1bc3f62b9a4f375243de8270b840b6d4c231d495f002b7b50fa6fde8e5805ef1

Analysis

user interaction
yes
max time kernel
208s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02/11/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample
Size 47B
Sample261102-fpclvazzgs
SHA256 1bc3f62b9a4f375243de8270b840b6d4c231d495f002b7b50fa6fde8e5805ef1
MD5 82c7d83fc790e84f3e2cf4f7702d353a
SHA1 bba0817e92e571a0fe72409d5d5b394ba41893d9
SHA512 e662a2b67d2acb44fd6b44103d8131b17a175dbe70107dd8217e32efb3fd8c6add48a3244aeb12c39ddf126ae8708ebd26e2fd6659ece34ec4a08c1661f8eaea
MD5 SHA1 SHA512

Score

7^/10

adware discovery execution persistence privilege_escalation spyware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
1472	vlc-3.0.24-win64.exe
3992	vlc-cache-gen.exe

Loads dropped DLL 64 IoCs

pid	Process
1472	vlc-3.0.24-win64.exe
1472	vlc-3.0.24-win64.exe
1472	vlc-3.0.24-win64.exe
1472	vlc-3.0.24-win64.exe
1472	vlc-3.0.24-win64.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe
3992	vlc-cache-gen.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3536	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_BR\	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_cycle_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libpodcast_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromaprint_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libanaglyph_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\COPYING.txt	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\vlc.mo	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ko\	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\main.css	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll	vlc-3.0.24-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	vlc-3.0.24-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\	vlc-3.0.24-win64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc-3.0.24-win64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 47 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C252BF52-D67A-11F1-A0CB-FA79DB5CA436} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D51F71F3-D67A-11F1-A0CB-FA79DB5CA436} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2530108697"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31287943"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0039b59a876add01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300b7a97876add01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000838c765fc5677a49bc2c0d1578ce33c3000000000200000000001066000000010000200000000303cd6e95626d6191245051c50240993b83f96a2a824bd4b3f9682ce21d4537000000000e800000000200002000000025e2f14140136d60e963a3f8f6210707329d1f1dd6e6d134e713c1d8cccec49920000000f4d4b944e1f4d69d0d0ca2958adadb8759d911c9d7fdedd1e9a819d767a23ed840000000ecf17108cf0a3b1ce94a20053c4ba636f7b74548233a1efec796fc60004039c2ad296ed89e361e97cbe5935d0f3d9f9547df7be0fd665d1baa5ef4090b7c25dc	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000838c765fc5677a49bc2c0d1578ce33c30000000002000000000010660000000100002000000062075a724dce59cdf96c6a1d1e28c02e4e5c2df87d6dff46d805338c22f3ed1d000000000e8000000002000020000000814b529dcfe745fca10bd61adfdb7f6e7c941268c953ad6e56003aac31153441200000002f6a3fc36be778f33574e9d52810cf1fae317e6634262eea008c17b34b9a8c3c40000000f5643b3f6f0d62af2938b9bbbcceea39b9f927394abcabf801f836b852f0a1d98f615c08584cae9ee727c306105ddfd1e42eda99c72d5d45bbf2df517aef8784	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000838c765fc5677a49bc2c0d1578ce33c3000000000200000000001066000000010000200000000112ecde3044f41e5dbcaf1c7b4ab57ea7706258808aa4b98ff4873f0d376374000000000e800000000200002000000028a2ca424e9c1728da2c9e0a1e069850ec32402ef6ebc3bf3e3f8099fffd31eb20000000d5bd49253cb463a36df8d520e6df50c45ce2ba79fcac43379985a25ab0cefd4e400000001f869e357c846d69525824b14050de5955c0bb68a724ef77386677ccb04422b3ead3a407f56e168c42ec992e7d3e809f9f1bd198e1ece11a6d958e0678a74b12	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30297597876add01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.amr\shell\Open	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg1\shell\Open	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.drc\shell\AddToPlaylistVLC\MultiSelectModel = "Player"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\.wma	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.adts\shell\AddToPlaylistVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tta\shell\PlayWithVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wma\shell\AddToPlaylistVLC	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tp\shell\PlayWithVLC\command	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.3gp2\ = "3GP2 Video File (VLC)"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2t\shell\PlayWithVLC\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --no-playlist-enqueue \"%1\""	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.3g2\shell\Open\command	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m4p\shell\PlayWithVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.evo\shell\Open\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.nuv\DefaultIcon	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4v\ = "VLC.f4v"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.amv\shell\PlayWithVLC\MultiSelectModel = "Player"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.au	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wma\shell\AddToPlaylistVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.nsv\shell\AddToPlaylistVLC\command	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.caf\ = "CAF Audio File (VLC)"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tta\ = "VLC.tta"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.dvr-ms\shell\Open	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m3u\shell\Open	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wpl\DefaultIcon\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.669\ = "VLC.669"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aac\shell\AddToPlaylistVLC\command	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.it\shell\PlayWithVLC\ = "Reproducir con VLC"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wma\shell\PlayWithVLC	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.3ga\shell	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rmi\DefaultIcon	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpe\shell\Open\MultiSelectModel = "Player"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.amr\shell\AddToPlaylistVLC\command	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg\shell\PlayWithVLC\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --no-playlist-enqueue \"%1\""	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpv2\DefaultIcon	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tp\shell\AddToPlaylistVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.zpl\shell\PlayWithVLC\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --no-playlist-enqueue \"%1\""	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xa\shell\AddToPlaylistVLC\ = "Añadir a la lista de VLC"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg4\shell\PlayWithVLC\command	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.iso\shell\PlayWithVLC\MultiSelectModel = "Player"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mlp	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mod\shell\Open\ = "Reproducir"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mts\shell\Open\command	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aac\shell\PlayWithVLC\ = "Reproducir con VLC"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.flac\shell\PlayWithVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rmvb\shell\PlayWithVLC\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file --no-playlist-enqueue \"%1\""	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aob\shell\Open\ = "Reproducir"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m2v\shell\Open\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wtv\shell\ = "Open"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mts\shell\AddToPlaylistVLC	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.vlc\shell\PlayWithVLC\ = "Reproducir con VLC"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.zpl\shell\PlayWithVLC\MultiSelectModel = "Player"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tts\shell\Open\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.amr\shell\AddToPlaylistVLC\Icon = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ifo\shell\AddToPlaylistVLC\MultiSelectModel = "Player"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg\shell\Open	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.nsv\shell\Open\command	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xesc\shell	vlc-3.0.24-win64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BC97469F-CB11-4037-8DCE-5FC9F5F85307}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.au\DefaultIcon\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\",0"	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.oga\DefaultIcon	vlc-3.0.24-win64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mxf\shell\Open\command	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.f4v\shell\PlayWithVLC\MultiSelectModel = "Player"	vlc-3.0.24-win64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.s3m\shell\ = "Open"	vlc-3.0.24-win64.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4208	EXCEL.EXE
1668	vlc.exe
3892	vlc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1472	vlc-3.0.24-win64.exe
1472	vlc-3.0.24-win64.exe
1472	vlc-3.0.24-win64.exe
1472	vlc-3.0.24-win64.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1668	vlc.exe
3892	vlc.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
1372	iexplore.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
2420	iexplore.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
1668	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe
3892	vlc.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
4208	EXCEL.EXE
4208	EXCEL.EXE
4208	EXCEL.EXE
4208	EXCEL.EXE
4208	EXCEL.EXE
4208	EXCEL.EXE
4208	EXCEL.EXE
4208	EXCEL.EXE
4208	EXCEL.EXE
4208	EXCEL.EXE
4208	EXCEL.EXE
4208	EXCEL.EXE
1372	iexplore.exe
1372	iexplore.exe
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1668	vlc.exe
2420	iexplore.exe
2420	iexplore.exe
4356	IEXPLORE.EXE
4356	IEXPLORE.EXE
4356	IEXPLORE.EXE
3892	vlc.exe
1528	OpenWith.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1768	1372	iexplore.exe	101
PID 2420 wrote to memory of 4356	2420	iexplore.exe	106
PID 3892 wrote to memory of 1472	3892	vlc.exe	108
PID 1472 wrote to memory of 3992	1472	vlc-3.0.24-win64.exe	111
PID 1472 wrote to memory of 876	1472	vlc-3.0.24-win64.exe	113
PID 876 wrote to memory of 2752	876	regsvr32.exe	114

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample
1⤵
- Executes a command shell one-liner
PID:3852

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\SplitUse.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4208

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\UndoRestart.xht
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1372 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1768

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnblockUnprotect.m1v"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5100

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4356

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SetInitialize.mpg"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\vlc-3.0.24-win64.exe
  "C:\Users\Admin\AppData\Local\Temp\vlc-3.0.24-win64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
    "C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe" C:\Program Files\VideoLAN\VLC\plugins
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3992
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\VideoLAN\VLC\axvlc.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\VideoLAN\VLC\axvlc.dll"
      4⤵
      Modifies registry class
      PID:2752

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ResumeRepair.vbe"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libvlc.dll

Path C:\Program Files\VideoLAN\VLC\libvlc.dll
Size 187KB
SHA256 c0b1bedbc8e11267b39111733920a6af73d08791e333e4f8902eaffe4daf6db9
MD5 175b9eb6827fffdd0fff88cbdeb813cd
SHA1 efaaa8a82e7885521efba9425a08a305754bd3bf
SHA512 ffc093ebb8801dc2fcfa3d36bfcbc4ff22cc7f59cbf9506da5c18a956bf41dbc578c3eeb990ae2262a1e2cdce63655334178f7be37deeaded1b2b553c52185e5
SSDEEP 3072:eiWrB4d6nohofYAcqxBh7KYRfJMTv5yYGiSFls6ls69:e+NhKl+Yt6D5y5Vt79
TLSH
T188144B17728260EDC5ABC275C3D6A733B831B4601734BE6E1764CA351FA0E543B2AE6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libvlccore.dll

Path C:\Program Files\VideoLAN\VLC\libvlccore.dll
Size 2.9MB
SHA256 c089f281affe1e85c61edd5996c2b496191f82fa5cdc7ef709b0c09bf754cdbe
MD5 d40052af49e2a14ff5cecc433000ffe3
SHA1 2186f6494b449dd99167e66260f617da4a27a4ec
SHA512 5cf004304a698c9cdcc40d709d2243796964c588f94bd55d370f548ec3ddefb856dc777a7d8b9d92e71d02ffa7fea0e41d8ba07070b65a74b69ef9048ca791bc
SSDEEP 49152:lKOmpf88d10JR346Woz+mD2eGnzQDz5cpGcNBAUZLY6sEZGaXBuQQ9eJN:cOmkRodp4KpGcNBAUZL3PN
TLSH
T1FCE59D13F29254ECC16BC130865AA772B931FC640A317EBF2954F7352E31EA06B6DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.mo

Path C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo
Size 600KB
SHA256 03c94d16b7678c173ad3e86b833e79ab91441419417bad1ebab8de2fb34d7a9c
MD5 e8350aeb7dd0b2bb9ab5b3a1a3b3d11a
SHA1 93183d0e186d4e3b353bcb9a2805c35392017285
SHA512 41229374124d356181aadc82e3eacd59cfa7b533f44155bc14a4d15bdaded7df4985dd9594e6d85948e9245512009f9565b2427a4bddfb0d74ea811af3e8491d
SSDEEP 12288:/DUKlin0p+5uiLIaZP5LC0E0vmnQBNwFr9G5:gKs0p+5t8aZPFCTRQx
TLSH
T1FED47E139A852B35C65A237276668DF33B3DD2AE4345E60B38ACE0793343571836E3D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.mo

Path C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo
Size 1.1MB
SHA256 6cee8e517c3ea2b58dc2ebc89246d0f0a5234b572d42893e0c731ea92dc1f3f6
MD5 c641da1351b333839ffd4a147d9d900c
SHA1 250feab7f71753511f0fa06fd75039beda6dce81
SHA512 f891c8df1f33113bb16b63e93e0447922c842a81f3384d4013840e0fd9c47f1358b1dae995969c915c970cabe2f66a61f3c43194cdd2d63211d840c9f24d99bb
SSDEEP 12288:iqwhy1AL6CSpb5UIrka2EDPgKC1u+bZEtW2LkOz4:ih8pb5Noa2EDPgKM7EA2YOz4
TLSH
T1AC35791750358E7A4FD002367B8E6F5BDA6F8E99409F668B2C7DB223490AFBD0C55132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.mo

Path C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo
Size 607KB
SHA256 f53adf04a8f84ec214b09270b361f783d5f88c0fced183123ddfb97fb788b195
MD5 1afd937ec48d08753af9e212468ee8eb
SHA1 eb7c07924d0ab11d55293200cf8e8bc4bea66a44
SHA512 aa8b0bd2b3f22b20e8295f85b7125bdd37285759c5f284a18fc7ab4d5ff5183bf0d75b0b9534f964a8be82e78f772acc3b690f63a4c9002f51c9a98ebd224caf
SSDEEP 6144:RgmXQAUtgMAL9ti5F7IePoimk6TwigEpCKmHiba2Sa2Pv6hniUEiFgZNYivRQ24l:RgK0AL+5umila2RhAC
TLSH
T115D46C2E5BC41731C5130373B79B8A63637CC15E6A05C587A5AEE23532CBA44D33ABDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.mo

Path C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo
Size 582KB
SHA256 95a2b17e2edc1dc33c836a13f62132027520e191e066a2c0265ab5afdcb3c5fd
MD5 22bc1530fb1fa566f04a951b4d50033c
SHA1 ed12c871427ad671988515a2e20125a00ce0fdd8
SHA512 04d5d1b60116a06eb2871374292647e182f27c0db64a3431cb34c530145d07d5b3e0cfd7204ab8f5fe553c30cffb87c04f053a3a426dbb2143f24309ccaf3bda
SSDEEP 6144:QHETd7kc4Twxr97DK9ti5F7I3PoimK6TwrgEpCKmHiba2Sah4V765UWthgGnp0nK:QkThkWs+5uTrla2d5TAxcUhr/LY
TLSH
T1A0C47C7AEB555F2DC86602B6BABB02A2777C848CE396D94A7C0FF1783303515137A4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_concat_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll
Size 43KB
SHA256 cf865553c4818f08d061a8078729412ad1bfbbc1d9e3849a812319b1f9bd0b07
MD5 c40dff3814a14060dd2ede3c53d70e7d
SHA1 0b71a65184e596f7ee5d74a1fe36f455ab3e1452
SHA512 eb39055388a2b349c5f69f706c2bc08ffc0eb6a233da70e759efcc9524b666149d1bbd8fb71ca7e7b2bcaf43a2d3c503db5c1459d056ccafc47b226333bb7639
SSDEEP 768:cOShuj/f777777777777777777hvLxij45Yio6bLm/FW5Yio6bLwRGMb:YujJLAK7o6O/u7o64RGe
TLSH
T193138D473B10389DCF87C5B192F6C773A9B1F4A16E608AAE5138C2619FA0B817B3D15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_imem_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll
Size 72KB
SHA256 9b7ee72fce0798870e6fff4bdb15ef1c290c28ac031a9ffaedd26e6a5bb27ad3
MD5 4adaee9fa237e712a64383fa967c820f
SHA1 6759153030571279740fbefbfcf5d2b877e14845
SHA512 92e1a247fdada2e732b23225ad003a4f498e9071288fdb1e62ac036309d862fe50123051c01610ac50045c741ecd1cb306dc0630f01b45c49f32b746f88dc7c3
SSDEEP 768:o6RcsZIXnA2VOmGgIsZfreSuqquPW5e7/S1nnRoVr765Yio6bLOhdA5Yio6bLawK:bRbSrvGvSfrCqwe7/2EvY7o62y7o6Cx
TLSH
T1BF735B4BB69264ACC98FC47186F78B37FA71B8711920DB6E8E64C3342F14A503F5E259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_mms_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll
Size 105KB
SHA256 485a229ca4700ade774884b3b53a3441720e895f23eb692947f7f7971159ba84
MD5 eee7931849fb3fc9a795cf296355c439
SHA1 60f4da29975303453c1e2b84fa5a1fa6fb06bed7
SHA512 0364701ee9496319ea766a4834e3450984f7778653128484efd755947510bd33999ad2467b521db76c596115747c68cc4a0f5519a4a552bbc82e7bbb97da0b11
SSDEEP 1536:OJNLOgdB4f+Jm4Bj8GvSfrpqb7Gw5tgVH77o6e7o61:aO+yfCByfd6G0+Vbs6es61
TLSH
T1E1B37D53B26264ACCA9F817496D7A333FB71B86156307BBF5B64C2350E60E803F1A59C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_srt_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll
Size 4.1MB
SHA256 20a60921d809cebfeac1886e41f2cd58300c7cab3d2e1afd7f6bed69e5367415
MD5 f9c872641758bf85fa629c3231e60bed
SHA1 3185e232fb647e26678f94a48936444f22605a41
SHA512 e844fda9edaae4046df411624686552fd7067e61f4ed87fe9d09640e1f4462f22467550b9fbd8966b952b194614f2c8944d20ec1d0708e73b98278d853af02f7
SSDEEP 49152:tO4HzqfPuYHwMwuMbRhU1CU+qeBUeQgGtlqbWX7tyukE0frHoCIEr1mg6Sx5wQ0Z:JuPuYHwMpTZ+qDVP7wuk5O6OOfNAGyz
TLSH
T15A165B03E2A255DCC67BC2348753A333AA71BC655130BE6F5A94F7712E31EA05B2EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libaccess_wasapi_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll
Size 60KB
SHA256 9aae534511a1c8418f9f0a07f776912fb0ec69bb4d2de9ce8fd1172814d0627d
MD5 63afd860af6e20ad1c6afef2b1360dde
SHA1 5a094aa1806addf73a5f69db69392b3062ec0702
SHA512 3f8e18a6d6d37919103aaf230410f4f6f242bac54bcceb0e9e6c65e67d5fc2400c389cd6843a737b37bacb1957a13a5bb9371136bae21ec198af1de653e13923
SSDEEP 768:N13XjKRXxUwxsK7sv3BUKqk/hdLNOOFjZ5Yio6bLrlt5Yio6bLoA:HjwzGv6kT8sH7o6zJ7o6QA
TLSH
T14F536C4BB7113C9DDA13C07092EA87366D71FCA15A609ACE4138C3779D74F41BB1E229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libattachment_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll
Size 40KB
SHA256 a84c95cfc0231e52dc7ea6b5bd0813017f5abc71d67ea38cdc7b6ef1007a5b7a
MD5 73ec5e08012663ffcc716fc0fa964faa
SHA1 b85dbfcc682b016f351f7f4890eb25244cedc725
SHA512 87172571a3c55517e7ede03c8d3f4c34d956e1b614943aab24408cd332c728d6c77947653348e6c7a1c5ffbdd5730de8f2cf875e6adc01b2d052262071e53543
SSDEEP 384:6JCwJ0m57L/U6SBfcufN8+Bu+3HQIYizPoBWx7bLs1AwhhTwTQHQIYizPoBWx7b0:VwN8cE++/35Yio6bLG15Yio6bLno0G
TLSH
T11E138D876B607C59CE4BC8B0A2F5D737ECB1B4A12E208AAE1138C262CF547817F6D15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcdda_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll
Size 961KB
SHA256 dfa5523a0dd091429f826960f646303148fe293176647ddc8458b2303579dafc
MD5 1689fbf5544afaee1f019ca564d72e5c
SHA1 c6eb9e1dca1ce2640dd96c5579fdefa0ac2b0789
SHA512 32e0fc1de56a780a150b195edfda05688589a9469dbf18762860049ccee7308dc5ca8d5ce923ffd4ce6c0f7e6b007b4d27092a8a11be2d7c715d2ef752bfb9a3
SSDEEP 12288:PWSwwgzIjYGS2czPY4xs7xKfv5rdT5nwNUkr8LkxKpnQ+dBr/:PWSwnzYdncDYEs7xKfv5hx2T4FLdBr/
TLSH
T1BE254927F29290ECC56BC17447AAA373B570FC145670ADAF1694EB313E31E506B2E728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libdcp_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll
Size 2.6MB
SHA256 d52eaeb2f21cf714421c50f1f7f6afe04292fa09cd3b0d61cdaf795a62fdb841
MD5 833ef6c3b81d89c136013ff8dc6ec133
SHA1 7a776a7bc929a7ae64c132c212baa00c655070f4
SHA512 ace69e2a6c98b1f6cca84d4b7492136c458820ff0d371f5e8d771c2674277e98ba92d1a55b0636a984af22c3677091c8eb3f70a2dde7bf864acf783ac13f3505
SSDEEP 49152:2kf3VtsDdhwpT/iyiq9gVIsVx5o356F0miyiHP2axZlQZCTbav:gM35Im1QZEg
TLSH
T169C54B17E66350ECC26FC13487969B72B530F86951347A2F2A94D7322F21F609F2E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libdshow_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll
Size 901KB
SHA256 a12ca9d27e988d7321fb380b32ffcbc0645d97471c000375e5e2dfe2d66d2992
MD5 b4d100cb08953423042a011a05695b08
SHA1 294aba39226f3100ebbbfee9c8392a9595e86bce
SHA512 8d6b33c0f0e99b9f64b3975c2c02e64441987d4c4bac4f2f48fc151bd6b2482265d1afd4942bcab5c57bf230aeec48451f06a1c038f1c104b8c0609a28399056
SSDEEP 24576:8pICafvzLGGUYSRFR4q1U1sXQB111a111i111n111VL7:8pICanzLpUYSR/XE
TLSH
T1EE153B1BE7A345E9C56FC13487A79732AA31B8694234BE6F1E94C7231F10E509F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libdtv_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll
Size 885KB
SHA256 a6cf0b49bcf94454a994cfa24b121f54dd33833196f49ec0061f5fba8d351575
MD5 20e2cfe8b4a9fd91b7b2e4ca7246c2d9
SHA1 bb3bc2423f2540ba22dd7d176e18f39b6d3dfa26
SHA512 a67fb09762fd0b703a39b62f44db128a83ce1bae2b4a9e97a5e129f7f612c9f984185edf095769faa04b05e31674d409fe3d112f4bfdd9a7eaaca30ac4c6f3fd
SSDEEP 24576:EQ7ReF6CyxTJxcvsvm18o1N1ToPpFPinnnonnnOnnnFnnn+tq6:sF6CyBJxCsvmpohN
TLSH
T1D1151A1BE77355E9C56FC13087A79732BA30B8694234BA7E1E54C7222F11E609F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libdvdnav_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll
Size 281KB
SHA256 23d3a2c7de5c495b193672cb7b66920cece4fea8517271c03a72de3e9102c050
MD5 f93c2f98f200becab7638762fd23deb6
SHA1 99801e42ca1bfed3c0678ffb10bcf9ecc1829928
SHA512 7dd1e71b614b9d681e360a4f3a827769a2e7181c111451a3d1a2643fe094a1c1ec394f39af40ced54128885a32173e6c280a9f272cf1fe9810f784c29eb6ff26
SSDEEP 6144:JhcSnOt0QPwNxRalXK0SqzVUtXzcWhl+F:JhIt0VNxkEZQVUaWhl+F
TLSH
T189544B16F29364ECDA5BC1348396E632F872B8650330BD7E1B64C7753E15E206B2E66C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libdvdread_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll
Size 216KB
SHA256 0c17c6d629317626cd1fda87ef13b80122c2c1c82fcdbfe7f72af06f9c215287
MD5 c236d0ce4e1d931315256543165cede0
SHA1 beb58208b6df8ecb5eecf2c381a8d5bb3e353f4d
SHA512 42fb920588e80dd3bba4e4ac6f562637b804887258f978d09640564abe5134ba5c6d0b5c102d26cae73db4dc5325f39ec5eea931328d7d72c0be5db0e9532bbe
SSDEEP 3072:dDIKCJjL0jmKw/PMoPsF/L6TmHCf7LKma2JWJQABJQCuQ/jQhs6hs6L:xcVImKwDs96qHq/Kma2rAzQhCkPPL
TLSH
T157244A17F29368EDC96BC2304792E632B872BC560230BE7E5B60D7352E15E10B76D66C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfilesystem_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll
Size 69KB
SHA256 cd454978665b51c62cd553a02f09797cf0ec4f303d5afa1a040672f358ebc517
MD5 50edb09c576e30bcc58c0edf7a80875d
SHA1 c55189a8cb1ba41d1e34252fead7f94fc9d72774
SHA512 7acfa155699bef16c7380a88cebdec653aa9a2fdafee1fda77d60239543a2cb109b1f16524b0c9c666135e0518fdd5aaf2f183cbc91d94c801fc45dac4f3f00a
SSDEEP 768:zQRGpNum2U2VlmGlIsZfreSjqiuEuuA7uSaBfBUweHXkx95Yio6bLoi5Yio6bLBX:fevoGySfr3qi27ut2wLj7o6AA7o6H9
TLSH
T11C636C4BB792A4ECC94BC4B542E69773EE72FC6219209B6E1778C2341F50B543F1A26C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libftp_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll
Size 126KB
SHA256 23936c3e4db91be3826a3a28fd212f8150eccfbc5a1b4206392829d55cb53789
MD5 791e75007ed6d0584934bdafa94c7f0b
SHA1 a777f0b89ebb151d1f00c46b63a4c7c58a76c11f
SHA512 59f9fef019bfd91ce96a7c793b05d31fe1d32f4d14808e3b1b207c86035163c1a8777bd2e86c678a3d6eeb3d9f72ddb50626dd589c00f09d92e310bd8b674eee
SSDEEP 1536:lyEWthhoh5i2R7zjDy3F4ZCH0XGHSfrZqKe7eMdd6bp/icX4PNg9rB27o6637o65:xW0j+3FvHAfl+epbGVg9rgs6qs65
TLSH
T1ADC34B17F19A50ECC5AAC57083D7A333EA71B8A14930EEAF5BA4D6312E50E507E1D36C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libhttp_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll
Size 75KB
SHA256 f8f5b7937e6040f3556f8ff50c1adc0124f450a2ca853bbc60914e824a0bce00
MD5 45a09cc580ea694ebd4867c85764958e
SHA1 1b129c6627ec690b57023fe3d44a69439dada07f
SHA512 adb4f680c675398eb9e21a89972036bf2e29c4c804ed8123b5f045ed3714804faeb8bd735f07ee8c492202505634c4d6c9c859c7982854508883ae563cb79c18
SSDEEP 1536:///25o/wzMGGSfrwqY7LlT0i7o6juX7o6gL:u5n/fcjLlTTs6juXs6gL
TLSH
T19F737D5BB39224ACCA5BC57092E79B33EA71F8515A346FBF07A0D2351F40A813F1A56C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libhttps_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll
Size 157KB
SHA256 75813801fa069121218c2f0eec4536c183930a2d0307accd1e28fa23c71da518
MD5 d05157ccedad48b3ca95ea6cba41cd38
SHA1 ac78f48a2c831cd8c7d6f5bb84f29e5b97e28315
SHA512 ff448afc2d77ba959c7678385ccba28d8f980984850c4c0c671c76a418b8df4aa5d49b349e434f2658223219d7f4da44f1742eab50b73aa2ad8710d49b3ee258
SSDEEP 3072:znExRjAM+1wodNhMjlfgE1Dx5nqUf/eARDFHaVs6Cs69:znExbywob2jlfgE1DxgwTRhar69
TLSH
T19DF35B67E2A360FEC65BC17486D6A333F871B8211730ADAD5764E7312F20E507B1E668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libidummy_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll
Size 41KB
SHA256 87a5ffe3056cac0a12e51d66c682cadcbf6560f49c7e73fbd926aa6f31c0c4cb
MD5 410f9f4879f2d43b06501f20628dacf0
SHA1 45b01a6f7f3841a465fa24fc473c2c015779db56
SHA512 d8598c755ac7c23d06048b803ce6fd79e73f0ffec40a7add58c76bb04c3547c816ed05db546b4d87cdd5e93c755b74a2c9754b89c37d14813ee55176ad8a4884
SSDEEP 768:jOq/xOXlFb6qbr5Yio6bL+s05Yio6bLKh:aq/Urb6qp7o6ze7o62
TLSH
T144138D873E507898CE8BC8B0A1E9D737EDB1B4A11E508AAE513CC6A18F547817F1E15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libimem_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll
Size 40KB
SHA256 aab9aaf551e5fd91766abd17fad948b20756db1d8bb99fcaa37bc2234b0b6fe0
MD5 0447e80895d755d0540079a1ffed0dd4
SHA1 965bfd5b887d0f367ab2233ebd132876669b6ba6
SHA512 f13c8e360faf08e1351b610093a98862b844c05a3b678254ac2cd5642c6ff4de6c70cd21c1541e54c7666c8681798eb7f148405b2eee9cdc248a81558a62d9fb
SSDEEP 384:OMQGi7n4UyYiR4enjFKDW+Tu+sVHQIYizPoBWx7bLskE2eHQIYizPoBWx7bLsKUS:NQGfTnpKDW+lsZ5Yio6bLvU5Yio6bLL
TLSH
T188138EC76B50BC99CF47C9B0A2E5D737FCB1B4A21E608A9E0138C2A19F547817B2D19D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblibbluray_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll
Size 1.4MB
SHA256 5b4f74483e1cf4329ae2a5ad9a3ddb771306fc42c984a3e50e7f3e3dda4a448a
MD5 1e2d22f8898e97ad834f4a3a580cc87e
SHA1 d90fe1aea07be80807a7b1e232fe15c4beb772f9
SHA512 6a349465c8eba2ab7d227ef08473a45c911c34f0275a56aabfedf7e9ab1e607f03b6cbaca8574129678d605d85a4bc052b314cef0161c9835d693cdf228b254d
SSDEEP 24576:bo0cXI57Ie/hf1DUqMIxB5lZtVOlYELZmyLZcR/L:bvSchdDPM6lVOlYhyy
TLSH
T103655C17E2E324FCC66BC2304797E772B971B4241134BEBE1694DB312E51EA06B7D628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblive555_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll
Size 593KB
SHA256 c1b514d0946b47ac11866bed9da6b4e43786982694a101f1c7c31eb7fae569d4
MD5 d9ef9935edca90f7f28f4c4d0e1676cb
SHA1 11ccec65ebb06955ca4b670d1ad6ddedfd04b423
SHA512 8bf66b5d49fc2458942f78ea1e22224145a1de830fe3dc81bf260c56047ee90cad49c2f49e6e996c8a929bd3cd84a11c564434349e87cdaca20f023b0f61f67b
SSDEEP 6144:q6LNZ7/vqE9sxmsdnZwm0mSeu/GMuYYJbmE2rF1ejEQBGiZukLRczltu5FoS8l1+:z7qi2Zwm0x/5VA8Gv46Rc6D+zX2XGm
TLSH
T144D45A03E79259ECC56FC1308662D732BB32F8150238FB4E366D97222F15DA55F6E628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libnfs_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll
Size 312KB
SHA256 859a5db6c7ce377a434075f1a8af243ddbf1a832f1d705634a7bd887e08ed66a
MD5 db7ea01bd9617b5d8e1860ed3ac710be
SHA1 8277fad935f737fbee8a2c1108bf509ad72f7b51
SHA512 0cbded355ef8638e4c2d9303656aa6711ed0ceb71386a6a444d9c9b1f5435a143f8f34339bdccaf9f5108f328dfcd1fd8143526df4dca28ab473e6d195a3c182
SSDEEP 6144:cbn0slM8Q1o7Xs2ArZUd5nl1g/vqcGSuiEnP:cbn0P5ozj5nl2/ijxiEnP
TLSH
T1A1641927E69A34BDCA6B92308256D3727C71F464D314BC6F05A5C9382E18D607B7FA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

librist_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\librist_plugin.dll
Size 2.8MB
SHA256 be6a9ce1e392e112db9b32f439ae4844694eb7b58b10a69c21fd398b3f83caf3
MD5 af6b95e8f23d91cf7e11beb5a17b71de
SHA1 752e3411b072d0503f82c61e338b71d3df6a9ea6
SHA512 eded928bbb93494b57395c7ed0420f401bcf0d276d846483c75cd716817fd2edd5a5a52a4f78fb81655305ed14c86b3a0e04b77b1246bb86f02b835747aa4d1f
SSDEEP 49152:anBVIDcDCV+l7gbRLB7eLdrC6tGtlqyez+aWMsDdfO3YGFf9cwEAQXk2XAxOBQKB:anBVIDcDAh37e5/L5WMn9rOBFFHlky
TLSH
T1EAD57D03E1E365ECC67BC1308B53A373B962BC245570ED3B5A58FAB52E31DA01B5AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

librtp_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll
Size 836KB
SHA256 c86087751e670d169f1795f7cbacde4b2a47204eaa2e3a387f03db80001d91ed
MD5 4cb2fb13766a877568ce4b6f7902ea5a
SHA1 e89710faab6d21ccf3e83f4182c46b24305809be
SHA512 b950937ded42258e44e08d69c29527889d0b9506c104bae9137b71cf6241a6dbec5ce8813d437f690e36f3f62ed006e72b44556b7f9d51a814ca69efb793dda4
SSDEEP 12288:y0nH9tnrEvY4D9nGLUXo/5kuXo5GNbPMuhl2otRuwmUES:rdhrCYG9nGQo/5VsY7MFidZES
TLSH
T121057B23F652A0FCC66BC130479AA272B571FC255671BD6F2250EB313E31E506B2E729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugins.dat.3992

Path C:\Program Files\VideoLAN\VLC\plugins\plugins.dat.3992
Size 302KB
SHA256 f504fb28d38a740fbd579688e8506e3ebc885cfd07cdffc6ad7395d7f1fda344
MD5 808310720adfc3ba799ba8df960d74c5
SHA1 532e4ab9f188bb4e1bbb61cfe2c2cf780dd83c41
SHA512 552ea3dd429403e8664822d385f81a2b411b0d6e53f70817f3f9b8a6fe4b4b83fb33a46e2fa1622a4f5cc47a8a5d1573a15a5cb0ab5528e462ab980216468549
SSDEEP 3072:KSJyhlKLblCd1Z+CBg6pn6pkAMz73htM4vk9cAC48NJdNvHecCOBN9DStfgAQAp:KSJAlKLZlCBvn6+5tHevOBN9DSxp
TLSH
T16764F88333541662C462017965CB8B91737CFD96EE1513033AECF31C1DB6969AEB3A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.log

Path C:\Program Files\VideoLAN\VLC\uninstall.log
Size 21KB
SHA256 b169c99060454b6d0c8d0731d8391aeb77f177ee9f4c01e90aceacfd6071d7bb
MD5 11f5767031b95d133c572a3725e883b2
SHA1 d79603a8c44c9a009542f2c5d33f66f0292f8052
SHA512 057fc96c7b33d33f69c7dd7376d8610faa0ca887b863b9e96ca2839cf312165e698b3611d57279963975aad20721d61c0a3b6756b62d2a93ebaedb9631762e5e
SSDEEP 192:bijpJ1+imkLI/cnwpnGPJigp17k78m7L2FxmQVw0WAiCZ7XVIINaonICB6DfsZQr:Ok08EIcEuKP3
TLSH
T1F2A2DFAF92AC0C96B5BA5D8478CC6ED885CC27E72305C364827D88E87E47D3B16E7474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc-cache-gen.exe

Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
Size 143KB
SHA256 a99fdb166faac1cee604543836b3847b08ee461bf94933db60a0c6c1e1f63261
MD5 9aa1781fcb249d99eb75131e8dbe8130
SHA1 af9f302e793f16f4dd6becf5e7928de00e10335b
SHA512 27eb0086a384315da61eb40c423d72342180bcdbf1cb870ccfa4b8dd5894b1168bc54a0903f4e276d5c6a3afe6e77ea1baf0d52e2ffe8582471f4707ae70926c
SSDEEP 3072:O52YNyf1g76l2k9Hc3/nl6LAHkzI1UfgEA6IIyR8ts6Ds6y:z66Ahk96kADwhy
TLSH
T1EFE3C057B781A4AAC61F853CC1E78771AA70BC2109505B6F2268EF357F60F813F1A25D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecoveryStore.{60E82948-ADF4-11F1-A0C0-CEC2EF7024A5}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{60E82948-ADF4-11F1-A0C0-CEC2EF7024A5}.dat
Size 5KB
SHA256 6aecd6a70e94c0b30f0fc0d0846c1df63cd988166eab570aa880dfb866579cc0
MD5 a03ee6588d2b40edf5c95dd4ef5ee9e1
SHA1 68db8d4c6b021d8249502b9f0ca186bf362dd7ca
SHA512 240b3511c70929926be735ec22167d6753222153609bdf2559ddd866a3dd21965a2abb3919f9cc81cc3d1944b226abe64f55850fb2eda7b54865ed4100054335
SSDEEP 24:rHsGo/QaluRXRGW/OluRNluR8SluR69lWjlu9lfu9lWjlu9XI:rMGo4vGWZZalfvaXI
TLSH
T121C1F912F991C416E4514F72CDE2C5CCAA3AFE90BE55A64336A2339F4C373C1D9D2825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C252BF55-D67A-11F1-A0CB-FA79DB5CA436}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{C252BF55-D67A-11F1-A0CB-FA79DB5CA436}.dat
Size 4KB
SHA256 45d50fffabe27859836b6c8640b73300860434ef1edbbe42008003a7368932da
MD5 bd1c6240cf27c76a7674dd95d8655e88
SHA1 feedf81a7c28498abf0c4655d833899a838d6dee
SHA512 08af42f1edd4452614e897ee15abda778f2c7b9348e8e78050fa96b3fde6dac4eaa38290c2220714a4618d701f977f709340a45c66141fb4a17dfeb4751eadf0
SSDEEP 24:rSxG8G1maP9W9w9lIKV9lO1CKItM7a6ya:ryGWaPA9LKE1CKHu6P
TLSH
T18B91F515B6E0D602E7620FBACDF2C6856A37FE606D45E2077AB1732F1D37680D850122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn60C1.tmp\LangDLL.dll
Size 8KB
SHA256 2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
MD5 313661ec12ed5ce1fd0b3292bf02cb69
SHA1 fd341676cf680a9f0f690c35b43feadc0693e9a8
SHA512 a16f35c6019eb1431a3d03fb7d0935c272756f2a8363f541e168a55b2e20a85ee90191715c845ab0588eef8f2af6cf91ac75c5bf1a5d0c61c513339006da9ff2
SSDEEP 96:b0nLo47eYkrGj23kBTPEa8ir2qUuRkNB/RMZCabEO/2/HdNfdpX2N:KoZYkrGj20tEEeYkv/RaCA/2/9h2N
TLSH
T13402D6DEFF0959F5C83395344096F25FC51D7426CA3B0E46EE1B0629BA2A9FC2A0D206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn60C1.tmp\System.dll
Size 28KB
SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
MD5 81e34f1c4b04a15dbce200c52f598f67
SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
TLSH
T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn60C1.tmp\nsDialogs.dll
Size 14KB
SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
MD5 2726673c720a296442c8ed134b41d169
SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
TLSH
T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn60C1.tmp\nsExec.dll
Size 10KB
SHA256 0d7f702c518286a2d87db689af169c3857142324de4c9d76d51ebf639dced3df
MD5 e78bcd3208bff839e612041895bb8d42
SHA1 4b21b475b21d8f8bb2655d8e8e7d47548825831f
SHA512 eb38959a877d1af4ae53f25407ede3172f990f8c824624f5a2f385cddbd71a437b9033d45042a0e40f7fb611ff48836be166d97d42f3c169babb063ef48e8e35
SSDEEP 192:MItx8GSBYnUMu3Oad973Ykv/RGwC7ocJ4D4:bx8GOYnBu3Oad973YkvMwC7ocJ
TLSH
T12A22B8C9BA1579F5E0239838B18AF12F4D5D7C31DA2B840EE89A1E35B81F5E4571DB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn60C1.tmp\nsProcess.dll
Size 41KB
SHA256 9e847501ef87d2d8d0ed501b637c54b8d9f92cad2826bfe1cf583c63eb149c31
MD5 960fe00dc6a5576d7551c3ce48ca90d9
SHA1 cce96ca77b6d68066e20eadbde69c0c9622b6629
SHA512 fa6169ce59351c21fb547f58fb0669b4f2935e487dc3f50039f9e5e22ac4476c094e1fa07bd819788e382de4a9cb23792228483e16a9224fe0c1a620b95ec9d5
SSDEEP 768:vJs1L9Cn8JJC5Yio6bL7MTR5Yio6bL6gCx:xw9V87o6i7o6Cx
TLSH
T12C138D4BBE006C21EE435DF0A4C9CF7BDDB0B5528DA246E6BA2D8254FF557C27A0805E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc-3.0.24-win64.exe

Path C:\Users\Admin\AppData\Local\Temp\vlc-3.0.24-win64.exe
Size 44.1MB
SHA256 d711e1e1fe52052748c39080c7dce63f6b7e4c315efedf1774a3f1957b782ff3
MD5 0c7fe40451e8232beaee2c2af7bf03d5
SHA1 d32bc4d8189f9efb93836fd634d821ff091e0462
SHA512 81d7794891acfdf2cd3d1c99fa11a03dfd341bd2f8b716b05ca63f8696be95145d6ce04c9693e2c62ca878f06a59cd98bc0aaae0a51b63de48bef47212c8fae0
SSDEEP 786432:q/I20lusFWd8QXUx6NN3Z2dIYPSiGuxcxm90z27mVOfHUVeIZABt0PxwJxQyyOgz:vNJWd8mN386yxc6Y8tHQeIZABtQaJHyf
TLSH
T171A73310B6E45FBEFCB22A34FA45304655B6157F4BA1D00FDB9409EDBA63A72CB1018B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DF9FA6F353DDDDE7F5.TMP

Path C:\Users\Admin\AppData\Local\Temp\~DF9FA6F353DDDDE7F5.TMP
Size 16KB
SHA256 d72a4e0943f273d826545ec76087afe4f8a604faf3f82b3656ff6042e4047905
MD5 5915416a70861da1377f28cc574b7828
SHA1 91158d8bb94364479901a6f0c5beb20d29b3454b
SHA512 b89f5b1cfd19e064b32eb9a92b744e8f175d469fe21cb04a8f6c77963c32b053bedcbabc62a55874e4db5309b269306d10d70ce5861538d2a3fdbd62e0b46079
SSDEEP 3:c3fbAj6/VGb3AHgirilclllv/nt+lybltll1lRslnp+ll2llizAhG8f48A7:c3fbFdGzQgxUFAlp+lkazKG8fb
TLSH
T16F729B12F6CD4541CD52437175D70640ADBB7349227D4ED1376110A1F44235CEAC3F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 317B
SHA256 28d01ef0bc3f69f4d3bf835737a2141357281bcb5a98cd040b7c647873dd4cff
MD5 fc706c6325701d6dfe06f4c1c8de5c8b
SHA1 899a5f76e36d5a3730840437c6c0d0eeac5e288b
SHA512 4e95a800be2cf46ed8570d0acc10142477d1c2166a9a11bc03bcc6960057ec24119b23bedbd0719378cbbacbc6101956cc0caaa5ad8d8f65eb0f851b7e17ad28
TLSH
T16AE012536F75E3F9D33C41E179B89DF187F1405CC966113118DC0EE22D15A0364DB645
MD5 SHA1 SHA512 TLSH

Submit Download

ml.xspf

Path C:\Users\Admin\AppData\Roaming\vlc\ml.xspf
Size 312B
SHA256 c3e4cbc19fb8d31aac7c29015bca2b405baa48edbc70d8d351ac4a3a6200bc6c
MD5 8e3eac4267eec836634e0496a41796b8
SHA1 6bfc04823eeed4524e8826d007d3d2253b539a88
SHA512 3f4153decdfdfa445ab35fb68e4255d61d656189fc6756507e9a6433322cda44e8d23f80639353cb66a29ffe97f1304ca8cdadc5ee67c6211f30f4997263c0aa
TLSH
T1F7E0CD9C7088DC5047F1F513ABF9C4407B75A0495BE55595F6E326B385401B4FA32154
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 82B
SHA256 d538c7e9913d1feb639af7af8d4424af51d6faaed4fb743cd9e40f79984d4d7b
MD5 f38de0f2c7c8b87172c1a760cb18226a
SHA1 ef9bfdd580f266eb42c68d4d0cc4990d83233fd3
SHA512 7757300a2489fb5611a9ce666c9490813d150ecaaa9fe4e061d22e03659b9f5c5f9512ee6fbd7cab8ab248379fdbc0e980a43d8673a0f7f24d686d57cfd02b1a
TLSH
T195A012444054005B81C00057554DA10B2965E806546434D2A781D001004CD7205C1872
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 192B
SHA256 5649340f29d3cb3ee810a69203532eed241b5e616cdf59c383496d741949d525
MD5 097ef43a49eed2befef9d3fdf445483c
SHA1 2443771e9bdb4d0bf366754879f3ed5830d766e6
SHA512 1a7d22093ffe823e9453b723d6257186dfa75268a0a470e51267f7699190b227b6343c2ad0c9b578b53d0c265d280fc0686400ea66f981a35147de67ccf8c309
TLSH
T109C0234C40E0081F4145510F5265B1473963DC1974D4355273C5DD47314CEB109C5C70
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 138B
SHA256 7c8d397f1e503543d77554a8ea7ff00b68b0385afa490591e5cfbc6391fecf37
MD5 b7b23b7487daddd29215daaae6e13b83
SHA1 0f15b54fc65f7a9558e1468ed924f01da3ba7c06
SHA512 e5b9322e7b73a882a72a19e217578887605f4874800be6257d5b0713dbbd3974cc02c9c4bf5218685db9a4c71de7d6825b9247084783bf65b2879c9486e29afb
TLSH
T19BC02B0480A0042F9085154F54DDF2173827D80A74B47992638DCE86724CFB10DCAC35
MD5 SHA1 SHA512 TLSH

Submit Download

vlcrc.1668

Path C:\Users\Admin\AppData\Roaming\vlc\vlcrc.1668
Size 94KB
SHA256 f525195a2736efc32fc69de319e15189daf47e5adcaa8ade24f6fb02baf7dc86
MD5 7d1ab6787781aff89b9deab6672f3c5a
SHA1 5de4843803272740d26d4796a1dd1907ad503aa1
SHA512 6d4f5d433105f56e7aef4e686578725e3a30511b1afbb60e248fdc751c6c36fecd2cefb37003de241e9dc2cd53322fe4d608555c259e69534255de1955ecad29
SSDEEP 1536:pnxgRjAmji8yuQEh4BjOOJfSKRII+ZNsrmOqREjqgqi7q3zmIN5K9e9k:pnxQjAmji8PhKKOJfXRkZNsrmXREOgqo
TLSH
T14693839195F14EB6400388A77DD7F081FA2D240E7FEB2A20D79C7B4A02D67E746116EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe

Path \??\c:\program files\videolan\vlc\vlc.exe
Size 1.0MB
SHA256 63d0d02df6e466d642b824dc66be6b5a134bf98b26747ffac8ec0d879dc180d7
MD5 b38c68a38897a7284afba58b6364b6ff
SHA1 4f5381522dd890848ab7238cacdbbbd3e7bb38c6
SHA512 0a644bb5727360a7ed9d93dcfa659893625caf6dfa6d56e80e5e7b8b390cc9aac11529d2465d42dbb5529844b0e1ed9dd7e616d8a90fc4974c5aa8844b34fbb1
SSDEEP 24576:9uVB9Lg4SwDzEYr4+OL181iTzz3zzzzzzzzzzzzzczzzzzzzzzzzzczzczzbzzzE:9uVBpg4SyzEYrkTzz3zzzzzzzzzzzzzn
TLSH
T187253B1BE76349EDC66FC1348793C7726A30B86942347E6E1D94DB222F10E609F6E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1668-72-0x00007FFF81580000-0x00007FFF815B4000-memory.dmp

Download

memory/1668-91-0x00007FFF7F1B0000-0x00007FFF7F1C8000-memory.dmp

Download

memory/1668-74-0x00007FFF8ED60000-0x00007FFF8ED78000-memory.dmp

Download

memory/1668-76-0x00007FFF894F0000-0x00007FFF89501000-memory.dmp

Download

memory/1668-113-0x00007FFF7E6D0000-0x00007FFF7E7DE000-memory.dmp

Download

memory/1668-110-0x00007FFF81580000-0x00007FFF815B4000-memory.dmp

Download

memory/1668-112-0x00007FFF7F2C0000-0x00007FFF80370000-memory.dmp

Download

memory/1668-109-0x00007FF644B20000-0x00007FF644C18000-memory.dmp

Download

memory/1668-111-0x00007FFF80650000-0x00007FFF80906000-memory.dmp

Download

memory/1668-85-0x00007FFF7F270000-0x00007FFF7F288000-memory.dmp

Download

memory/1668-79-0x00007FFF805F0000-0x00007FFF8060D000-memory.dmp

Download

memory/1668-87-0x00007FFF7F230000-0x00007FFF7F241000-memory.dmp

Download

memory/1668-71-0x00007FF644B20000-0x00007FF644C18000-memory.dmp

Download

memory/1668-77-0x00007FFF80630000-0x00007FFF80647000-memory.dmp

Download

memory/1668-88-0x00007FFF7F210000-0x00007FFF7F221000-memory.dmp

Download

memory/1668-81-0x00007FFF803C0000-0x00007FFF805CB000-memory.dmp

Download

memory/1668-73-0x00007FFF80650000-0x00007FFF80906000-memory.dmp

Download

memory/1668-82-0x00007FFF80370000-0x00007FFF803B1000-memory.dmp

Download

memory/1668-75-0x00007FFF8B9F0000-0x00007FFF8BA07000-memory.dmp

Download

memory/1668-78-0x00007FFF80610000-0x00007FFF80621000-memory.dmp

Download

memory/1668-84-0x00007FFF7F290000-0x00007FFF7F2B1000-memory.dmp

Download

memory/1668-93-0x00007FFF7F110000-0x00007FFF7F177000-memory.dmp

Download

memory/1668-98-0x00007FFF7E6D0000-0x00007FFF7E7DE000-memory.dmp

Download

memory/1668-89-0x00007FFF7F1F0000-0x00007FFF7F20B000-memory.dmp

Download

memory/1668-90-0x00007FFF7F1D0000-0x00007FFF7F1E1000-memory.dmp

Download

memory/1668-97-0x00007FFF7EFE0000-0x00007FFF7F008000-memory.dmp

Download

memory/1668-96-0x00007FFF7F010000-0x00007FFF7F067000-memory.dmp

Download

memory/1668-95-0x00007FFF7F070000-0x00007FFF7F081000-memory.dmp

Download

memory/1668-94-0x0000019AA9B20000-0x0000019AA9B9C000-memory.dmp

Download

memory/1668-80-0x00007FFF805D0000-0x00007FFF805E1000-memory.dmp

Download

memory/1668-92-0x00007FFF7F180000-0x00007FFF7F1B0000-memory.dmp

Download

memory/1668-83-0x00007FFF7F2C0000-0x00007FFF80370000-memory.dmp

Download

memory/1668-86-0x00007FFF7F250000-0x00007FFF7F261000-memory.dmp

Download

memory/3892-163-0x00007FFF8EF50000-0x00007FFF8EF80000-memory.dmp

Download

memory/3892-150-0x00007FFF98E20000-0x00007FFF98E38000-memory.dmp

Download

memory/3892-153-0x00007FFF80440000-0x00007FFF8064B000-memory.dmp

Download

memory/3892-148-0x00007FFF98E40000-0x00007FFF98E74000-memory.dmp

Download

memory/3892-149-0x00007FFF80650000-0x00007FFF80906000-memory.dmp

Download

memory/3892-155-0x00007FFF8F0A0000-0x00007FFF8F0C1000-memory.dmp

Download

memory/3892-151-0x00007FFF96550000-0x00007FFF96567000-memory.dmp

Download

memory/3892-152-0x00007FFF8F710000-0x00007FFF8F721000-memory.dmp

Download

memory/3892-156-0x00007FFF8F080000-0x00007FFF8F098000-memory.dmp

Download

memory/3892-157-0x00007FFF8F060000-0x00007FFF8F071000-memory.dmp

Download

memory/3892-158-0x00007FFF8F040000-0x00007FFF8F051000-memory.dmp

Download

memory/3892-159-0x00007FFF8F020000-0x00007FFF8F031000-memory.dmp

Download

memory/3892-160-0x00007FFF8F000000-0x00007FFF8F01B000-memory.dmp

Download

memory/3892-147-0x00007FF644B20000-0x00007FF644C18000-memory.dmp

Download

memory/3892-161-0x00007FFF8EFA0000-0x00007FFF8EFB1000-memory.dmp

Download

memory/3892-162-0x00007FFF8EF80000-0x00007FFF8EF98000-memory.dmp

Download

memory/3892-164-0x00007FFF8EE40000-0x00007FFF8EEA7000-memory.dmp

Download

memory/3892-165-0x00007FFF81B00000-0x00007FFF81B7C000-memory.dmp

Download

memory/3892-166-0x00007FFF8EF30000-0x00007FFF8EF41000-memory.dmp

Download

memory/3892-154-0x00007FFF8F6C0000-0x00007FFF8F701000-memory.dmp

Download

memory/4208-56-0x00007FFF9FBF0000-0x00007FFF9FDE5000-memory.dmp

Download

memory/4208-11-0x00007FFF9FBF0000-0x00007FFF9FDE5000-memory.dmp

Download

memory/4208-53-0x00007FFF5FC70000-0x00007FFF5FC80000-memory.dmp

Download

memory/4208-54-0x00007FFF5FC70000-0x00007FFF5FC80000-memory.dmp

Download

memory/4208-55-0x00007FFF5FC70000-0x00007FFF5FC80000-memory.dmp

Download

memory/4208-52-0x00007FFF5FC70000-0x00007FFF5FC80000-memory.dmp

Download

memory/4208-44-0x00007FFF9FBF0000-0x00007FFF9FDE5000-memory.dmp

Download

memory/4208-14-0x00007FFF5D310000-0x00007FFF5D320000-memory.dmp

Download

memory/4208-13-0x00007FFF5D310000-0x00007FFF5D320000-memory.dmp

Download

memory/4208-7-0x00007FFF9FBF0000-0x00007FFF9FDE5000-memory.dmp

Download

memory/4208-8-0x00007FFF9FBF0000-0x00007FFF9FDE5000-memory.dmp

Download

memory/4208-0-0x00007FFF5FC70000-0x00007FFF5FC80000-memory.dmp

Download

memory/4208-10-0x00007FFF9FBF0000-0x00007FFF9FDE5000-memory.dmp

Download

memory/4208-12-0x00007FFF9FBF0000-0x00007FFF9FDE5000-memory.dmp

Download

memory/4208-9-0x00007FFF9FBF0000-0x00007FFF9FDE5000-memory.dmp

Download

memory/4208-6-0x00007FFF9FBF0000-0x00007FFF9FDE5000-memory.dmp

Download

memory/4208-5-0x00007FFF5FC70000-0x00007FFF5FC80000-memory.dmp

Download

memory/4208-4-0x00007FFF5FC70000-0x00007FFF5FC80000-memory.dmp

Download

memory/4208-1-0x00007FFF5FC70000-0x00007FFF5FC80000-memory.dmp

Download

memory/4208-2-0x00007FFF5FC70000-0x00007FFF5FC80000-memory.dmp

Download

memory/4208-3-0x00007FFF9FC8D000-0x00007FFF9FC8E000-memory.dmp

Download