File name:

vlc-3.0.21-win64.exe

Full analysis: https://app.any.run/tasks/ed003704-66c0-4067-9eae-e1548af55721
Verdict: Malicious activity
Analysis date: September 27, 2024, 17:24:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
MD5:

A6F92AFFB6CE711F9F5048410CB4BC32

SHA1:

80D994FB95087EFCE34AEB4A98C8F4D7D2A035A6

SHA256:

9742689A50E96DDC04D80CEFF046B28DA2BEEFD617BE18166F8C5E715EC60C59

SSDEEP:

393216:60D8jG0ZIpp/kAuk6sQdyHhTCXw/GLbINLLPoD:Hw6sAZ6sQdJg/GLbINLLPoD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • vlc-3.0.21-win64.exe (PID: 2244)

  • SUSPICIOUS

    • Searches for installed software

      • vlc-3.0.21-win64.exe (PID: 2244)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • vlc-3.0.21-win64.exe (PID: 2244)

    • The process creates files with name similar to system file names

      • vlc-3.0.21-win64.exe (PID: 2244)

    • Executable content was dropped or overwritten

      • vlc-3.0.21-win64.exe (PID: 2244)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 2036)

  • INFO

    • Checks supported languages

      • vlc-3.0.21-win64.exe (PID: 2244)
      • vlc-cache-gen.exe (PID: 3528)

    • Create files in a temporary directory

      • vlc-3.0.21-win64.exe (PID: 2244)

    • Reads the computer name

      • vlc-3.0.21-win64.exe (PID: 2244)

    • Creates files in the program directory

      • vlc-3.0.21-win64.exe (PID: 2244)

    • Reads the machine GUID from the registry

      • vlc-cache-gen.exe (PID: 3528)

    • Sends debugging messages

      • vlc-cache-gen.exe (PID: 3528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:29 12:07:21+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.42
CodeSize: 37888
InitializedDataSize: 61952
UninitializedDataSize: 129024
EntryPoint: 0x45a4
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vlc-3.0.21-win64.exe vlc-cache-gen.exe conhost.exe no specs regsvr32.exe no specs regsvr32.exe no specs explorer.exe no specs explorer.exe no specs vlc.exe vlc-3.0.21-win64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
488"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\VideoLAN\VLC\axvlc.dll"C:\Windows\SysWOW64\regsvr32.exe—vlc-3.0.21-win64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2020"C:\Program Files\VideoLAN\VLC\vlc.exe" C:\Program Files\VideoLAN\VLC\vlc.exe
explorer.exe
User:
admin
Company:
VideoLAN
Integrity Level:
MEDIUM
Description:
VLC media player
Version:
3.0.21
Modules
Images
c:\program files\videolan\vlc\vlc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\program files\videolan\vlc\libvlc.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\videolan\vlc\libvlccore.dll
2036"C:\WINDOWS\explorer.exe" "C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Windows\explorer.exe—vlc-3.0.21-win64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
2244"C:\Users\admin\Desktop\vlc-3.0.21-win64.exe" C:\Users\admin\Desktop\vlc-3.0.21-win64.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\vlc-3.0.21-win64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3528"C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe" C:\Program Files\VideoLAN\VLC\pluginsC:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
vlc-3.0.21-win64.exe
User:
admin
Company:
VideoLAN
Integrity Level:
HIGH
Description:
VLC media player
Exit code:
0
Version:
3.0.21
Modules
Images
c:\program files\videolan\vlc\vlc-cache-gen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\program files\videolan\vlc\libvlc.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4892C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\twinapi.dll
c:\windows\system32\oleaut32.dll
5196"C:\Users\admin\Desktop\vlc-3.0.21-win64.exe" C:\Users\admin\Desktop\vlc-3.0.21-win64.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\vlc-3.0.21-win64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5740 /s "C:\Program Files\VideoLAN\VLC\axvlc.dll"C:\Windows\System32\regsvr32.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—vlc-cache-gen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
12 772
Read events
11 666
Write events
992
Delete events
114

Modification events

(PID) Process:(2244) vlc-3.0.21-win64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\vlc.exe
Operation:writeName:FriendlyAppName
Value:
VLC media player
(PID) Process:(2244) vlc-3.0.21-win64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VLC.3ga\shell\Open
Operation:writeName:MultiSelectModel
Value:
Player
(PID) Process:(2244) vlc-3.0.21-win64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\vlc.exe\SupportedTypes
Operation:writeName:10160232
Value:
(PID) Process:(2244) vlc-3.0.21-win64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VLC.669\shell\Open
Operation:writeName:MultiSelectModel
Value:
Player
(PID) Process:(2244) vlc-3.0.21-win64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VLC.a52\shell\Open
Operation:writeName:MultiSelectModel
Value:
Player
(PID) Process:(2244) vlc-3.0.21-win64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VLC.aac\shell\Open
Operation:writeName:MultiSelectModel
Value:
Player
(PID) Process:(2244) vlc-3.0.21-win64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VLC.ac3\shell\Open
Operation:writeName:MultiSelectModel
Value:
Player
(PID) Process:(2244) vlc-3.0.21-win64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VLC.adt\shell\Open
Operation:writeName:MultiSelectModel
Value:
Player
(PID) Process:(2244) vlc-3.0.21-win64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VLC.adts\shell\Open
Operation:writeName:MultiSelectModel
Value:
Player
(PID) Process:(2244) vlc-3.0.21-win64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VLC.aif\shell\Open
Operation:writeName:MultiSelectModel
Value:
Player
Executable files
378
Suspicious files
156
Text files
69
Unknown types
0

Dropped files

PID
Process
Filename
Type
2244vlc-3.0.21-win64.exeC:\Program Files\VideoLAN\VLC\vlc.exeexecutable
MD5:F9538485432D3EC640F89096BA2D4D00
SHA256:5D695D8A0BB1D919CC77A2AA2488A61797BFA065238160278EE458120630AAF9
2244vlc-3.0.21-win64.exeC:\Users\admin\AppData\Local\Temp\nsu92F8.tmp\nsProcess.dllexecutable
MD5:391F1B7C2BA6CC753CC300EB0B3C522F
SHA256:72D4EC8A496C7057F676BB6C0D3AE872F22FA88EFE2AACED163EE1F429534DDE
2244vlc-3.0.21-win64.exeC:\Users\admin\AppData\Local\Temp\nsu92F8.tmp\System.dllexecutable
MD5:4A82832A6209CDC3A2447AB2DE137542
SHA256:B07A12C5CED6A1ECE5E7DC4103F8B3E15BF77F5EDB70DAEF115B9A77BCF55885
2244vlc-3.0.21-win64.exeC:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dllexecutable
MD5:3129A88916039FB124F4856C4DCD299D
SHA256:6F6F559EF8D2159307D0AE995994240137CC3CE57C0F92EAE2E523AA59E552D3
2244vlc-3.0.21-win64.exeC:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dllexecutable
MD5:F36632E140E822CBBD8FFFF07B877F3A
SHA256:7444230B516A10D1DE8B8CCF1A0A987738C866A738056D85322D4427B9F86B30
2244vlc-3.0.21-win64.exeC:\Program Files\VideoLAN\VLC\COPYING.txttext
MD5:FFA10F40B98BE2C2BC9608F56827ED23
SHA256:189B1AF95D661151E054CEA10C91B3D754E4DE4D3FECFB074C1FB29476F7167B
2244vlc-3.0.21-win64.exeC:\Program Files\VideoLAN\VLC\libvlc.dllexecutable
MD5:264A9E0194DBD3C0540D67B156ECAABA
SHA256:095D164633AF53AC015DCD76540E8523744F57D506DB111F19B3FDD9D6180833
2244vlc-3.0.21-win64.exeC:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dllexecutable
MD5:D2F439934A462A8DE976A301FB101E4A
SHA256:3C150257A94F533E55B6D3383A7D14D4F5B6D67CBD9D921A5EA95CE313438AEB
2244vlc-3.0.21-win64.exeC:\Program Files\VideoLAN\VLC\README.txttext
MD5:A843F0E99AFB4FA6D987563043FFE3F2
SHA256:56951348F503A7CD9A635C36E0EA4FF8DF3DDA3FBEC41512885D5671ECF5C64A
2244vlc-3.0.21-win64.exeC:\Program Files\VideoLAN\VLC\axvlc.dllexecutable
MD5:76C37511EF2E97250CFB0142A114954F
SHA256:EE55B5CA4494DAE67E5328128587829E1417E732D0F76858B473C834D5306419
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
27
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.50.73.9:443
https://browser.pipe.aria.microsoft.com/Collector/3.0/?qsp=true&content-type=application%2Fbond-compact-binary&client-id=NO_AUTH&sdk-version=AWT-Web-CJS-1.2.0&x-apikey=33d70a864599496b982a39f036f71122-2064703e-3a9d-4d90-8362-eec08dffe8e8-7176
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
8
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
20.50.73.9:443
browser.pipe.aria.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.142
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
browser.pipe.aria.microsoft.com
  • 20.50.73.9
whitelisted

Threats

No threats detected
Process
Message
vlc-cache-gen.exe
main libvlc debug: VLC media player - 3.0.21 Vetinari
vlc-cache-gen.exe
main libvlc debug: Copyright © 1996-2024 the VideoLAN team
vlc-cache-gen.exe
main libvlc debug: revision 3.0.21-1-0-g9c4768291e
vlc-cache-gen.exe
main libvlc debug: configured with /builds/videolan/vlc/extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-shout' '--enable-goom' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=x86_64-w64-mingw32' '--with-contrib=../contrib/x86_64-w64-mingw32' '--with-breakpad=https://win.crashes.videolan.org' '--enable-qt' '--enable-skins2' '--enable-dvdread' '--enable-caca' 'host_alias=x86_64-w64-mingw32' 'CFLAGS= -D_WIN32_WINNT=0x0502 -DWINVER=0x502 -D__MSVCRT_VERSION__=0x700 ' 'CXXFLAGS= -D_WIN32_WINNT=0x0502 -DWINVER=0x502 -D__MSVCRT_VERSION__=0x700 ' 'PKG_CONFIG=pkg-config' 'PKG_CONFIG_LIBDIR=/usr/x86_64-w64-mingw32/lib/pkgconfig:/usr/lib/x86_64-w64-mingw32/pkgconfig'
vlc-cache-gen.exe
main libvlc debug: using multimedia timers as clock source
vlc-cache-gen.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
vlc-cache-gen.exe
main libvlc debug: searching plug-in modules
vlc-cache-gen.exe
main libvlc debug: ignoring plugins cache file
vlc-cache-gen.exe
main libvlc debug: recursively browsing `C:\Program Files\VideoLAN\VLC\plugins'
vlc-cache-gen.exe
main libvlc debug: saving plugins cache C:\Program Files\VideoLAN\VLC\plugins\plugins.dat
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vlc-3.0.21-win64.exe