File name:

msi-app-player-5.9.300.6315-installer_8RDv-e1.exe

Full analysis: https://app.any.run/tasks/b9020a1b-47e1-409c-b0d2-80caabb8cef4
Verdict: Malicious activity
Analysis date: May 14, 2024, 08:13:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D3124F0D2C99985BFE3DBA2985B4AC16

SHA1:

C74A7C74B1A6A61B73D82884946CE452CD2B6ADF

SHA256:

C8FC8F279A2DB80F37703EA808A6FE95F8850472AA2FABBBCD1E8DAA47B1F0E0

SSDEEP:

49152:J7HecD4dnbibBl3eG1xdd8JN3JQTG04g64S9YqCaBORHmpWHkd8lw720lK+DBLta:R+cD4dnS3ddE3yC0MEQORGpGkd8lAnlU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.exe (PID: 3964)
      • msi-app-player-5.9.300.6315-installer_8RDv-e1.exe (PID: 1020)
      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)
      • avg_antivirus_free_setup.exe (PID: 1872)
      • avg_antivirus_free_online_setup.exe (PID: 2180)
      • msi-app-player-5.9.300.6315-installer.exe (PID: 1628)
      • icarus.exe (PID: 580)
      • icarus.exe (PID: 1600)

    • Creates a writable file in the system directory

      • icarus.exe (PID: 1600)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.exe (PID: 3964)
      • msi-app-player-5.9.300.6315-installer_8RDv-e1.exe (PID: 1020)
      • avg_antivirus_free_setup.exe (PID: 1872)
      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)
      • avg_antivirus_free_online_setup.exe (PID: 2180)
      • msi-app-player-5.9.300.6315-installer.exe (PID: 1628)
      • icarus.exe (PID: 580)
      • icarus.exe (PID: 1600)

    • Reads the Windows owner or organization settings

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)

    • Reads settings of System Certificates

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)
      • avg_antivirus_free_setup.exe (PID: 1872)
      • avg_antivirus_free_online_setup.exe (PID: 2180)
      • BlueStacksInstaller.exe (PID: 316)

    • Adds/modifies Windows certificates

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)

    • Reads the Internet Settings

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)
      • msi-app-player-5.9.300.6315-installer.exe (PID: 1628)
      • BlueStacksInstaller.exe (PID: 316)

    • Reads security settings of Internet Explorer

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)
      • msi-app-player-5.9.300.6315-installer.exe (PID: 1628)

    • Starts itself from another location

      • icarus.exe (PID: 580)

    • The process creates files with name similar to system file names

      • icarus.exe (PID: 1600)

    • The process drops C-runtime libraries

      • icarus.exe (PID: 1600)

    • Process drops legitimate windows executable

      • icarus.exe (PID: 1600)

    • Drops a system driver (possible attempt to evade defenses)

      • icarus.exe (PID: 1600)

    • The process verifies whether the antivirus software is installed

      • icarus.exe (PID: 1600)

  • INFO

    • Checks supported languages

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.exe (PID: 3964)
      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 3980)
      • msi-app-player-5.9.300.6315-installer_8RDv-e1.exe (PID: 1020)
      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)
      • wmpnscfg.exe (PID: 748)
      • avg_antivirus_free_online_setup.exe (PID: 2180)
      • avg_antivirus_free_setup.exe (PID: 1872)
      • msi-app-player-5.9.300.6315-installer.exe (PID: 1628)
      • BlueStacksInstaller.exe (PID: 316)
      • icarus.exe (PID: 1600)
      • icarus.exe (PID: 568)
      • HD-CheckCpu.exe (PID: 768)
      • icarus.exe (PID: 580)

    • Create files in a temporary directory

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.exe (PID: 3964)
      • msi-app-player-5.9.300.6315-installer_8RDv-e1.exe (PID: 1020)
      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)
      • avg_antivirus_free_online_setup.exe (PID: 2180)
      • msi-app-player-5.9.300.6315-installer.exe (PID: 1628)
      • BlueStacksInstaller.exe (PID: 316)
      • icarus.exe (PID: 580)
      • icarus.exe (PID: 1600)
      • icarus.exe (PID: 568)

    • Reads the computer name

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 3980)
      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)
      • wmpnscfg.exe (PID: 748)
      • avg_antivirus_free_setup.exe (PID: 1872)
      • avg_antivirus_free_online_setup.exe (PID: 2180)
      • msi-app-player-5.9.300.6315-installer.exe (PID: 1628)
      • BlueStacksInstaller.exe (PID: 316)
      • icarus.exe (PID: 1600)
      • icarus.exe (PID: 568)
      • icarus.exe (PID: 580)

    • Reads the software policy settings

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)
      • avg_antivirus_free_setup.exe (PID: 1872)
      • avg_antivirus_free_online_setup.exe (PID: 2180)
      • BlueStacksInstaller.exe (PID: 316)

    • Reads the machine GUID from the registry

      • msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp (PID: 2104)
      • avg_antivirus_free_setup.exe (PID: 1872)
      • avg_antivirus_free_online_setup.exe (PID: 2180)
      • BlueStacksInstaller.exe (PID: 316)
      • icarus.exe (PID: 580)
      • icarus.exe (PID: 1600)
      • icarus.exe (PID: 568)

    • Creates files in the program directory

      • avg_antivirus_free_online_setup.exe (PID: 2180)
      • icarus.exe (PID: 580)
      • icarus.exe (PID: 1600)
      • BlueStacksInstaller.exe (PID: 316)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 748)

    • Reads Environment values

      • BlueStacksInstaller.exe (PID: 316)
      • icarus.exe (PID: 1600)

    • Creates files or folders in the user directory

      • BlueStacksInstaller.exe (PID: 316)

    • Reads CPU info

      • icarus.exe (PID: 580)
      • icarus.exe (PID: 1600)
      • icarus.exe (PID: 568)

    • Dropped object may contain TOR URL's

      • icarus.exe (PID: 580)
      • icarus.exe (PID: 1600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:15 14:54:16+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 89600
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 5.2.14.0
ProductVersionNumber: 5.2.14.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: Softonic International SA
FileVersion: 5.2.14
LegalCopyright: ©2023 Softonic International SA
OriginalFileName:
ProductName: Softonic International SA
ProductVersion: 5.2.14
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
13
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msi-app-player-5.9.300.6315-installer_8rdv-e1.exe msi-app-player-5.9.300.6315-installer_8rdv-e1.tmp no specs msi-app-player-5.9.300.6315-installer_8rdv-e1.exe msi-app-player-5.9.300.6315-installer_8rdv-e1.tmp wmpnscfg.exe no specs avg_antivirus_free_setup.exe avg_antivirus_free_online_setup.exe msi-app-player-5.9.300.6315-installer.exe bluestacksinstaller.exe hd-checkcpu.exe no specs icarus.exe icarus.exe no specs icarus.exe

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Users\admin\AppData\Local\Temp\7zSC561ED60\BlueStacksInstaller.exe" C:\Users\admin\AppData\Local\Temp\7zSC561ED60\BlueStacksInstaller.exe
msi-app-player-5.9.300.6315-installer.exe
User:
admin
Company:
BlueStack Systems, Inc.
Integrity Level:
HIGH
Description:
MSI App Player Installer
Version:
5.9.300.6315
Modules
Images
c:\users\admin\appdata\local\temp\7zsc561ed60\bluestacksinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
568C:\Windows\Temp\asw-43741336-ef21-4a53-9e25-c34a287ab1b9\avg-av-vps\icarus.exe /silent /ws /psh:92pTu5faEDRofK3mrXgJF5dvzZuSEG2uJJe6n4iKE9oOWyCWDKvgLvcjHSuyMjxDevwK1sRKSc6Yrs /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.faa6ce799509101c /track-guid:39a4d19b-866c-49e6-bf46-a45a606e7ef4 /er_master:master_ep_202605c1-959b-48ae-9b17-0ce67476d80b /er_ui:ui_ep_8b3997a1-1940-46f4-84cf-afbab876e4f5 /er_slave:avg-av-vps_slave_ep_bd34371a-7c6c-4906-9c85-bc1a5e92387c /slave:avg-av-vpsC:\Windows\Temp\asw-43741336-ef21-4a53-9e25-c34a287ab1b9\avg-av-vps\icarus.exe—icarus.exe
User:
admin
Company:
AVG Technologies
Integrity Level:
HIGH
Description:
AVG Installer
Version:
24.4.7245.0
Modules
Images
c:\windows\temp\asw-43741336-ef21-4a53-9e25-c34a287ab1b9\avg-av-vps\icarus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
580C:\Windows\Temp\asw-43741336-ef21-4a53-9e25-c34a287ab1b9\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-43741336-ef21-4a53-9e25-c34a287ab1b9\icarus-info.xml /install /silent /ws /psh:92pTu5faEDRofK3mrXgJF5dvzZuSEG2uJJe6n4iKE9oOWyCWDKvgLvcjHSuyMjxDevwK1sRKSc6Yrs /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.faa6ce799509101c /track-guid:39a4d19b-866c-49e6-bf46-a45a606e7ef4C:\Windows\Temp\asw-43741336-ef21-4a53-9e25-c34a287ab1b9\common\icarus.exe
avg_antivirus_free_online_setup.exe
User:
admin
Company:
AVG Technologies
Integrity Level:
HIGH
Description:
AVG Installer
Version:
24.4.7245.0
Modules
Images
c:\windows\temp\asw-43741336-ef21-4a53-9e25-c34a287ab1b9\common\icarus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
748"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
768"C:\Users\admin\AppData\Local\Temp\7zSC561ED60\HD-CheckCpu.exe" --cmd checkSSE4C:\Users\admin\AppData\Local\Temp\7zSC561ED60\HD-CheckCpu.exe—BlueStacksInstaller.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\7zsc561ed60\hd-checkcpu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
1020"C:\Users\admin\AppData\Local\Temp\msi-app-player-5.9.300.6315-installer_8RDv-e1.exe" /SPAWNWND=$20130 /NOTIFYWND=$30136 C:\Users\admin\AppData\Local\Temp\msi-app-player-5.9.300.6315-installer_8RDv-e1.exe
msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Softonic International SA
Version:
5.2.14
Modules
Images
c:\users\admin\appdata\local\temp\msi-app-player-5.9.300.6315-installer_8rdv-e1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1600C:\Windows\Temp\asw-43741336-ef21-4a53-9e25-c34a287ab1b9\avg-av\icarus.exe /silent /ws /psh:92pTu5faEDRofK3mrXgJF5dvzZuSEG2uJJe6n4iKE9oOWyCWDKvgLvcjHSuyMjxDevwK1sRKSc6Yrs /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.faa6ce799509101c /track-guid:39a4d19b-866c-49e6-bf46-a45a606e7ef4 /er_master:master_ep_202605c1-959b-48ae-9b17-0ce67476d80b /er_ui:ui_ep_8b3997a1-1940-46f4-84cf-afbab876e4f5 /er_slave:avg-av_slave_ep_c0c155f3-e949-4987-97a8-dd942776a43b /slave:avg-avC:\Windows\Temp\asw-43741336-ef21-4a53-9e25-c34a287ab1b9\avg-av\icarus.exe
icarus.exe
User:
admin
Company:
AVG Technologies
Integrity Level:
HIGH
Description:
AVG Installer
Version:
24.4.7245.0
Modules
Images
c:\windows\temp\asw-43741336-ef21-4a53-9e25-c34a287ab1b9\avg-av\icarus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1628"C:\Users\admin\Downloads\msi-app-player-5.9.300.6315-installer.exe" C:\Users\admin\Downloads\msi-app-player-5.9.300.6315-installer.exe
msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp
User:
admin
Company:
BlueStack Systems Inc.
Integrity Level:
HIGH
Description:
MSI App Player Installer
Version:
5.0
Modules
Images
c:\users\admin\downloads\msi-app-player-5.9.300.6315-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1872"C:\Users\admin\AppData\Local\Temp\is-G2C3U.tmp\component0_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5faEDRofK3mrXgJF5dvzZuSEG2uJJe6n4iKE9oOWyCWDKvgLvcjHSuyMjxDevwK1sRKSc6YrsC:\Users\admin\AppData\Local\Temp\is-G2C3U.tmp\component0_extract\avg_antivirus_free_setup.exe
msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp
User:
admin
Company:
AVG Technologies CZ, s.r.o.
Integrity Level:
HIGH
Description:
AVG Installer
Version:
2.1.99.0
Modules
Images
c:\users\admin\appdata\local\temp\is-g2c3u.tmp\component0_extract\avg_antivirus_free_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2104"C:\Users\admin\AppData\Local\Temp\is-MHH51.tmp\msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp" /SL5="$2013C,837551,832512,C:\Users\admin\AppData\Local\Temp\msi-app-player-5.9.300.6315-installer_8RDv-e1.exe" /SPAWNWND=$20130 /NOTIFYWND=$30136 C:\Users\admin\AppData\Local\Temp\is-MHH51.tmp\msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp
msi-app-player-5.9.300.6315-installer_8RDv-e1.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-mhh51.tmp\msi-app-player-5.9.300.6315-installer_8rdv-e1.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
28 034
Read events
27 881
Write events
138
Delete events
15

Modification events

(PID) Process:(2104) msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
380800009A5E75A2D6A5DA01
(PID) Process:(2104) msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
14D098CCCF96355AD4E7232BB40BBD721E5386C072E02FF32C40DC35CCCB541D
(PID) Process:(2104) msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2104) msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2104) msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates
Operation:delete valueName:9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Value:
(PID) Process:(2104) msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB6200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2104) msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
1400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D70300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB60F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D8200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2104) msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
190000000100000010000000BCC80DAA2F98A4692805BFF4CBB372EB0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB61400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D7200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(2104) msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
Operation:delete valueName:CABD2A79A1076A31F21D253635CB039D4329A5E8
Value:
(PID) Process:(2104) msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
0400000001000000100000000CD2F9E0DA1773E9ED864DA5E370E74E0F00000001000000200000003F0411EDE9C4477057D57E57883B1F205B20CDC0F3263129B1EE0269A2678F63030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E809000000010000000C000000300A06082B060105050703011D000000010000001000000073B6876195F5D18E048510422AEF04E314000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E0B000000010000001A0000004900530052004700200052006F006F007400200058003100000062000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C61900000001000000100000002FE1F70BB05D7C92335BC5E05B984DA620000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
Executable files
410
Suspicious files
568
Text files
261
Unknown types
0

Dropped files

PID
Process
Filename
Type
2104msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpC:\Users\admin\AppData\Local\Temp\is-G2C3U.tmp\is-EROD7.tmp —
MD5:—
SHA256:—
2104msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpC:\Users\admin\AppData\Local\Temp\is-G2C3U.tmp\AVG_AV.pngimage
MD5:AEE8E80B35DCB3CF2A5733BA99231560
SHA256:35BBD8F390865173D65BA2F38320A04755541A0783E9F825FDB9862F80D97AA9
3964msi-app-player-5.9.300.6315-installer_8RDv-e1.exeC:\Users\admin\AppData\Local\Temp\is-51CQO.tmp\msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpexecutable
MD5:60EE442DD93DD1658C59972BE71CB4BB
SHA256:C38769F3FCD028B9176D57134DD739C91445F3B1B908F9C9FC422B6990D59343
2104msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpC:\Users\admin\AppData\Local\Temp\is-G2C3U.tmp\v.pngimage
MD5:901CCEF6859BF21318516EC882854058
SHA256:00873784B2C875FEFB4FFC71163A3DE9991809C865F750D77990C279D4EBC579
2104msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpC:\Users\admin\AppData\Local\Temp\is-G2C3U.tmp\is-36GI1.tmpexecutable
MD5:5570243405835E8F74DDED31569A7662
SHA256:C5605D9911AA7C3308EFE16370BE500922F04189EFE6389E13702181A6C44689
2104msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpC:\Users\admin\AppData\Local\Temp\is-G2C3U.tmp\msi-app-player-5.9.300.6315-installer.exeexecutable
MD5:5570243405835E8F74DDED31569A7662
SHA256:C5605D9911AA7C3308EFE16370BE500922F04189EFE6389E13702181A6C44689
2104msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpC:\Users\admin\AppData\Local\Temp\is-G2C3U.tmp\is-JR7IB.tmpcompressed
MD5:56B0D3E1B154AE65682C167D25EC94A6
SHA256:434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
2104msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpC:\Users\admin\AppData\Local\Temp\is-G2C3U.tmp\component0compressed
MD5:56B0D3E1B154AE65682C167D25EC94A6
SHA256:434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
2104msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpC:\Users\admin\AppData\Local\Temp\is-G2C3U.tmp\is-S3LO3.tmpimage
MD5:AEE8E80B35DCB3CF2A5733BA99231560
SHA256:35BBD8F390865173D65BA2F38320A04755541A0783E9F825FDB9862F80D97AA9
2104msi-app-player-5.9.300.6315-installer_8RDv-e1.tmpC:\Users\admin\Downloads\msi-app-player-5.9.300.6315-installer.exeexecutable
MD5:5570243405835E8F74DDED31569A7662
SHA256:C5605D9911AA7C3308EFE16370BE500922F04189EFE6389E13702181A6C44689
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
40
DNS requests
48
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1872
avg_antivirus_free_setup.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
—
1872
avg_antivirus_free_setup.exe
POST
200
216.58.206.46:80
http://www.google-analytics.com/collect
unknown
—
—
—
1872
avg_antivirus_free_setup.exe
POST
204
34.117.223.223:80
http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
unknown
—
—
—
1872
avg_antivirus_free_setup.exe
POST
200
216.58.206.46:80
http://www.google-analytics.com/collect
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2104
msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp
52.222.206.208:443
d1m7dy78k1890a.cloudfront.net
AMAZON-02
US
unknown
2104
msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp
23.199.214.60:443
images.sftcdn.net
AKAMAI-AS
DE
unknown
2104
msi-app-player-5.9.300.6315-installer_8RDv-e1.tmp
199.232.198.133:443
gsf-fl.softonic.com
FASTLY
US
unknown
1872
avg_antivirus_free_setup.exe
216.58.206.46:80
www.google-analytics.com
GOOGLE
US
unknown
1872
avg_antivirus_free_setup.exe
34.117.223.223:80
v7event.stats.avast.com
GOOGLE-CLOUD-PLATFORM
US
unknown
1872
avg_antivirus_free_setup.exe
95.101.197.12:443
honzik.avcdn.net
Akamai International B.V.
NL
unknown
2180
avg_antivirus_free_online_setup.exe
34.117.223.223:443
v7event.stats.avast.com
GOOGLE-CLOUD-PLATFORM
US
unknown

DNS requests

Domain
IP
Reputation
d1m7dy78k1890a.cloudfront.net
  • 52.222.206.208
  • 52.222.206.201
  • 52.222.206.20
  • 52.222.206.211
unknown
images.sftcdn.net
  • 23.199.214.60
unknown
gsf-fl.softonic.com
  • 199.232.198.133
  • 199.232.194.133
unknown
www.google-analytics.com
  • 216.58.206.46
unknown
honzik.avcdn.net
  • 95.101.197.12
  • 2a02:26f0:480:79b::240d
  • 2a02:26f0:480:784::240d
  • 2a02:26f0:480:781::240d
  • 2a02:26f0:480:7b6::240d
  • 23.32.101.67
  • 2a02:26f0:3500:f92::240d
  • 2a02:26f0:3500:f9c::240d
unknown
v7event.stats.avast.com
  • 34.117.223.223
unknown
analytics.avcdn.net
  • 34.117.223.223
unknown
cloud.bluestacks.com
  • 34.160.86.181
unknown
shepherd.avcdn.net
  • 34.160.176.28
unknown
watson.microsoft.com
  • 104.208.16.93
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
msi-app-player-5.9.300.6315-installer_8RDv-e1.exe