home

hdvideoplayer_3053128298.exe

Nesino

Secure Software Products

The application hdvideoplayer_3053128298.exe, “Nesino Setup ” by Secure Software Products has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.headmetavault.com.
Publisher:
Secure Software Products  (signed and verified)

Product:
Nesino

Description:
Nesino Setup

Version:
1.7.3.5

MD5:
ba1538db89cb0c3ca4ac3bd34e606923

SHA-1:
493d46b10211f8ae2939bcf8a609cb0791974eeb

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
4/13/2025 7:28:35 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore (M)
16.8.11.1

File size:
948.4 KB (971,144 bytes)

Product version:
2.5

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Yansiz Dil

Common path:
C:\documents and settings\user\belgelerim\downloads\hdvideoplayer_3053128298.exe

Digital Signature
Signed by:
Secure Software Products

Authority:
GoDaddy.com, Inc.

Valid from:
4/20/2016 12:29:38 AM

Valid to:
4/20/2017 12:29:38 AM

Subject:
CN=Secure Software Products, O=Secure Software Products, L=Las Vegas, S=Nevada, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
5E7095902F2C0288

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:+F1Jc6nAE5wksdRL5E4T9LmOQJ1RmFs6tke7:MeE5XsBhiqV

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file hdvideoplayer_3053128298.exe has been seen being distributed by the following URL.

http://www.headmetavault.com/QxyMaQJJszA1XtHUGA6XM5_ RA9axfMpDybLvL0i7pi72cdbB2GG U5 nyE vWyaJ vKi04 Fget9PQMkQ92vohlIr E5WNr6AAK9MGeCAEzbZjNVZYxOIy338gWzwo4aGjJE69EKPpDv3 zSjHFTkWBQF9F2XdeBC yWoZ72kX1A xAJd7pfZZygJYK5mlXVeP_hQM9jRbH6habABXr0rfll1yKOFWOLSnHR zt j3GfLzgvbGyi3MhqPi_Pg3LCRS5c6R6_wZfElX79OyqXVPG1LOwChlzsjEFxYvZKdTQfBveenBt xoE3BgTAvlDy_yZ1NPR5ijOW_abBfnHUPftPKQX5eZjFT9hsgwJMmLkrdoGaBb4k2rUR6uGVDh9ahH76b_SMMSL2DSh43y8U1lW4_OE70_oWy_1NghbhmlPkLjnOaaqZI_4MCgpc4YEqCkXLlxbPywbMy9gk QpeGcQr5CHF1mbOy bxPypv XEDvpimPYHBemdhuDrYdn0giDRzz6O2oW JVJOHiIZiuNKRGXHSkAFdVboRGYFviD_DbHshGxLvXIlIS9mYCKVjW40avB6qnJlx0J4WlcKLnDuFFTMaP M0b5buNr1roSSeR9lcayD_DoOyKJHZJQTx7xkJ32IX83iZnAGekuwapymy99zOuYyFIjjaJrV3YP_qSPSvAqubro1ntGJQKs_QucC5Kw0fxmlGj5H32LlOEtEja2xHMtsgHWTT8KO76IZ a7be0ywiWrWxQwYxSqcedEgjMrB7P8r9PXBpGX8ZY1XQoCTtvSDo8Lma393pGnKBcnIpbydxqKuZqrlTv1GB2rNavOd-Gy4AAEQ3F5slGeyny9EFwR_D5eddCCcCLSS3DuTGa74Jz DR685Mk8IaPXTgdNGPAg==

Remove hdvideoplayer_3053128298.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.