197a1501f7bf0bd9d
SHA512 527e422db083cf83a3bcbe07b5043d32266568ee443fe23f313482a12010c1e132eb34adc4d2ffd9492cfe9ec2fa809626476b260ddc9aaeeb14304b4a53d1fd
TLSH
T1A301C088856FA358082054E660F93791A7E12C3C471138F3F46288C6634D9C34BE9DE2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7B14.tmp\ioSpecial.ini
Size 753B
SHA256 d46d74608cfd69d3d17e699d875d53a4b370e01ad267534b7884607d4903c609
MD5 dfdc7f9a4b1bae5f82f8f94f8d70df7e
SHA1 086d42311802ded067c331f151ccb254ace67192
SHA512 d26ebb09e2ae57ba27e9e242e48617f383b51af8f70e8551fc54e774ae8815fc4e0a378ef616510dada143517f3ad6547a554f57b56a2be7ec1410a920639f47
TLSH
T1CB01C588455FA399082054E660FA379177E12C2C47113CF6F07298C6634DDD387DDDD6
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7B14.tmp\ioSpecial.ini
Size 962B
SHA256 cac690cda04979090dbe6960b9e6cad7bfc1e96b79eb9869996d327a32b88dbf
MD5 f52a68a8370199984896d5e417e2eced
SHA1 0774abdd9f22f09578491c410750ad59de69f6e1
SHA512 8e4d832d378e09ea2d132bd58c68018e7677ff3ebbceeca9dc828e3e1f48cc5e20d05a67dc555355369d148ebe1d28cd82fd3843b8db7d1d5fd31c4eadb20221
TLSH
T1871197889119421A4820DAA2A5FB7F9163E02C3083052AF0F9B75CC3E74ECD699EC9C5
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7B14.tmp\ioSpecial.ini
Size 962B
SHA256 f0a6c1bf11043f9c45d599b7a7556031887049a64d8b61997eba090c721bad0a
MD5 5d54aac9ccad3030f3a817ebedb6fcad
SHA1 137a13468be31760e71a53fc79ad2cf773419448
SHA512 d430dae7a85d57d59a1354a516bcfd4382588dd02d849a144076bfc8ff3ed785599c0aa55060e4b424bdf3435bad0ed681031d52fa36ce1c35d7c8d82a153634
TLSH
T1F7115788911A035A4C2086A6A5FB7F9663E02C30C71926B1F5B35CC7A74ECD5D9EC991
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsc7B14.tmp\ioSpecial.ini
Size 971B
SHA256 b2b72ace60d9e928200749d84e47ac31f303893b6f8625cacf11b2132a19613a
MD5 3ea6b20d1949ec1bb70ae14a9cabd156
SHA1 ea53c4a5537b316a82fef3ad0d9f731f6149f3c8
SHA512 274351d861385dd503fecf580430a40f9dc8743ec9afb7b9ba9b924178e64e3294800052576b7fbe73307e4ab9212b21019eb6c8a1f118d1a44498ed69cd9ce1
TLSH
T1A5119788911A035A4C2086A6A5FB7F9263E02C30C31926B0F5B34CC3A74ECD5D9EC9C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3936-86-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/3936-87-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/3936-886-0x000000006AF00000-0x000000006AF0D000-memory.dmp

Download

memory/3936-885-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/3936-83-0x000000006AF00000-0x000000006AF0D000-memory.dmp

Download

memory/3936-907-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/3936-0-0x0000000000426000-0x0000000000427000-memory.dmp

Download

memory/3936-82-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/4824-979-0x0000000003DC0000-0x0000000003DEB000-memory.dmp

Download

memory/4824-1008-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-955-0x0000000002B80000-0x0000000002B90000-memory.dmp

Download

memory/4824-967-0x0000000002B90000-0x00000000032F0000-memory.dmp

Download

memory/4824-968-0x00000000032F0000-0x0000000003300000-memory.dmp

Download

memory/4824-969-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-970-0x0000000003300000-0x00000000035C0000-memory.dmp

Download

memory/4824-972-0x00000000035E0000-0x00000000035F3000-memory.dmp

Download

memory/4824-973-0x0000000003620000-0x000000000363B000-memory.dmp

Download

memory/4824-974-0x0000000003640000-0x00000000038F8000-memory.dmp

Download

memory/4824-975-0x0000000003930000-0x0000000003A74000-memory.dmp

Download

memory/4824-977-0x0000000003A80000-0x0000000003B42000-memory.dmp

Download

memory/4824-978-0x0000000003D80000-0x0000000003D93000-memory.dmp

Download

memory/4824-909-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-980-0x0000000003DF0000-0x00000000046B5000-memory.dmp

Download

memory/4824-983-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-982-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-984-0x00000000046E0000-0x00000000046F0000-memory.dmp

Download

memory/4824-985-0x00000000046F0000-0x00000000046FD000-memory.dmp

Download

memory/4824-986-0x0000000004710000-0x0000000004727000-memory.dmp

Download

memory/4824-987-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-988-0x0000000004750000-0x00000000049A7000-memory.dmp

Download

memory/4824-990-0x00000000049B0000-0x00000000049C8000-memory.dmp

Download

memory/4824-991-0x00000000049D0000-0x00000000049EC000-memory.dmp

Download

memory/4824-993-0x0000000004A00000-0x0000000004A65000-memory.dmp

Download

memory/4824-994-0x0000000004A70000-0x0000000004A7F000-memory.dmp

Download

memory/4824-995-0x0000000004AA0000-0x0000000004AF3000-memory.dmp

Download

memory/4824-998-0x0000000004B10000-0x0000000004C0F000-memory.dmp

Download

memory/4824-999-0x0000000004C10000-0x0000000004C37000-memory.dmp

Download

memory/4824-1001-0x0000000004C50000-0x0000000004C62000-memory.dmp

Download

memory/4824-1002-0x0000000004C70000-0x0000000004D92000-memory.dmp

Download

memory/4824-1003-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-1005-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-1004-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-1006-0x0000000004DB0000-0x0000000004ED5000-memory.dmp

Download

memory/4824-915-0x0000000002B70000-0x0000000002B7F000-memory.dmp

Download

memory/4824-1009-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-1010-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-1011-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-1013-0x000000006A300000-0x000000006A31E000-memory.dmp

Download

memory/4824-1036-0x0000000061CC0000-0x0000000061CCD000-memory.dmp

Download

memory/4824-1043-0x000000006B240000-0x000000006B24A000-memory.dmp

Download

memory/4824-1042-0x00000000699C0000-0x00000000699C8000-memory.dmp

Download

memory/4824-1041-0x0000000067500000-0x0000000067509000-memory.dmp

Download

memory/4824-1040-0x00000000712C0000-0x00000000712CA000-memory.dmp

Download

memory/4824-1039-0x0000000065E00000-0x0000000065E0C000-memory.dmp

Download

memory/4824-1038-0x000000006E780000-0x000000006E788000-memory.dmp

Download

memory/4824-1037-0x00000000634C0000-0x00000000634C8000-memory.dmp

Download

memory/4824-1032-0x0000000064BC0000-0x0000000064C20000-memory.dmp

Download

memory/4824-1035-0x0000000002B80000-0x0000000002B90000-memory.dmp

Download

memory/4824-1034-0x000000006BC80000-0x000000006BC8F000-memory.dmp

Download

memory/4824-1031-0x0000000065780000-0x0000000065789000-memory.dmp

Download

memory/4824-1030-0x000000006EB80000-0x000000006EB88000-memory.dmp

Download

memory/4824-1029-0x000000006C000000-0x000000006C008000-memory.dmp

Download

memory/4824-1028-0x000000006BE80000-0x000000006BE97000-memory.dmp

Download

memory/4824-1027-0x00000000661C0000-0x00000000661DB000-memory.dmp

Download

memory/4824-1026-0x0000000070080000-0x000000007008E000-memory.dmp

Download

memory/4824-1025-0x0000000069740000-0x000000006974D000-memory.dmp

Download

memory/4824-1022-0x000000006E880000-0x000000006E888000-memory.dmp

Download

memory/4824-1021-0x0000000067C40000-0x0000000067C48000-memory.dmp

Download

memory/4824-1020-0x000000006AB40000-0x000000006AB48000-memory.dmp

Download

memory/4824-1019-0x0000000069A00000-0x0000000069A09000-memory.dmp

Download

memory/4824-1033-0x0000000069800000-0x0000000069809000-memory.dmp

Download

memory/4824-1024-0x0000000067AC0000-0x0000000067ACD000-memory.dmp

Download

memory/4824-1023-0x0000000062E40000-0x0000000062E48000-memory.dmp

Download

memory/4824-1018-0x0000000065480000-0x0000000065489000-memory.dmp

Download

memory/4824-1017-0x0000000069940000-0x0000000069948000-memory.dmp

Download

memory/4824-1016-0x0000000002B70000-0x0000000002B7F000-memory.dmp

Download

memory/4824-1015-0x000000006D740000-0x000000006D748000-memory.dmp

Download

memory/4824-1102-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-1103-0x0000000000400000-0x0000000000425000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads