File scan report

Verdict Safe

Analyzed Oct 16, 20269 days ago

Is SAFlashPlayer.exe safe? Yes, no threats found.

None of the 70 antivirus engines that checked it flagged this widely circulated Flash Player projector-style executable, seen by nearly 1,900 submitters since 2018, though it…

Read the whole reasonShow less

Strong evidence · Widely seen for a long time, and nothing harmful found.

Run it as usual if it came from the official source

The file shows no signs of malware, but because it is unsigned and Flash-based, run it only if it came from a source you trust, and keep your security software enabled.

Good practice2 tips

We found nothing harmful in this file.

Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Antivirus results

0 of 70 flagged

Flagged 0
No detection 70
No result 5

FileSAFlashPlayer.exe53.1 MBSHA-256 eb84edd6bc07…e38eb5

Code signing Unsigned
Test run Completed
First seen 7y ago

It has a long history: seen by 1,884 sources over more than six months.

Chapter 02

Why we think so

3 points against it and 4 in its favour, checked against the scan evidence.

Analyst conclusion

None of the 70 antivirus engines that checked it in our network flagged this file, including all 17 major antivirus engines. It has circulated since 2018 among almost 1,900 submitters. Its one sandbox run was clean, writing only Flash Player settings and opening a web page in Chrome. It is unsigned, so its publisher cannot be verified.

Where this verdict could be wrong3 caveats

The executable is unsigned, so no publisher identity can be confirmed.
One sandbox run mapped a data-destruction technique and recorded activity in Google updater processes, though no destructive file activity or malicious verdict accompanied it.
The file tags include a Tor-related network tag, which was not corroborated by any flagged host.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

9sandbox rule tags
11spawned processes
17network contacts
40filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Clean verdict

Sandbox verdicts

VT: CLEANclean

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1012
T1036
T1056· Keylogging
T1059· Runs commands
T1071· Application protocol
T1082· System recon
T1095· Custom network
T1485
T1518.001· Checks your AV

Observed activity

Processes started

Programs the file ran, with their command lines.

SAFlashPlayer.exe"C:\Users\<USER>\AppData\Local\Temp\SAFlashPlayer.exe"
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument http://ivanaedler.github.io/MIMPUT/index.html
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\<USER>\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.112 --initial-client-data=0x1e8,0x208,0x20c,0x40,0x1e4,0x7ff85f13dc40,0x7ff85f13dc4c,0x7ff85f13dc58
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1872,i,971447721362458093,7267231496120252884,262144 --variations-seed-version=20240522-180050.589000 /prefetch:3
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4564 --field-trial-handle=1872,i,971447721362458093,7267231496120252884,262144 --variations-seed-version=20240522-180050.589000 /prefetch:8
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5424 --field-trial-handle=1872,i,971447721362458093,7267231496120252884,262144 --variations-seed-version=20240522-180050.589000 /prefetch:8

Show all 11 entries

chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5572 --field-trial-handle=1872,i,971447721362458093,7267231496120252884,262144 --variations-seed-version=20240522-180050.589000 /prefetch:8
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5868 --field-trial-handle=1872,i,971447721362458093,7267231496120252884,262144 --variations-seed-version=20240522-180050.589000 /prefetch:8
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5716 --field-trial-handle=1872,i,971447721362458093,7267231496120252884,262144 --variations-seed-version=20240522-180050.589000 /prefetch:8
SAFlashPlayer.exe%SAMPLEPATH%\SAFlashPlayer.exe
eb84edd6bc07dbbe12f835883689e01398b3c36bb49261a69ed9cde8e1e38eb5.exe%SAMPLEPATH%\eb84edd6bc07dbbe12f835883689e01398b3c36bb49261a69ed9cde8e1e38eb5.exe

Network contacts

17 hosts, listed as 12 domains, 5 addresses, 1 link. Links show the host and path only.

Domaincdn.onenote.net
Domainivanaedler.github.io
Domainaccounts.google.com
Domain_googlecast._tcp.local
Domainwww.gstatic.com
Domainau-bg-shim.trafficmanager.net

Show all 18 entries

Domainaudownload.windowsupdate.nsatc.net
Domaincs11.wpc.v0cdn.net
Domainhlb.apr-52dd2-0.edgecastdns.net
Domainwu.azureedge.net
Domainwu.ec.azureedge.net
Domainwu.wpc.apr-52dd2.edgecastdns.net
IP address104.69.90.31
IP address142.250.126.84
IP address185.199.108.153
IP address142.250.126.94
IP address23.59.198.43
URLhttp://www.gstatic.com/generate_204

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
WrittenC:\Users\user\AppData\Roaming\Adobe\Flash Player\AssetCache
WrittenC:\Users\user\AppData\Roaming\Adobe\Flash Player\AssetCache\MB2Q8XSB
WrittenC:\Users\user\AppData\Roaming\Macromedia
WrittenC:\Users\user\AppData\Roaming\Macromedia\Flash Player
WrittenC:\Users\user\AppData\Roaming\Macromedia\Flash Player\#SharedObjects

Show all 30 entries

WrittenC:\Users\user\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\46BQ4N72
WrittenC:\Users\user\AppData\Roaming\Macromedia\Flash Player\macromedia.com
WrittenC:\Users\user\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support
WrittenC:\Users\user\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer
WrittenC:\Users\user\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys
WrittenC:\Users\user\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx
WrittenC:\Users\user\AppData\Roaming\Adobe\Flash Player\AssetCache\PSS3AMFN
WrittenC:\Users\user\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\BSXKSDKN
WrittenC:\Users\user\AppData\Roaming\Adobe\Flash Player\AssetCache\NTGS2GZ3
DeletedC:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
DeletedC:\Users\<USER>\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx
Deleted%USERPROFILE%\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER26BD.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER26ED.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER27D6.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER27E7.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER2826.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER2827.tmp.txt
DeletedC:\Windows\System32\spp\store\2.0\cache\cache.dat
DeletedC:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_cbbb49d6-b7ff-44ca-aba5-8a5e250d4d42
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER2C6A.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER2DB2.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER2E01.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER64A0.tmp.WERInternalMetadata.xml

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

SetHKLM\SYSTEM\ControlSet001\Control\WMI\AutoLogger\Circular Kernel Context Logger\Status
SetHKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\4fc43890_0\(Default)
SetHKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name
SetHKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\4fc43890_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F}\3
SetHKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\4fc43890_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F}\5
SetHKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\4fc43890_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F}\4

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

Local\DirectSound DllMain mutex (0x000005E0)
\Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x00000128)
\Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x00001B80)
\Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x00001140)
\Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x000005AC)
\Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x00001E38)

Show all 10 entries

\Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x00000FD8)
\Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x00001804)
\Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x00001A94)
\Sessions\1\BaseNamedObjects\Local\DirectSound DllMain mutex (0x000015A4)

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processwuapihost.exeC:\Windows\System32\wuapihost.exe
VM processUI0Detect.exeC:\Windows\System32\UI0Detect.exe
VM processupdater.exeC:\Program Files\Google3176_682182568\bin\updater.exe
VM processupdater.exeC:\Program Files\Google1528_31880026\bin\updater.exe
VM injection targetC:\Program Files\Google3176_682182568\bin\updater.exe
VM injection targetC:\Program Files\Google1528_31880026\bin\updater.exe

Show all 35 entries

VM injection targetC:\Program Files\Google4068_281049622\bin\updater.exe
VM injection targetC:\Program Files\Google3912_393500154\bin\updater.exe
VM injection targetC:\Program Files\Google3196_219038142\bin\updater.exe
VM injection targetC:\Program Files\Google3284_1467245704\bin\updater.exe
VM injection targetC:\Program Files\Google2928_1478182116\bin\updater.exe
VM hostquery.prod.cms.rt.microsoft.com
VM hostwww.microsoft.com
VM hostres.public.onecdn.static.microsoft
VM hostctldl.windowsupdate.com
VM host82.250.63.168.in-addr.arpa
VM host183.209.82.20.in-addr.arpa
VM host152.251.123.92.in-addr.arpa
VM host0.204.248.87.in-addr.arpa
VM host239.255.255.250
VM host224.0.0.251
VM host104.86.182.43
VM host192.168.0.73
VM host20.80.129.13
VM host23.216.147.64
VM host20.62.24.77
VM host20.99.133.109
VM host23.216.147.76
VM host20.99.184.37
VM host131.253.33.203
VM host192.229.211.108
VM host20.99.186.246
VM host20.99.185.48
VM host192.168.0.84
VM URLhttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

872ff17a2d3c880c9f85…5372b9Not checked
no saved verdict
deb45dff9ee2c453aead…dfb6edNot checked
no saved verdict
1e6364e1a33cce939507…3e6869Not checked
no saved verdict
c8746efeca1edd7e9d9a…24817cNot checked
no saved verdict
5c1258ed8363e7d550d8…c46df7Not checked
no saved verdict
4b4f70069e2072c81219…3fe971Not checked
no saved verdict
0fa298e52c17a5d4d382…76b142Not checked
no saved verdict
77e344951051c2eb1717…9150c0Not checked
no saved verdict
abdf891f396f69dad5c3…97becdNot checked
no saved verdict
4428c7d57355e006ab1e…b88411Not checked
no saved verdict

Chapter 04

Technical details

None of the 70 antivirus engines that checked it flag it; no publisher signature.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 70 engines flagged it · 5 gave no result DetailsSep 9, 2026

Sandbox runVirusTotal sandboxesCompleteCombined summary: clean verdict DetailsOct 16, 2026

Contacted hostsMalwareTips URL scannerComplete36 contacted hosts checked DetailsOct 16, 2026

Signature rulesYARAify community rules + MalwareTips rulesCompleteNo rule matchedOct 16, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedOct 16, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchOct 16, 2026

File fingerprint

Last analyzed: Oct 16, 2026, 9:20 PM UTC

SHA-256: eb84edd6bc07dbbe12f835883689e01398b3c36bb49261a69ed9cde8e1e38eb5
SHA-1: ab0fa013436603aa6a289631af3408b0ccf68aec
MD5: 9e75ccec9f6710d2f246966cd95a48ff

About this file

SAFlashPlayer.exe is a Win32 EXE file of 53.1 MB.

Type and size: Win32 EXE · 53.1 MB
Signer: UnsignedNo code signature.
First seen: Nov 21, 2018On VirusTotal.
Submitted by: 1,884 distinct sources
Packer: None detected
Entropy: 6.74 of 8

First scanned Oct 16, 2026

Antivirus consensus

0 of 70 engines flagged this file

0 malicious0 suspicious70 not flagged5 no result

5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-235 engines
0flagged
Low-trust17 engines
0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticNo result
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 6.74Unpacked

Section entropy6 sections

.text

6.73

.rodata

4.17

.rdata

6.73

.data

7.55

.rsrc

6.19

.reloc

5.60

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

1,884

Hundreds of people have uploaded this — common.

Total submissions

2,106

Includes repeat uploads by the same source.

First seen

8y ago

Nov 21, 2018

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is SAFlashPlayer.exe safe?

We found nothing harmful in SAFlashPlayer.exe. None of the 70 antivirus engines that checked it flag it. Run it only if it came from the developer's own website or an official app store.

What is SAFlashPlayer.exe?

SAFlashPlayer.exe is a Windows program, about 53.1 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Nov 21, 2018.

How many antivirus engines detected SAFlashPlayer.exe?

None of the 70 antivirus engines that checked it flag SAFlashPlayer.exe. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

What is the SHA-256 hash of SAFlashPlayer.exe?

The SHA-256 fingerprint of SAFlashPlayer.exe is eb84edd6bc07dbbe12f835883689e01398b3c36bb49261a69ed9cde8e1e38eb5, and its MD5 is 9e75ccec9f6710d2f246966cd95a48ff. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to run SAFlashPlayer.exe?

We found nothing harmful in SAFlashPlayer.exe. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of SAFlashPlayer.exe?

This report reflects the scan on Oct 16, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is SAFlashPlayer.exe safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

About this file

0 of 70 engines flagged this file

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is SAFlashPlayer.exe safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

File fingerprint

About this file

Related file reports