download:

/download/5kplayer-setup.exe

Full analysis: https://app.any.run/tasks/9c3709fd-c83d-46de-9e6d-40aca957f4f7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 15, 2024, 13:57:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
opendir
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0CB8A509B925197BD4B94B4C835C8DB9

SHA1:

B741C00855307AA3A8A3C52C651C2C8D969A4F78

SHA256:

02B4B6CD3A3A78CC764CB0AD573A9BCE3AB0F1681D5E6926C9501E0EBCD7BBBB

SSDEEP:

98304:9kaELUIVkgx1xdcKfAhtsZetTHlIcULI7dtki632QxILe2XHDUD0SBmolhU3OzfW:5pWO/kKi/yASXRfL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • FileRelation.exe (PID: 5284)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • 5kp.exe (PID: 6660)
      • 5kplayer-setup.exe (PID: 6496)
      • 5kplayer.exe (PID: 4592)

    • Drops 7-zip archiver for unpacking

      • 5kplayer-setup.exe (PID: 6496)
      • 5kplayer.exe (PID: 4592)

    • Executable content was dropped or overwritten

      • 5kplayer-setup.exe (PID: 6496)
      • 5kplayer.exe (PID: 4592)

    • There is functionality for taking screenshot (YARA)

      • 5kp.exe (PID: 6660)
      • 5KPlayer.exe (PID: 6832)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 5kplayer.exe (PID: 4592)

    • The process creates files with name similar to system file names

      • 5kplayer.exe (PID: 4592)

    • Potential Corporate Privacy Violation

      • 5kp.exe (PID: 6660)

    • Process drops python dynamic module

      • 5kplayer.exe (PID: 4592)

    • Process drops legitimate windows executable

      • 5kplayer.exe (PID: 4592)

    • Reads security settings of Internet Explorer

      • 5kplayer.exe (PID: 4592)
      • 5KPlayer.exe (PID: 6832)

    • Reads the date of Windows installation

      • 5kplayer.exe (PID: 4592)

    • The process drops C-runtime libraries

      • 5kplayer.exe (PID: 4592)

    • Creates a software uninstall entry

      • 5kplayer.exe (PID: 4592)

  • INFO

    • Creates files or folders in the user directory

      • 5kp.exe (PID: 6660)
      • 5kplayer.exe (PID: 4592)
      • FileRelation.exe (PID: 5284)
      • 5KPlayer.exe (PID: 6832)

    • Reads the computer name

      • 5kp.exe (PID: 6660)
      • 5kplayer.exe (PID: 4592)
      • identity_helper.exe (PID: 812)
      • 5KPlayer.exe (PID: 6832)
      • identity_helper.exe (PID: 3376)
      • TextInputHost.exe (PID: 1436)

    • Create files in a temporary directory

      • 5kplayer-setup.exe (PID: 6496)
      • 5kp.exe (PID: 6660)
      • 5kplayer.exe (PID: 4592)
      • 5KPlayer.exe (PID: 6832)

    • Checks supported languages

      • 5kplayer-setup.exe (PID: 6496)
      • 5kp.exe (PID: 6660)
      • 5kplayer.exe (PID: 4592)
      • FileRelation.exe (PID: 5284)
      • 5KPlayer.exe (PID: 6832)
      • identity_helper.exe (PID: 812)
      • identity_helper.exe (PID: 3376)
      • TextInputHost.exe (PID: 1436)

    • Reads the machine GUID from the registry

      • 5kp.exe (PID: 6660)
      • 5KPlayer.exe (PID: 6832)

    • Creates files in the program directory

      • 5kplayer.exe (PID: 4592)

    • Process checks computer location settings

      • 5kplayer.exe (PID: 4592)

    • Reads Microsoft Office registry keys

      • 5kplayer.exe (PID: 4592)
      • msedge.exe (PID: 2008)
      • msedge.exe (PID: 2088)
      • 5KPlayer.exe (PID: 6832)
      • msedge.exe (PID: 6780)
      • msedge.exe (PID: 5732)

    • Reads Environment values

      • identity_helper.exe (PID: 812)
      • identity_helper.exe (PID: 3376)

    • Application launched itself

      • msedge.exe (PID: 6780)
      • msedge.exe (PID: 2088)
      • msedge.exe (PID: 5732)
      • msedge.exe (PID: 2008)

    • Manual execution by a user

      • msedge.exe (PID: 2008)

    • Dropped object may contain TOR URL's

      • 5KPlayer.exe (PID: 6832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:20:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 29696
InitializedDataSize: 489984
UninitializedDataSize: 16896
EntryPoint: 0x38af
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
211
Monitored processes
74
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 5kplayer-setup.exe THREAT 5kp.exe 5kplayer.exe filerelation.exe THREAT 5kplayer.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs textinputhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 5kplayer-setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3688 --field-trial-handle=2468,i,4297966303548817084,16379106928080655226,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
640"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=2468,i,4297966303548817084,16379106928080655226,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
812"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5008 --field-trial-handle=2420,i,2589984823379439644,18257256959063152232,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcp_win.dll
1044"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7084 --field-trial-handle=2420,i,2589984823379439644,18257256959063152232,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1044"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=2484,i,397424376934991636,6358771137630235700,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1048"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5476 --field-trial-handle=2420,i,2589984823379439644,18257256959063152232,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5080 --field-trial-handle=2484,i,397424376934991636,6358771137630235700,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1436"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
2008"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument https://www.5kplayer.com/r/go.php?an=5kpwin&cvs=6.9&cb=&fui=&rt=undef&eid=&pvs=&ev=ins&uc=8661f00d8544b296&jump=https%3A%2F%2Fwww.5kplayer.com%2Fsoftware%2Finstall.htm%3Fttsoft%3D5kpwin-6.9-ins&h=70c7266a66d52eef9af9dabfa7295549C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2088"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-windowC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
42 537
Read events
42 074
Write events
431
Delete events
32

Modification events

(PID) Process:(4592) 5kplayer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\5KPlayer
Operation:writeName:InstPath
Value:
C:\Program Files (x86)\DearMob\5KPlayer
(PID) Process:(4592) 5kplayer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\5KPlayer
Operation:writeName:DisplayName
Value:
5KPlayer
(PID) Process:(4592) 5kplayer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\5KPlayer
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\DearMob\5KPlayer\uninstaller.exe
(PID) Process:(4592) 5kplayer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\5KPlayer
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\DearMob\5KPlayer\5KPlayer.exe
(PID) Process:(4592) 5kplayer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\5KPlayer
Operation:writeName:Publisher
Value:
DearMob, Inc.
(PID) Process:(4592) 5kplayer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\5KPlayer
Operation:writeName:DisplayVersion
Value:
6.9
(PID) Process:(4592) 5kplayer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\5KPlayer
Operation:writeName:EstimatedSize
Value:
123800
(PID) Process:(5284) FileRelation.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\5KPlayer.xxx\shell\open
Operation:writeName:FriendlyAppName
Value:
5KPlayer
(PID) Process:(5284) FileRelation.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:5KPlayer
Value:
"C:\Program Files (x86)\DearMob\5KPlayer\5KPlayer.exe" -auto
(PID) Process:(5284) FileRelation.exeKey:HKEY_CLASSES_ROOT\.3gp
Operation:writeName:5KPlayer.backup
Value:
VLC.3gp
Executable files
491
Suspicious files
1 186
Text files
2 286
Unknown types
0

Dropped files

PID
Process
Filename
Type
64965kplayer-setup.exeC:\Users\admin\AppData\Local\Temp\5kplayer\5kp.7z —
MD5:—
SHA256:—
66605kp.exeC:\Users\admin\AppData\Local\Temp\5kplayer.temp —
MD5:—
SHA256:—
66605kp.exeC:\Users\admin\AppData\Local\Temp\5kplayer.exe —
MD5:—
SHA256:—
45925kplayer.exeC:\Program Files (x86)\DearMob\5KPlayer\app.7z —
MD5:—
SHA256:—
64965kplayer-setup.exeC:\Users\admin\AppData\Local\Temp\5kplayer\5kp.exeexecutable
MD5:3E71A7C07BB5BD316F64768D21971CFC
SHA256:E00F8BB3EAAFF144C30CEAC509CA4D5267D73A5BAF6D0FE45B3BF8CC58CE3178
66605kp.exeC:\Users\admin\AppData\Roaming\Digiarty\unique.bintext
MD5:B5FEABFA4D74F7856C6C753DF1AA53F6
SHA256:8511EC9D84C8686DC45100F400A55BCE3BA6B5130BD92DFB8469E3F86203148F
45925kplayer.exeC:\Users\admin\AppData\Local\Temp\nsd1AB4.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
64965kplayer-setup.exeC:\Users\admin\AppData\Local\Temp\nsh730A.tmp\nsis7zU.dllexecutable
MD5:06A47571AC922F82C098622B2F5F6F63
SHA256:E4AB3064F2E094910AE80104EF9D371CCB74EBBEEED592582CF099ACD83F5FE9
45925kplayer.exeC:\Users\admin\AppData\Local\Temp\nsd1AB4.tmp\nsNiuniuSkin.dllexecutable
MD5:77270FD8BBC780B411EB737641E1E6CD
SHA256:562A8CB521971572445F73D9344A1984345F44D631397D0C305CF4512D2C8DB1
45925kplayer.exeC:\Users\admin\AppData\Local\Temp\nsd1AB4.tmp\license-zh.rtftext
MD5:D7711B19B5B8F0C42FB89F1F2B9448B4
SHA256:1AE4CA700A6C974AF9B1CF6AC28D623E4275E7BD2795849D1A6EE4F9FF437835
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
168
DNS requests
142
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6660
5kp.exe
HEAD
200
67.228.121.196:80
http://www.5kplayer.com/download/5kplayer-64bit.exe
unknown
—
—
whitelisted
6660
5kp.exe
GET
200
67.228.121.193:80
http://dl1.5kplayer.com/download/onlineload.config
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2616
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6660
5kp.exe
GET
206
67.228.121.196:80
http://www.5kplayer.com/download/5kplayer-64bit.exe
unknown
—
—
whitelisted
6660
5kp.exe
GET
206
67.228.121.196:80
http://www.5kplayer.com/download/5kplayer-64bit.exe
unknown
—
—
whitelisted
6660
5kp.exe
GET
206
67.228.121.196:80
http://www.5kplayer.com/download/5kplayer-64bit.exe
unknown
—
—
whitelisted
6940
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6832
5KPlayer.exe
GET
200
67.228.121.193:80
http://dl1.5kplayer.com/5kpads/100338.zip
unknown
—
—
whitelisted
6832
5KPlayer.exe
GET
—
67.228.121.193:80
http://dl1.5kplayer.com/youtube/youtube_dl_1.zip
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4936
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3520
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4936
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6660
5kp.exe
67.228.121.196:443
www.5kplayer.com
SOFTLAYER
US
unknown
6660
5kp.exe
67.228.121.193:80
dl1.5kplayer.com
SOFTLAYER
US
unknown
5336
SearchApp.exe
2.23.209.186:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 52.183.220.149
whitelisted
www.5kplayer.com
  • 67.228.121.196
whitelisted
dl1.5kplayer.com
  • 67.228.121.193
whitelisted
www.bing.com
  • 2.23.209.186
  • 2.23.209.185
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.182
  • 2.23.209.177
  • 2.23.209.183
  • 2.23.209.189
  • 2.23.209.179
  • 92.123.104.6
  • 92.123.104.5
  • 92.123.104.66
  • 92.123.104.10
  • 92.123.104.63
  • 92.123.104.62
  • 92.123.104.65
  • 92.123.104.9
  • 92.123.104.67
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.35.21
  • 40.126.35.64
  • 40.126.35.19
  • 20.190.163.18
  • 40.126.35.128
  • 40.126.35.144
  • 40.126.35.85
  • 40.126.35.134
whitelisted
th.bing.com
  • 2.23.209.161
  • 2.23.209.179
  • 2.23.209.171
  • 2.23.209.162
  • 2.23.209.160
  • 2.23.209.177
  • 2.23.209.175
  • 2.23.209.166
  • 2.23.209.173
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
6660
5kp.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
17 ETPRO signatures available at the full report
Process
Message
5kp.exe
------- "en"
5kp.exe
httpAnalyFinished
5kp.exe
startDownPack "http://www.5kplayer.com/download/5kplayer-32bit.exe" "http://www.5kplayer.com/download/5kplayer-64bit.exe" "3b3d0ee83dd892a61df44b2ac0a79768" "d5a7da20dc61426fc84538cef7ac1c41" true
5kp.exe
serverMD5 "d5a7da20dc61426fc84538cef7ac1c41"
5kp.exe
start down all new
5kp.exe
delete local file successed true
5kp.exe
start: 0 end: 20247394
5kp.exe
start: 20247395 end: 40494789
5kp.exe
start: 40494790 end: 60742184
5kp.exe
connected to network
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/download/5kplayer-setup.exe