• Detects network connections and DNS queries initiated by Regsvr32.exe
• Detects "cmd" utilization to self-delete files in some critical Windows destinations
• Detects modification of autostart extensibility point (ASEP) in registry

• Matches rule MALWARE-CNC DNS Fast Flux attempt from Snort registered user ruleset -> trojan-activity

Where did you download yours from?

Those sigma rule detections are all nonsense. The installer registers shell extension when the player is intalled in normal mode instead of in portable mode and this would use regsvr32, but there is no network activity. The file deletions in "critical Windows destinations" listed there are temp file removals from Windows\TEMP, but these are not done by foobar2000. And the Autoruns keys modifications it reports are about Edge browser. I think the temp file removals were also caused by Edge browser updater, possibly the regsvr32.exe network accesses were too.

Looks like the stupid system records all kinds of background activity taking place on their machine and blames it on the software you happened to scan.

Edit: I forgot to comment the "MALWARE-CNC DNS Fast Flux attempt" high risk trojan alert. If you look at the details entry, the supposed malware attack comes from Google's 8.8.8.8 DNS server. Other than that no idea what it is supposed to be about. foobar2000 installer doesn't access network, you can verify that by using Process Monitor to log all the activity it does. And foobar2000 only access network if you ask it to, for example to play a stream or to check for updates.

It may be possible that NSIS is designed to switch the machine into High Performance power profile for the duration of the install, but I kind of doubt it.