home

hdvideoplayer_1609686768.exe

Nesino

Secure Software Products

The application hdvideoplayer_1609686768.exe, “Nesino Setup ” by Secure Software Products has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.headmetavault.com.
Publisher:
Secure Software Products  (signed and verified)

Product:
Nesino

Description:
Nesino Setup

Version:
1.7.3.5

MD5:
ef82e042ec58216c11987170b03fd1a8

SHA-1:
baeed9890fff30f1914438eba62e6b605f7b9d48

SHA-256:
77f15ac9f8049985034c0c62d86b1c053cd557ebcf8c7af3f455a1ea17a3315b

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
4/13/2025 7:28:37 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore (M)
16.8.11.0

File size:
948.4 KB (971,144 bytes)

Product version:
2.5

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\hdvideoplayer_1609686768.exe

Digital Signature
Signed by:
Secure Software Products

Authority:
GoDaddy.com, Inc.

Valid from:
4/19/2016 11:29:38 PM

Valid to:
4/19/2017 11:29:38 PM

Subject:
CN=Secure Software Products, O=Secure Software Products, L=Las Vegas, S=Nevada, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
5E7095902F2C0288

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:AF1Jc6nAE5wksdRL5E4T9LmOQJ1RmFs6tke7:aeE5XsBhiqV

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file hdvideoplayer_1609686768.exe has been seen being distributed by the following URL.

http://www.headmetavault.com/SF57o2q0V9hR1C9saL8PqVC66mwAZ4Zu3RglxXxBh8kEeLt9zoQzijyiCSa PJ8S7j0gnpjj1h3JtqsFdcmWdNQorK992DrW JXoxgTkRJB5xFaj0Oj_J2zdolo WwNS4FJLwIT668HmhhVHcVUsQiw_qw5Yjjq_h_J90Xkh9k_pBpz9qrMV70fm9naSVnms1qJeNkckJkKp9AR31qbqSrXXyh_1kIG RqUKkdt6Dp3B t1 8Olon2oQtT7hNnLqudmUGW1B6tJjZLpQ67ThnGPSnC8dxT8cP5U0Z BXNDxtKaVuL46TQsgB0975q4zp8uR 6VJlvEfJydfLz1IIPJkzA5_Ku2au5BxbeMRx4GaYqsesSvV0o529S7QxlAo5ttQOBKYypYeEpQ6yvTdyiXn22woqnubjGX9NQAjJobC7R5KUUL2zO6o7HoxUHDpjQumcu0PGCvmUtJ8 K2WqrBw8WvuSOFCb82DkiFz2IdkhcqLvG8p0keu4t4yJSV1AbPAyLvxGiYBIH9WYYy3oJvd5CJcIJKe5FxplXU0nHHs1wwGwWZbESU28ybqhDKaD h_85nxoMGCHFcHlKnKWe_lEfSHT8QwG3eNThhwvJsgoWa3wYe0Gu2Nib4MV7jnFRTvPJl7py i mZvSK6sozBYkGIzJvqi3sqWDNv44lBxBjcSDjTbfux1QxOn0CQAtJ53kYnv0kxPSf2KV3JW34e6FuqXzor rJdeUhUV 0LwNSi0MYvYquHcNqdjjcoa16lrhPVHgGoJJBD3Ii8_oEbyq5KYKL7F5senDovLtPofMSaapsBbj0JI X82kq6STKr1v2mMz-Gy4AAEQ3F5slGeyny9EFwR_D5eddCCcCLSS3DuTGa74Jz DR685Mk8IaPXTgdNGPAg==

Remove hdvideoplayer_1609686768.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.