URL:

https://vlc-media-player.en.softonic.com/download?installerType=riseInstaller

Full analysis: https://app.any.run/tasks/8a440d08-1dd8-4e9f-9afe-fefec29f8cb4
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: February 16, 2026, 13:06:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adware
innosetup
evasion
delphi
inno
installer
Indicators:
MD5:

2E410C8F48FE5347789227514CE11C62

SHA1:

9637F3E0F35046F00253D3C91DCC25825A008E00

SHA256:

E2FEC4841D8CF5E34F6C79627F6CF27688B95D247EE2A87333EA36FAF779F2D9

SSDEEP:

3:N8VL/vHLGKMbNTXe/VOXn:2hHLGKMRTXedOXn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • INNOSETUP has been detected (SURICATA)

      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)

    • Proxy execution via Explorer

      • vlc-media-player-3.0.22-installer.exe (PID: 2244)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)

    • Executable content was dropped or overwritten

      • vlc-media-player-3.0.22-installer_PO-GA41.exe (PID: 9952)
      • vlc-media-player-3.0.22-installer_PO-GA41.exe (PID: 10040)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)
      • cookie_mmm_irs_ppi_008_537.exe (PID: 9572)
      • avast_free_antivirus_online_setup.exe (PID: 2872)
      • icarus.exe (PID: 9872)
      • vlc-media-player-3.0.22-installer.exe (PID: 2244)
      • icarus.exe (PID: 9608)

    • Access to an unwanted program domain was detected

      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)

    • Checks for external IP

      • cookie_mmm_irs_ppi_008_537.exe (PID: 9572)

    • Starts itself from another location

      • icarus.exe (PID: 9608)

    • The process creates files with name similar to system file names

      • icarus.exe (PID: 9872)
      • vlc-media-player-3.0.22-installer.exe (PID: 2244)

    • The process verifies whether the antivirus software is installed

      • icarus.exe (PID: 9872)

    • Executes application which crashes

      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • vlc-media-player-3.0.22-installer.exe (PID: 2244)

    • The process drops C-runtime libraries

      • icarus.exe (PID: 9872)

    • Process drops legitimate windows executable

      • icarus.exe (PID: 9872)

    • Creates/Modifies COM task schedule object

      • vlc-media-player-3.0.22-installer.exe (PID: 2244)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 10040)

    • Drops a system driver (possible attempt to evade defenses)

      • icarus.exe (PID: 9872)

  • INFO

    • Reads Environment values

      • identity_helper.exe (PID: 9016)
      • icarus.exe (PID: 9872)

    • Application launched itself

      • msedge.exe (PID: 4128)

    • Reads the computer name

      • identity_helper.exe (PID: 9016)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)
      • vlc-media-player-3.0.22-installer_PO-GA41.exe (PID: 10040)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 9968)
      • cookie_mmm_irs_ppi_008_537.exe (PID: 9572)
      • avast_free_antivirus_online_setup.exe (PID: 2872)
      • icarus.exe (PID: 9608)
      • icarus.exe (PID: 9888)
      • icarus.exe (PID: 9872)
      • vlc-media-player-3.0.22-installer.exe (PID: 2244)
      • vlc.exe (PID: 768)

    • Checks supported languages

      • identity_helper.exe (PID: 9016)
      • vlc-media-player-3.0.22-installer_PO-GA41.exe (PID: 9952)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 9968)
      • vlc-media-player-3.0.22-installer_PO-GA41.exe (PID: 10040)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)
      • cookie_mmm_irs_ppi_008_537.exe (PID: 9572)
      • avast_free_antivirus_online_setup.exe (PID: 2872)
      • icarus.exe (PID: 9608)
      • icarus.exe (PID: 9888)
      • vlc-media-player-3.0.22-installer.exe (PID: 2244)
      • icarus.exe (PID: 9872)
      • vlc-cache-gen.exe (PID: 3276)
      • vlc.exe (PID: 768)

    • Drops script file

      • msedge.exe (PID: 4128)
      • msedge.exe (PID: 1760)
      • avast_free_antivirus_online_setup.exe (PID: 2872)
      • icarus.exe (PID: 9608)
      • icarus.exe (PID: 9872)
      • vlc-media-player-3.0.22-installer.exe (PID: 2244)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 8132)
      • msedge.exe (PID: 4128)

    • Create files in a temporary directory

      • vlc-media-player-3.0.22-installer_PO-GA41.exe (PID: 9952)
      • vlc-media-player-3.0.22-installer_PO-GA41.exe (PID: 10040)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)
      • avast_free_antivirus_online_setup.exe (PID: 2872)
      • vlc-media-player-3.0.22-installer.exe (PID: 2244)

    • Launching a file from the Downloads directory

      • msedge.exe (PID: 4128)

    • Reads security settings of Internet Explorer

      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 9968)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)
      • explorer.exe (PID: 9956)

    • Process checks computer location settings

      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 9968)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)

    • Detects InnoSetup installer (YARA)

      • vlc-media-player-3.0.22-installer_PO-GA41.exe (PID: 9952)
      • vlc-media-player-3.0.22-installer_PO-GA41.exe (PID: 10040)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 9968)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)

    • Compiled with Borland Delphi (YARA)

      • vlc-media-player-3.0.22-installer_PO-GA41.exe (PID: 9952)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 9968)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)
      • vlc-media-player-3.0.22-installer_PO-GA41.exe (PID: 10040)

    • The sample compiled with english language support

      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)
      • cookie_mmm_irs_ppi_008_537.exe (PID: 9572)
      • avast_free_antivirus_online_setup.exe (PID: 2872)
      • icarus.exe (PID: 9608)
      • icarus.exe (PID: 9872)
      • vlc-media-player-3.0.22-installer.exe (PID: 2244)

    • Reads the machine GUID from the registry

      • cookie_mmm_irs_ppi_008_537.exe (PID: 9572)
      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)
      • avast_free_antivirus_online_setup.exe (PID: 2872)
      • icarus.exe (PID: 9608)
      • icarus.exe (PID: 9872)
      • icarus.exe (PID: 9888)
      • vlc-cache-gen.exe (PID: 3276)
      • vlc-media-player-3.0.22-installer.exe (PID: 2244)
      • vlc.exe (PID: 768)

    • Checks proxy server information

      • vlc-media-player-3.0.22-installer_PO-GA41.tmp (PID: 10064)
      • avast_free_antivirus_online_setup.exe (PID: 2872)
      • WerFault.exe (PID: 5016)
      • WerFault.exe (PID: 7732)

    • Creates files in the program directory

      • avast_free_antivirus_online_setup.exe (PID: 2872)
      • icarus.exe (PID: 9608)
      • icarus.exe (PID: 9872)
      • vlc-media-player-3.0.22-installer.exe (PID: 2244)
      • vlc-cache-gen.exe (PID: 3276)

    • Reads CPU info

      • icarus.exe (PID: 9608)
      • icarus.exe (PID: 9888)
      • icarus.exe (PID: 9872)

    • The sample compiled with czech language support

      • icarus.exe (PID: 9872)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 5016)
      • WerFault.exe (PID: 7732)

    • Creates a software uninstall entry

      • vlc-media-player-3.0.22-installer.exe (PID: 2244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
234
Monitored processes
81
Malicious processes
6
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs vlc-media-player-3.0.22-installer_po-ga41.exe vlc-media-player-3.0.22-installer_po-ga41.tmp no specs vlc-media-player-3.0.22-installer_po-ga41.exe #INNOSETUP vlc-media-player-3.0.22-installer_po-ga41.tmp slui.exe no specs cookie_mmm_irs_ppi_008_537.exe avast_free_antivirus_online_setup.exe icarus.exe icarus.exe icarus.exe no specs vlc-media-player-3.0.22-installer.exe msedge.exe no specs msedge.exe no specs werfault.exe werfault.exe msedge.exe no specs vlc-cache-gen.exe conhost.exe no specs explorer.exe no specs msedge.exe no specs explorer.exe no specs vlc.exe msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
748"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=7272,i,2255168115882386834,10567505864621596514,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=9588 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
768"C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
explorer.exe
User:
admin
Company:
VideoLAN
Integrity Level:
MEDIUM
Description:
VLC media player
Version:
3.0.22
Modules
Images
c:\program files (x86)\videolan\vlc\vlc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1320"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6808,i,2255168115882386834,10567505864621596514,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1388"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5832,i,2255168115882386834,10567505864621596514,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1520"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5176,i,2255168115882386834,10567505864621596514,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1584"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=9516,i,2255168115882386834,10567505864621596514,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=9576 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1684"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=8956,i,2255168115882386834,10567505864621596514,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1760"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=8664,i,2255168115882386834,10567505864621596514,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1760"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=9616,i,2255168115882386834,10567505864621596514,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=9608 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1856"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=5736,i,2255168115882386834,10567505864621596514,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
27 558
Read events
26 567
Write events
980
Delete events
11

Modification events

(PID) Process:(10064) vlc-media-player-3.0.22-installer_PO-GA41.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000EA070200010010000D0007003300BA00010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(10064) vlc-media-player-3.0.22-installer_PO-GA41.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000EA070200010010000D0007003300BB00010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(2872) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:5FD38555-4B16-40AE-9A09-E2C969CB74AF
Value:
5E88AB2B29C498B5332BFF3DCC837969
(PID) Process:(2872) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:7CCD586D-2ABC-42FF-A23B-3731F4F183D9
Value:
5E88AB2B29C498B5332BFF3DCC837969
(PID) Process:(2872) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:8C5CFDF4-AB05-4EB0-8EF6-7B4620DC2CF3
Value:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA207OLR3TFkG0qbwgQMstvQQAAAACAAAAAAAQZgAAAAEAACAAAABgqpVuXDfSO2VIyKJqhAuQXPnOhZLgmDpKqxB3w3CQCQAAAAAOgAAAAAIAACAAAAAgEgxmH9MAffGMnPiov65CD8jc+R92LbXF5ObD1Thi7FAAAAA0d5/0UuJF5JPRQH3Msa3vLaDgNbNtuTQgRG+6x1NzmBRMAfJ7X5UsmGB55YdzHSnxQLFwrSDtJQ4PMqSa1SfzOqUZrndQvosLFjyj157knkAAAACMcQQTs1ctyVOESOqnaIkoQIaHOrcRPddTFzfnKw8nadn+UWtPQasG5Nfrybc+gQaP1SFg14BxdQ5YE+LTnly7
(PID) Process:(2872) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:5E1D6A55-0134-486E-A166-38C2E4919BB1
Value:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA207OLR3TFkG0qbwgQMstvQQAAAACAAAAAAAQZgAAAAEAACAAAABgqpVuXDfSO2VIyKJqhAuQXPnOhZLgmDpKqxB3w3CQCQAAAAAOgAAAAAIAACAAAAAgEgxmH9MAffGMnPiov65CD8jc+R92LbXF5ObD1Thi7FAAAAA0d5/0UuJF5JPRQH3Msa3vLaDgNbNtuTQgRG+6x1NzmBRMAfJ7X5UsmGB55YdzHSnxQLFwrSDtJQ4PMqSa1SfzOqUZrndQvosLFjyj157knkAAAACMcQQTs1ctyVOESOqnaIkoQIaHOrcRPddTFzfnKw8nadn+UWtPQasG5Nfrybc+gQaP1SFg14BxdQ5YE+LTnly7
(PID) Process:(2872) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:144807F0-DE37-4C62-9C05-EB4CC64A7A2F
Value:
2c98bf7f-bc00-434d-a9e5-4e197ba0611f
(PID) Process:(2872) avast_free_antivirus_online_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F
Operation:writeName:56C7A9DA-4B11-406A-8B1A-EFF157C294D6
Value:
2c98bf7f-bc00-434d-a9e5-4e197ba0611f
(PID) Process:(9608) icarus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:144807F0-DE37-4C62-9C05-EB4CC64A7A2F
Value:
2c98bf7f-bc00-434d-a9e5-4e197ba0611f
(PID) Process:(9608) icarus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\1D0EC6DE-4A80-4CC3-A335-E6E41C951198
Operation:writeName:5FD38555-4B16-40AE-9A09-E2C969CB74AF
Value:
5E88AB2B29C498B5332BFF3DCC837969
Executable files
989
Suspicious files
1 055
Text files
608
Unknown types
64

Dropped files

PID
Process
Filename
Type
4128msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF1e506f.TMP —
MD5:—
SHA256:—
4128msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
4128msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1e507f.TMP —
MD5:—
SHA256:—
4128msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
4128msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF1e507f.TMP —
MD5:—
SHA256:—
4128msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
4128msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF1e508f.TMP —
MD5:—
SHA256:—
4128msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
4128msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF1e509e.TMP —
MD5:—
SHA256:—
4128msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
352
TCP/UDP connections
520
DNS requests
501
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
US
binary
312 b
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
US
binary
958 b
whitelisted
8132
msedge.exe
GET
200
150.171.22.17:443
https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=66&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1766135237&lafgdate=0
US
text
4.47 Kb
whitelisted
8132
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:N_IGqM5UKv4TUmVd_6h7MgpNqTqiktboNck_EmIXy7A&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
US
text
101 b
whitelisted
—
—
POST
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp
US
binary
958 b
whitelisted
8132
msedge.exe
GET
200
151.101.65.91:443
https://vlc-media-player.en.softonic.com/download?installerType=riseInstaller
US
html
286 Kb
unknown
8132
msedge.exe
GET
200
150.171.28.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
US
text
446 b
whitelisted
8132
msedge.exe
GET
200
104.18.22.222:443
https://copilot.microsoft.com/c/api/user/eligibility
US
binary
25 b
whitelisted
8132
msedge.exe
GET
200
13.107.246.44:443
https://api.edgeoffer.microsoft.com/edgeoffer/pb/experiments?appId=edge-extensions&country=US
US
binary
82 b
whitelisted
8132
msedge.exe
GET
200
3.174.46.38:443
https://sdk.privacy-center.org/a8ff32f4-78c7-4428-825d-0badb488b68b/loader.js?target=en.softonic.com
US
text
169 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5568
SearchApp.exe
2.16.204.137:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
23.63.118.230:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
3344
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5180
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3412
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8132
msedge.exe
150.171.22.17:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8132
msedge.exe
150.171.27.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 20.189.173.2
whitelisted
google.com
  • 142.251.141.142
whitelisted
www.bing.com
  • 2.16.204.137
  • 2.16.204.161
  • 2.16.204.156
  • 2.16.204.135
  • 2.16.204.160
  • 2.16.204.138
  • 2.16.204.139
  • 2.16.204.157
  • 2.16.204.159
  • 2.16.204.144
  • 2.16.204.143
  • 2.16.204.136
  • 2.16.204.141
  • 2.16.204.146
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
config.edge.skype.com
  • 150.171.22.17
whitelisted
vlc-media-player.en.softonic.com
  • 151.101.65.91
  • 151.101.1.91
  • 151.101.193.91
  • 151.101.129.91
unknown
api.edgeoffer.microsoft.com
  • 13.107.246.44
  • 13.107.213.44
whitelisted

Threats

PID
Process
Class
Message
3344
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
8132
msedge.exe
Potentially Bad Traffic
ET INFO PE EXE or DLL Windows file download HTTP
8132
msedge.exe
Misc activity
ET INFO EXE - Served Attached HTTP
10064
vlc-media-player-3.0.22-installer_PO-GA41.tmp
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
10064
vlc-media-player-3.0.22-installer_PO-GA41.tmp
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
10064
vlc-media-player-3.0.22-installer_PO-GA41.tmp
A Network Trojan was detected
ET ADWARE_PUP Win32/OfferCore Checkin M1
10064
vlc-media-player-3.0.22-installer_PO-GA41.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
10064
vlc-media-player-3.0.22-installer_PO-GA41.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
2292
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
9572
cookie_mmm_irs_ppi_008_537.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
Process
Message
vlc-cache-gen.exe
main libvlc debug: configured with /builds/videolan/vlc/extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-shout' '--enable-goom' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--with-contrib=../contrib/i686-w64-mingw32' '--with-breakpad=https://win.crashes.videolan.org' '--enable-qt' '--enable-skins2' '--enable-dvdread' '--enable-caca' 'host_alias=i686-w64-mingw32' 'CFLAGS= -D__MSVCRT_VERSION__=0x700 -D_WIN32_WINNT=0x0502 -DWINVER=0x0502 ' 'CPPFLAGS= -D__MSVCRT_VERSION__=0x700 -D_WIN32_WINNT=0x0502 -DWINVER=0x0502' 'CXXFLAGS= -D__MSVCRT_VERSION__=0x700 -D_WIN32_WINNT=0x0502 -DWINVER=0x0502 ' 'PKG_CONFIG=pkg-config' 'PKG_CONFIG_LIBDIR=/usr/i686-w64-mingw32/lib/pkgconfig:/usr/lib/i686-w64-mingw32/pkgconfig'
vlc-cache-gen.exe
main libvlc debug: Copyright © 1996-2025 the VideoLAN team
vlc-cache-gen.exe
main libvlc debug: VLC media player - 3.0.22 Vetinari
vlc-cache-gen.exe
main libvlc debug: revision 3.0.22-0-gf9020c4df0
vlc-cache-gen.exe
main libvlc debug: searching plug-in modules
vlc-cache-gen.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
vlc-cache-gen.exe
main libvlc debug: ignoring plugins cache file
vlc-cache-gen.exe
main libvlc debug: recursively browsing `C:\Program Files (x86)\VideoLAN\VLC\plugins'
vlc-cache-gen.exe
main libvlc debug: using multimedia timers as clock source
vlc-cache-gen.exe
main libvlc debug: saving plugins cache C:\Program Files (x86)\VideoLAN\VLC\plugins\plugins.dat
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://vlc-media-player.en.softonic.com/download?installerType=riseInstaller