File name:

check-update.exe

Full analysis: https://app.any.run/tasks/a91b9e5b-e880-45a3-9e74-11e308e697cc
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 08, 2023, 16:33:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6DAE4EBB66DC2A5B1F9D14B4AA8787BA

SHA1:

3F6457A81C8FC2EE47456C03AB28B55B7ADA13D7

SHA256:

BFC9F2E5D39F869702F7A080BE369699264CB82A65FF6C39C1F6951D294A8687

SSDEEP:

12288:cNnTT3AsoS22wwl/lLiItZUj4neHB5em3ske71M:cNnTTQsVxw+/lLiQjnenqM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to autorun other applications

      • ns5255.tmp (PID: 1280)
      • ns53E7.tmp (PID: 1840)

    • Changes the autorun value in the registry

      • vlc-updater.exe (PID: 3220)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • check-update.exe (PID: 3224)
      • udt.exe (PID: 3192)
      • vlc-setup-win32.exe (PID: 3940)
      • vlcplus-3.0.18-win32.exe (PID: 2960)
      • vlc-updater.exe (PID: 3220)

    • Reads the Internet Settings

      • udt.exe (PID: 3192)
      • check-update.exe (PID: 3224)
      • vlc-setup-win32.exe (PID: 3940)
      • vlcplus-3.0.18-win32.exe (PID: 2960)
      • explorer.exe (PID: 1800)
      • vlc.exe (PID: 3708)

    • Process requests binary or script from the Internet

      • udt.exe (PID: 3192)

    • Starts application with an unusual extension

      • vlc-setup-win32.exe (PID: 3940)
      • vlcplus-3.0.18-win32.exe (PID: 2960)
      • vlc-updater.exe (PID: 3220)

    • Executing commands from a ".bat" file

      • udt.exe (PID: 3192)

    • The process creates files with name similar to system file names

      • vlc-setup-win32.exe (PID: 3940)
      • vlcplus-3.0.18-win32.exe (PID: 2960)

    • Reads security settings of Internet Explorer

      • vlc-setup-win32.exe (PID: 3940)

    • Checks Windows Trust Settings

      • vlc-setup-win32.exe (PID: 3940)

    • Starts CMD.EXE for commands execution

      • udt.exe (PID: 3192)

    • Reads settings of System Certificates

      • vlc-setup-win32.exe (PID: 3940)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 3572)

    • Creates a software uninstall entry

      • vlc-updater.exe (PID: 3220)

  • INFO

    • The process checks LSA protection

      • check-update.exe (PID: 3224)
      • wmpnscfg.exe (PID: 3464)
      • udt.exe (PID: 3192)
      • vlc-setup-win32.exe (PID: 3940)
      • vlcplus-3.0.18-win32.exe (PID: 2960)
      • vlc-cache-gen.exe (PID: 1960)
      • explorer.exe (PID: 3572)
      • explorer.exe (PID: 1800)
      • vlc-updater.exe (PID: 3220)
      • vlc.exe (PID: 3708)

    • Create files in a temporary directory

      • check-update.exe (PID: 3224)
      • udt.exe (PID: 3192)
      • vlc-setup-win32.exe (PID: 3940)
      • vlcplus-3.0.18-win32.exe (PID: 2960)
      • iexplore.exe (PID: 2084)
      • vlc-updater.exe (PID: 3220)

    • Reads the computer name

      • check-update.exe (PID: 3224)
      • udt.exe (PID: 3192)
      • wmpnscfg.exe (PID: 3464)
      • vlc-setup-win32.exe (PID: 3940)
      • vlcplus-3.0.18-win32.exe (PID: 2960)
      • vlc-updater.exe (PID: 3220)
      • vlc.exe (PID: 3708)

    • Checks supported languages

      • check-update.exe (PID: 3224)
      • udt.exe (PID: 3192)
      • wmpnscfg.exe (PID: 3464)
      • vlc-setup-win32.exe (PID: 3940)
      • ns5255.tmp (PID: 1280)
      • vlcplus-3.0.18-win32.exe (PID: 2960)
      • ns2546.tmp (PID: 536)
      • vlc-cache-gen.exe (PID: 1960)
      • vlc-updater.exe (PID: 3220)
      • vlc.exe (PID: 3708)
      • ns53E7.tmp (PID: 1840)

    • Reads the machine GUID from the registry

      • udt.exe (PID: 3192)
      • wmpnscfg.exe (PID: 3464)
      • vlc-setup-win32.exe (PID: 3940)
      • vlc-cache-gen.exe (PID: 1960)
      • vlcplus-3.0.18-win32.exe (PID: 2960)
      • vlc.exe (PID: 3708)
      • vlc-updater.exe (PID: 3220)

    • Creates files or folders in the user directory

      • udt.exe (PID: 3192)
      • vlc-setup-win32.exe (PID: 3940)

    • Checks proxy server information

      • udt.exe (PID: 3192)
      • vlc-setup-win32.exe (PID: 3940)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3464)

    • Creates files in the program directory

      • vlc-cache-gen.exe (PID: 1960)
      • vlcplus-3.0.18-win32.exe (PID: 2960)

    • Application launched itself

      • iexplore.exe (PID: 2084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

Comments: Updater
ProductName: Updater
CompanyName: Aller Media e.K.
ProductVersion: 1,0
OriginalFileName: Setup.EXE
LegalCopyright: Aller Media e.K.
FileVersion: 2. 4. 500. 0
FileDescription: Updater
CharacterSet: Unicode
LanguageCode: German
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 2.7.0.0
FileVersionNumber: 2.4.500.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x80b6
UninitializedDataSize: -
InitializedDataSize: 225280
CodeSize: 32768
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2015:08:21 14:30:02+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 21-Aug-2015 14:30:02
Detected languages:
  • German - Germany
  • Process Default Language
FileDescription: Updater
FileVersion: 2. 4. 500. 0
LegalCopyright: Aller Media e.K.
OriginalFilename: Setup.EXE
ProductVersion: 1,0
CompanyName: Aller Media e.K.
ProductName: Updater
Comments: Updater

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 21-Aug-2015 14:30:02
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000752A
0x00008000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.29454
.rdata
0x00009000
0x0000478C
0x00005000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.33624
.data
0x0000E000
0x00000ABC
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.093482
.rsrc
0x0000F000
0x00030F78
0x00031000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.56017

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.10134
787
Latin 1 / Western European
German - Germany
RT_MANIFEST
128
3.55604
132
Latin 1 / Western European
Process Default Language
RT_GROUP_ICON
1000
7.97649
34144
Latin 1 / Western European
UNKNOWN
RT_ICON
1001
4.71111
67624
Latin 1 / Western European
UNKNOWN
RT_ICON
1002
4.5265
38056
Latin 1 / Western European
UNKNOWN
RT_ICON
1003
4.76846
21640
Latin 1 / Western European
UNKNOWN
RT_ICON
1004
4.82704
16936
Latin 1 / Western European
UNKNOWN
RT_ICON
1005
4.71749
9640
Latin 1 / Western European
UNKNOWN
RT_ICON
1006
5.0156
4264
Latin 1 / Western European
UNKNOWN
RT_ICON
1007
5.19109
2440
Latin 1 / Western European
UNKNOWN
RT_ICON

Imports

KERNEL32.dll
MFC42.DLL
MSVCRT.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
21
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start check-update.exe udt.exe wmpnscfg.exe no specs vlc-setup-win32.exe ns5255.tmp schtasks.exe no specs cmd.exe no specs vlcplus-3.0.18-win32.exe no specs vlcplus-3.0.18-win32.exe iexplore.exe iexplore.exe ns2546.tmp no specs vlc-cache-gen.exe explorer.exe no specs explorer.exe no specs vlc-updater.exe iexplore.exe vlc.exe ns53e7.tmp schtasks.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Users\admin\AppData\Local\Temp\nswB778.tmp\ns2546.tmp" "C:\Program Files\VLC Plus Player\vlc-cache-gen.exe" C:\Program Files\VLC Plus Player\pluginsC:\Users\admin\AppData\Local\Temp\nswB778.tmp\ns2546.tmp—vlcplus-3.0.18-win32.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nswb778.tmp\ns2546.tmp
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
536"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2084 CREDAT:3347727 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1280"C:\Users\admin\AppData\Local\Temp\nsc4861.tmp\ns5255.tmp" "schtasks.exe" /create /tn "VLC Plus Player (x86) Updater" /tr "C:\Users\admin\AppData\Local\VLC Plus Player (x86) Updater\Updater.exe" /rl HIGHEST /sc onlogon /fC:\Users\admin\AppData\Local\Temp\nsc4861.tmp\ns5255.tmp
vlc-setup-win32.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\nsc4861.tmp\ns5255.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1596"schtasks.exe" /create /tn "VLC Plus Player (x86) Updater" /tr "C:\Users\admin\AppData\Local\VLC Plus Player (x86) Updater\Updater.exe" /rl HIGHEST /sc onlogon /fC:\Windows\System32\schtasks.exe—ns53E7.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\schtasks.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
1800C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1840"C:\Users\admin\AppData\Local\Temp\nsx53C6.tmp\ns53E7.tmp" "schtasks.exe" /create /tn "VLC Plus Player (x86) Updater" /tr "C:\Users\admin\AppData\Local\VLC Plus Player (x86) Updater\Updater.exe" /rl HIGHEST /sc onlogon /fC:\Users\admin\AppData\Local\Temp\nsx53C6.tmp\ns53E7.tmp
vlc-updater.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsx53c6.tmp\ns53e7.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1960"C:\Program Files\VLC Plus Player\vlc-cache-gen.exe" C:\Program Files\VLC Plus Player\pluginsC:\Program Files\VLC Plus Player\vlc-cache-gen.exe
ns2546.tmp
User:
admin
Company:
VideoLAN
Integrity Level:
HIGH
Description:
VLC media player
Exit code:
0
Version:
3.0.18
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\vlc plus player\vlc-cache-gen.exe
c:\program files\vlc plus player\libvlc.dll
c:\program files\vlc plus player\libvlccore.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\advapi32.dll
2084"C:\Program Files\Internet Explorer\iexplore.exe" https://www.vlc.de/ok/?id=_install_udt_ok.C:\Program Files\Internet Explorer\iexplore.exe
vlc-setup-win32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2116"C:\Users\admin\AppData\Local\Temp\vlcplus-3.0.18-win32.exe" C:\Users\admin\AppData\Local\Temp\vlcplus-3.0.18-win32.exe—vlc-setup-win32.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\vlcplus-3.0.18-win32.exe
c:\windows\system32\ntdll.dll
2336"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2084 CREDAT:2954505 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
106 278
Read events
103 972
Write events
2 130
Delete events
176

Modification events

(PID) Process:(3224) check-update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3224) check-update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3224) check-update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3224) check-update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3192) udt.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3192) udt.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3192) udt.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3192) udt.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3192) udt.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3192) udt.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
790
Suspicious files
140
Text files
276
Unknown types
200

Dropped files

PID
Process
Filename
Type
3192udt.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\vlc-setup-win32[1].exeexecutable
MD5:322C08209115EBDA64617CB8350EB21E
SHA256:2B629AE280D6E29875627721C10F6CC84FDBA3A31B63BFABA127EBE00DBCCDA0
3192udt.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\version[1].xmlxml
MD5:0E99B5132CC788BB4ADD03DFA9B4480F
SHA256:6BBF4E8547E3F87DDAADB4A830B99371D8EE7DC01151C8A0819338124F282185
3224check-update.exeC:\Users\admin\AppData\Local\Temp\UDT-FBDHAGGAGAKGNHGBNHCA0\udt.exeexecutable
MD5:5B1E449FBBA833D603725B82F49E26A8
SHA256:7FB83AEDD630DE1E0C4A766837B85ACD65A1B61C6A6F66ED2583CAAB318ECCCC
3224check-update.exeC:\Users\admin\AppData\Local\Temp\UDT-FBDHAGGAGAKGNHGBNHCA0\A2xml
MD5:AE6A394FCD53586B0875F4B40CC511BC
SHA256:2264ACAC265E8EEF34A7D37E18292A1550AB346FDFCC9F5A262E6A2C59AC4CD6
3224check-update.exeC:\Users\admin\AppData\Local\Temp\UDT-FBDHAGGAGAKGNHGBNHCA0\udt.exe.manifestxml
MD5:AE6A394FCD53586B0875F4B40CC511BC
SHA256:2264ACAC265E8EEF34A7D37E18292A1550AB346FDFCC9F5A262E6A2C59AC4CD6
3224check-update.exeC:\Users\admin\AppData\Local\Temp\UDT-FBDHAGGAGAKGNHGBNHCA0\A0executable
MD5:5B1E449FBBA833D603725B82F49E26A8
SHA256:7FB83AEDD630DE1E0C4A766837B85ACD65A1B61C6A6F66ED2583CAAB318ECCCC
3224check-update.exeC:\Users\admin\AppData\Local\Temp\UDT-FBDHAGGAGAKGNHGBNHCA0\A5executable
MD5:C0B8010D872F15C1FF0CA8063600BC9D
SHA256:2F5296C5FCC67F78CEE6EADB1D87201772602F94216D19F857140E51E2F691FF
3192udt.exeC:\Users\admin\AppData\Local\Temp\UDT-FBDHAGGAGAKGNHGBNHCA0\E17_Version\vlc-setup-win32.exeexecutable
MD5:322C08209115EBDA64617CB8350EB21E
SHA256:2B629AE280D6E29875627721C10F6CC84FDBA3A31B63BFABA127EBE00DBCCDA0
3940vlc-setup-win32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\vlcplus-3.0.18-win32[1].exe —
MD5:—
SHA256:—
3940vlc-setup-win32.exeC:\Users\admin\AppData\Local\Temp\vlcplus-3.0.18-win32.exe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
54
DNS requests
21
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3192
udt.exe
GET
—
87.230.43.108:80
http://update.am.de//version.xml
DE
—
—
whitelisted
3192
udt.exe
GET
—
87.230.43.108:80
http://update.am.de/vlc-setup-win32.exe
DE
—
—
whitelisted
3192
udt.exe
GET
200
87.230.43.108:80
http://update.am.de//version.xml
DE
xml
4.63 Kb
whitelisted
3192
udt.exe
GET
200
87.230.43.108:80
http://update.am.de/vlc-setup-win32.exe
DE
executable
205 Kb
whitelisted
3940
vlc-setup-win32.exe
GET
200
87.230.43.108:80
http://www.vlc.de/install/setup_x86.txt
DE
text
84 b
suspicious
3940
vlc-setup-win32.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEH1NQqkrQx1%2BZFPnwZqNWHc%3D
US
der
1.41 Kb
whitelisted
3940
vlc-setup-win32.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b59077b7409d5bf0
US
compressed
4.70 Kb
whitelisted
3396
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/alphasslcasha256g4/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSPdwLcDiHQXlVfp8h37hrpMerTggQUT8usqMLvq92Db2u%2Fzpg9XFgldhUCDAdhS7KCW2gWElDQKQ%3D%3D
US
der
1.40 Kb
whitelisted
3396
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ5rEWLwbJFq%2FmAU80sm7E%3D
US
der
471 b
whitelisted
3192
udt.exe
GET
200
87.230.43.108:80
http://update.am.de//version.xml
DE
xml
4.63 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3940
vlc-setup-win32.exe
151.139.128.10:443
files.vlc.de
STACKPATH-CDN
US
malicious
—
—
87.230.43.108:80
update.am.de
Host Europe GmbH
DE
suspicious
3192
udt.exe
87.230.43.108:80
update.am.de
Host Europe GmbH
DE
suspicious
3940
vlc-setup-win32.exe
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
2084
iexplore.exe
92.123.104.64:443
www.bing.com
Akamai International B.V.
DE
suspicious
2084
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3396
iexplore.exe
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
3396
iexplore.exe
23.88.90.4:443
www.counter.info
Hetzner Online GmbH
DE
unknown
3396
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2084
iexplore.exe
87.230.43.108:443
update.am.de
Host Europe GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
update.am.de
  • 87.230.43.108
whitelisted
www.vlc.de
  • 87.230.43.108
suspicious
files.vlc.de
  • 151.139.128.10
malicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 92.123.104.64
  • 92.123.104.66
  • 92.123.104.61
  • 92.123.104.5
  • 92.123.104.7
  • 92.123.104.54
  • 92.123.104.53
  • 92.123.104.63
  • 92.123.104.57
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.counter.info
  • 23.88.90.4
suspicious
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
3192
udt.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2 ETPRO signatures available at the full report
Process
Message
vlc-cache-gen.exe
main libvlc debug: VLC media player - 3.0.18 Vetinari
vlc-cache-gen.exe
main libvlc debug: Copyright © 1996-2022 the VideoLAN team
vlc-cache-gen.exe
main libvlc debug: revision 3.0.18-0-ge9eceaed4d
vlc-cache-gen.exe
main libvlc debug: configured with /win64/vlc-3.0.18/extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-shout' '--enable-goom' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--with-contrib=../contrib/i686-w64-mingw32' '--enable-qt' '--enable-skins2' '--enable-dvdread' '--enable-caca' 'host_alias=i686-w64-mingw32' 'CFLAGS= ' 'CXXFLAGS= ' 'PKG_CONFIG=pkg-config' 'PKG_CONFIG_LIBDIR=/usr/i686-w64-mingw32/lib/pkgconfig:/usr/lib/i686-w64-mingw32/pkgconfig'
vlc-cache-gen.exe
main libvlc debug: VLC media player - 3.0.18 Vetinari
vlc-cache-gen.exe
main libvlc debug: Copyright © 1996-2022 the VideoLAN team
vlc-cache-gen.exe
main libvlc debug: revision 3.0.18-0-ge9eceaed4d
vlc-cache-gen.exe
main libvlc debug: configured with /win64/vlc-3.0.18/extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-shout' '--enable-goom' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--with-contrib=../contrib/i686-w64-mingw32' '--enable-qt' '--enable-skins2' '--enable-dvdread' '--enable-caca' 'host_alias=i686-w64-mingw32' 'CFLAGS= ' 'CXXFLAGS= ' 'PKG_CONFIG=pkg-config' 'PKG_CONFIG_LIBDIR=/usr/i686-w64-mingw32/lib/pkgconfig:/usr/lib/i686-w64-mingw32/pkgconfig'
vlc-cache-gen.exe
main libvlc debug: using multimedia timers as clock source
vlc-cache-gen.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
check-update.exe