File name:

MDE_File_Sample_5f4485615c870b5ec03f0aa7591a04f330b3a2f6.zip

Full analysis: https://app.any.run/tasks/722c86c9-2283-46ab-94e6-94c9b6a50e07
Verdict: Malicious activity
Analysis date: September 15, 2022, 10:47:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

67FF509F87F2BBBBDC5F4DB39FEC2293

SHA1:

84D3C61B0855989032C275D5022CAB8481380341

SHA256:

1BF7E23F0FA7A0BCD4F5A66DB9B20AB6323F485A61DD53C9FA9A874CEBD38CFF

SSDEEP:

196608:4nozAcEWwr7nmdKYC05ZVtDyHpwP8thBpNerbhqkwmRZ8:PzAcEWSGC6KLfBuxqknH8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GOMPLAYERENSETUP.EXE (PID: 3824)
      • GOMPLAYERENSETUP.EXE (PID: 2956)
      • KillGom.exe (PID: 2732)
      • GOM.exe (PID: 3368)
      • GOM.exe (PID: 848)
      • AskInstallChecker.exe (PID: 948)
      • ShellRegister.exe (PID: 1684)
      • GOM.exe (PID: 2888)
      • GomWiz.exe (PID: 3340)
      • GOM.exe (PID: 1324)
      • GrLauncher.exe (PID: 2696)
      • GrLauncher.exe (PID: 2892)
      • GrLauncherTempSetup.exe (PID: 3572)
      • GrLauncherTempSetup.exe (PID: 2972)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2060)
      • GOMPLAYERENSETUP.EXE (PID: 3824)
      • GOM.exe (PID: 1324)
      • GrLauncher.exe (PID: 2892)
      • GrLauncherTempSetup.exe (PID: 2972)

    • Loads dropped or rewritten executable

      • GOMPLAYERENSETUP.EXE (PID: 3824)
      • GOM.exe (PID: 848)
      • svchost.exe (PID: 1712)
      • DllHost.exe (PID: 2912)
      • GomWiz.exe (PID: 3340)
      • DllHost.exe (PID: 712)
      • GOM.exe (PID: 1324)
      • GrLauncherTempSetup.exe (PID: 2972)

    • Steals credentials from Web Browsers

      • AskInstallChecker.exe (PID: 948)

    • Actions looks like stealing of personal data

      • AskInstallChecker.exe (PID: 948)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2060)
      • GOMPLAYERENSETUP.EXE (PID: 3824)
      • GOM.exe (PID: 1324)
      • GrLauncher.exe (PID: 2892)
      • GrLauncherTempSetup.exe (PID: 2972)

    • Reads the computer name

      • WinRAR.exe (PID: 2060)
      • GOMPLAYERENSETUP.EXE (PID: 3824)
      • AskInstallChecker.exe (PID: 948)
      • GOM.exe (PID: 848)
      • GOM.exe (PID: 2888)
      • GomWiz.exe (PID: 3340)
      • GOM.exe (PID: 1324)
      • GrLauncher.exe (PID: 2696)
      • GrLauncher.exe (PID: 2892)
      • GrLauncherTempSetup.exe (PID: 2972)

    • Checks supported languages

      • WinRAR.exe (PID: 2060)
      • GOMPLAYERENSETUP.EXE (PID: 3824)
      • KillGom.exe (PID: 2732)
      • ShellRegister.exe (PID: 1684)
      • GOM.exe (PID: 3368)
      • AskInstallChecker.exe (PID: 948)
      • GOM.exe (PID: 848)
      • GOM.exe (PID: 2888)
      • GomWiz.exe (PID: 3340)
      • GrLauncher.exe (PID: 2696)
      • GrLauncher.exe (PID: 2892)
      • GOM.exe (PID: 1324)
      • GrLauncherTempSetup.exe (PID: 2972)

    • Creates a directory in Program Files

      • GOMPLAYERENSETUP.EXE (PID: 3824)

    • Reads Environment values

      • GOMPLAYERENSETUP.EXE (PID: 3824)

    • Drops a file with a compile date too recent

      • GOMPLAYERENSETUP.EXE (PID: 3824)
      • WinRAR.exe (PID: 2060)
      • GOM.exe (PID: 1324)
      • GrLauncher.exe (PID: 2892)
      • GrLauncherTempSetup.exe (PID: 2972)

    • Changes default file association

      • ShellRegister.exe (PID: 1684)
      • GOM.exe (PID: 848)
      • GOMPLAYERENSETUP.EXE (PID: 3824)
      • DllHost.exe (PID: 712)
      • DllHost.exe (PID: 2912)

    • Creates files in the Windows directory

      • GOMPLAYERENSETUP.EXE (PID: 3824)

    • Creates files in the program directory

      • GOMPLAYERENSETUP.EXE (PID: 3824)

    • Executed via COM

      • DllHost.exe (PID: 2912)
      • DllHost.exe (PID: 712)

    • Creates a software uninstall entry

      • GOMPLAYERENSETUP.EXE (PID: 3824)

    • Creates files in the user directory

      • GOMPLAYERENSETUP.EXE (PID: 3824)
      • GOM.exe (PID: 2888)
      • GOM.exe (PID: 1324)
      • GrLauncher.exe (PID: 2892)

    • Reads CPU info

      • GOM.exe (PID: 1324)

    • Reads Microsoft Outlook installation path

      • GOM.exe (PID: 1324)

    • Reads internet explorer settings

      • GOM.exe (PID: 1324)

    • Creates/Modifies COM task schedule object

      • GOMPLAYERENSETUP.EXE (PID: 3824)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • GOMPLAYERENSETUP.EXE (PID: 3824)

    • Checks supported languages

      • DllHost.exe (PID: 2912)
      • DllHost.exe (PID: 712)

    • Reads the computer name

      • DllHost.exe (PID: 2912)
      • DllHost.exe (PID: 712)

    • Checks Windows Trust Settings

      • GOMPLAYERENSETUP.EXE (PID: 3824)
      • GrLauncher.exe (PID: 2892)
      • GrLauncherTempSetup.exe (PID: 2972)

    • Manual execution by user

      • GOM.exe (PID: 2888)

    • Reads settings of System Certificates

      • GOMPLAYERENSETUP.EXE (PID: 3824)
      • GOM.exe (PID: 1324)
      • GrLauncher.exe (PID: 2892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
18
Malicious processes
13
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe gomplayerensetup.exe no specs gomplayerensetup.exe killgom.exe no specs shellregister.exe no specs gom.exe no specs askinstallchecker.exe gom.exe no specs svchost.exe no specs DllHost.exe no specs gom.exe no specs gomwiz.exe no specs VSUtil no specs gom.exe grlauncher.exe grlauncher.exe grlaunchertempsetup.exe no specs grlaunchertempsetup.exe

Process information

PID
CMD
Path
Indicators
Parent process
712C:\Windows\system32\DllHost.exe /Processid:{2DB4F9B7-144E-4319-B14A-432AC74C0CEF}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
848"C:\Program Files\GRETECH\GomPlayer\GOM.exe" /regassocC:\Program Files\GRETECH\GomPlayer\GOM.exe—GOMPLAYERENSETUP.EXE
User:
admin
Company:
Gretech Corp.
Integrity Level:
HIGH
Description:
GOM Player
Exit code:
0
Version:
2, 1, 33, 5071
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\program files\gretech\gomplayer\gom.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
948C:\Users\admin\AppData\Local\Temp\AskInstallChecker.exe GOM2C:\Users\admin\AppData\Local\Temp\AskInstallChecker.exe
GOMPLAYERENSETUP.EXE
User:
admin
Company:
Ask.com
Integrity Level:
HIGH
Description:
Install Checker
Exit code:
0
Version:
1.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\askinstallchecker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1324"C:\Program Files\GRETECH\GomPlayer\GOM.exe" C:\Program Files\GRETECH\GomPlayer\GOM.exe
GomWiz.exe
User:
admin
Company:
Gretech Corp.
Integrity Level:
MEDIUM
Description:
GOM Player
Exit code:
0
Version:
2, 1, 33, 5071
Modules
Images
c:\program files\gretech\gomplayer\gom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1684"C:\Program Files\GRETECH\GomPlayer\ShellRegister.exe"C:\Program Files\GRETECH\GomPlayer\ShellRegister.exe—GOMPLAYERENSETUP.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\kernel32.dll
c:\program files\gretech\gomplayer\shellregister.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1712C:\Windows\system32\svchost.exe -k RPCSSC:\Windows\system32\svchost.exe—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\rpcepmap.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\secur32.dll
2060"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\MDE_File_Sample_5f4485615c870b5ec03f0aa7591a04f330b3a2f6.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
2696"C:\Program Files\GRETECH\GomPlayer\GrLauncher.exe"" <GRLAUNCHER_PARAM Command='checkversion' AgentName='GomPlayer 2, 1, 33, 5071 (ENG)' ProgramID='GOMPLAYER2' ForceCheck='0' CheckMinorVersion='1' RetWindowHandle='524688' LocalVersionFilePath='C:\Users\admin\AppData\Roaming\GRETECH\GomPlayer\GrVersion.ini' />"C:\Program Files\GRETECH\GomPlayer\GrLauncher.exe
GOM.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
41
Modules
Images
c:\program files\gretech\gomplayer\grlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\usp10.dll
2732"C:\Program Files\GRETECH\GomPlayer\KillGom.exe" GOM.EXEC:\Program Files\GRETECH\GomPlayer\KillGom.exe—GOMPLAYERENSETUP.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\gretech\gomplayer\killgom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
2888"C:\Program Files\GRETECH\GomPlayer\GOM.exe" C:\Program Files\GRETECH\GomPlayer\GOM.exe—Explorer.EXE
User:
admin
Company:
Gretech Corp.
Integrity Level:
MEDIUM
Description:
GOM Player
Exit code:
0
Version:
2, 1, 33, 5071
Modules
Images
c:\program files\gretech\gomplayer\gom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winmm.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
Total events
28 982
Read events
14 370
Write events
14 603
Delete events
9

Modification events

(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2060) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\MDE_File_Sample_5f4485615c870b5ec03f0aa7591a04f330b3a2f6.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
47
Suspicious files
7
Text files
332
Unknown types
89

Dropped files

PID
Process
Filename
Type
2060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2060.1329\GOMPLAYERENSETUP.EXEexecutable
MD5:—
SHA256:—
3824GOMPLAYERENSETUP.EXEC:\Users\admin\AppData\Local\Temp\NSISPromotionEx.dllexecutable
MD5:—
SHA256:—
3824GOMPLAYERENSETUP.EXEC:\Program Files\GRETECH\GomPlayer\GOM.exeexecutable
MD5:—
SHA256:—
3824GOMPLAYERENSETUP.EXEC:\Users\admin\AppData\Local\Temp\nstF169.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
3824GOMPLAYERENSETUP.EXEC:\Users\admin\AppData\Local\Temp\NSISPromotionEx.initext
MD5:FF5F0C84C510C5D69F7FA5774C8BAC7E
SHA256:56DDBB25A7FEAE8DA47A3DADE69A8F513E99AC5E1AB010DC1DEB94105745F0A8
3824GOMPLAYERENSETUP.EXEC:\Users\admin\AppData\Local\Temp\spltmp.bmpimage
MD5:D4C147D4EEBA482BA53F9A6FF6101E31
SHA256:1C33A2C72449468A285E183ED9E71C81D439FD7F6CE67DA51F50CA8D1631D665
3824GOMPLAYERENSETUP.EXEC:\Users\admin\AppData\Local\Temp\nstF169.tmp\InstallOptions.dllexecutable
MD5:325B008AEC81E5AAA57096F05D4212B5
SHA256:C9CD5C9609E70005926AE5171726A4142FFBCCCC771D307EFCD195DAFC1E6B4B
3824GOMPLAYERENSETUP.EXEC:\Program Files\GRETECH\GomPlayer\GomX.dllexecutable
MD5:C892F82FDA41C02904242E6B2CA991BE
SHA256:1A57659DE2DD38DA23DB4AD39AEA25EEA32980F5EA910E077F8B4D7199EB295A
3824GOMPLAYERENSETUP.EXEC:\Users\admin\AppData\Local\Temp\nstF169.tmp\SkinKidslock.iniini
MD5:BDEE298E2F72ABB6C2E6D4AC4E3A436E
SHA256:7226614E56D843B447EEA362FDF14787A7B02778546517214E27F7610DCB64EA
3824GOMPLAYERENSETUP.EXEC:\Users\admin\AppData\Local\Temp\nstF169.tmp\AdvSplash.dllexecutable
MD5:C098AF110A7935DE4100BFAFA3065635
SHA256:B475C7C4CA8293E785D845C9D4886DC5B6D6EC994E01FC781EFE2FAE180DEA7B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
22
DNS requests
14
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
948
AskInstallChecker.exe
GET
—
34.102.132.13:80
http://websearch.ask.com/preinstall?client=ic&tb=GOM2&r=0&ipid=&npid=GOM2&iev=9&ielu=0&fflu=0&iv=&nv=1.8.0.0&clientv=1.5.0.0&rep=0
US
—
—
suspicious
3824
GOMPLAYERENSETUP.EXE
GET
200
54.84.188.188:80
http://app.gomlab.com/eng/gom/PromotionCheck.php
US
text
495 b
unknown
3824
GOMPLAYERENSETUP.EXE
GET
302
18.66.127.70:80
http://www.gomlab.com/
US
html
206 b
malicious
3824
GOMPLAYERENSETUP.EXE
GET
302
18.66.127.70:80
http://www.gomlab.com/ipCheck/ipCheck.php
US
html
206 b
malicious
3824
GOMPLAYERENSETUP.EXE
GET
200
54.84.188.188:80
http://app.gomlab.com/eng/gomaudio/promo/audio.jpg
US
image
119 Kb
unknown
2972
GrLauncherTempSetup.exe
GET
200
18.66.248.88:80
http://playinfo.gomlab.com/cms/bundle/index.gom?version=1&mode=upgrade
US
html
4.85 Kb
whitelisted
948
AskInstallChecker.exe
GET
200
34.117.224.112:80
http://img.apnanalytics.com/images/nocache/apn/tr.gif?ev=eichk&cb=&encb=&chk=sucof&ts=Uciha&guid=
US
image
46 b
suspicious
2696
GrLauncher.exe
GET
200
54.84.188.188:80
http://app.gomlab.com/eng/gom/GrVersionEN.ini
US
text
843 b
unknown
3824
GOMPLAYERENSETUP.EXE
GET
200
52.222.250.174:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
3824
GOMPLAYERENSETUP.EXE
GET
200
108.138.2.107:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
948
AskInstallChecker.exe
34.102.132.13:80
websearch.ask.com
—
US
suspicious
3824
GOMPLAYERENSETUP.EXE
54.84.188.188:80
app.gomlab.com
Amazon.com, Inc.
US
unknown
948
AskInstallChecker.exe
34.117.224.112:80
img.apnanalytics.com
—
US
suspicious
3824
GOMPLAYERENSETUP.EXE
18.66.127.70:80
www.gomlab.com
Massachusetts Institute of Technology
US
unknown
3824
GOMPLAYERENSETUP.EXE
18.66.127.70:443
www.gomlab.com
Massachusetts Institute of Technology
US
unknown
3824
GOMPLAYERENSETUP.EXE
23.216.77.69:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious
3824
GOMPLAYERENSETUP.EXE
108.138.2.107:80
o.ss2.us
BellSouth.net Inc.
US
whitelisted
3824
GOMPLAYERENSETUP.EXE
52.222.250.174:80
ocsp.rootg2.amazontrust.com
Amazon.com, Inc.
US
whitelisted
2696
GrLauncher.exe
54.84.188.188:80
app.gomlab.com
Amazon.com, Inc.
US
unknown
3824
GOMPLAYERENSETUP.EXE
52.222.250.185:80
ocsp.rootg2.amazontrust.com
Amazon.com, Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
websearch.ask.com
  • 34.102.132.13
suspicious
img.apnanalytics.com
  • 34.117.224.112
suspicious
app.gomlab.com
  • 54.84.188.188
  • 34.228.179.180
  • 54.210.56.184
unknown
www.gomlab.com
  • 18.66.127.70
malicious
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
o.ss2.us
  • 108.138.2.107
  • 108.138.2.195
  • 108.138.2.173
  • 108.138.2.10
whitelisted
ocsp.rootg2.amazontrust.com
  • 52.222.250.174
  • 52.222.250.185
  • 52.222.250.42
  • 52.222.250.112
whitelisted
ocsp.rootca1.amazontrust.com
  • 52.222.250.185
  • 52.222.250.174
  • 52.222.250.112
  • 52.222.250.42
shared
info.gomplayer.com
  • —
unknown
geo2.adobe.com
  • 23.35.236.137
whitelisted

Threats

PID
Process
Class
Message
948
AskInstallChecker.exe
Potential Corporate Privacy Violation
ET POLICY Suspicious User Agent (AskInstallChecker)
948
AskInstallChecker.exe
Potential Corporate Privacy Violation
ET POLICY Suspicious User Agent (AskInstallChecker)
2972
GrLauncherTempSetup.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MDE_File_Sample_5f4485615c870b5ec03f0aa7591a04f330b3a2f6.zip