URL:

www.naver.com

Full analysis: https://app.any.run/tasks/74489815-5529-4c6b-862b-f5ced6c73dee
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: July 10, 2025, 05:20:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
inno
installer
stealer
adware
loader
Indicators:
MD5:

11A2A34FAF559CBFAF9B68F0E173E3E6

SHA1:

FED818DA7395E30442B1DCF45C9B6669D1C0FF6B

SHA256:

C451D1FDAF01B00BEF0CBE04A82A7557387FBF62F51E0B44DFD60559AC6AE08F

SSDEEP:

3:Ezmn:dn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • KillGom.exe (PID: 3196)
      • wememo Setup 1.2.0.exe (PID: 7844)
      • Wememo Service.exe (PID: 7668)
      • inchanter.exe (PID: 592)
      • Wememo Service.exe (PID: 6232)

    • Uses Task Scheduler to autorun other applications

      • secureconnection_install.exe (PID: 7616)

    • Actions looks like stealing of personal data

      • tabservicepack.exe (PID: 6360)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • secureconnection_install.exe (PID: 7616)
      • wememo Setup 1.2.0.exe (PID: 7844)

    • Executable content was dropped or overwritten

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)
      • secureconnection_install.exe (PID: 7616)
      • OroraBrowserInstaller2.2.exe (PID: 2692)
      • wememo Setup 1.2.0.exe (PID: 7844)
      • inchanter.exe (PID: 592)
      • GOM.EXE (PID: 1712)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • secureconnection_install.exe (PID: 7616)
      • wememo Setup 1.2.0.exe (PID: 7844)

    • Reads security settings of Internet Explorer

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • GrLauncher.exe (PID: 7552)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)
      • secureconnection_install.exe (PID: 7616)
      • wememo Setup 1.2.0.exe (PID: 7844)
      • Wememo Service.exe (PID: 7668)
      • inchanter.exe (PID: 592)
      • tabservicepack.exe (PID: 6360)
      • GOM.EXE (PID: 1712)
      • Toast.gom (PID: 7708)
      • ielowutil.exe (PID: 7748)
      • GrLauncher.exe (PID: 7756)

    • Process drops legitimate windows executable

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • wememo Setup 1.2.0.exe (PID: 7844)

    • Creates/Modifies COM task schedule object

      • GOMPLAYERKORSETUP.EXE (PID: 7628)

    • Reads Internet Explorer settings

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • Toast.gom (PID: 7708)
      • GOM.EXE (PID: 1712)

    • There is functionality for taking screenshot (YARA)

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)
      • GOM.EXE (PID: 1712)

    • Reads Microsoft Outlook installation path

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • GOM.EXE (PID: 1712)
      • Toast.gom (PID: 7708)

    • Creates a software uninstall entry

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • secureconnection_install.exe (PID: 7616)
      • wememo Setup 1.2.0.exe (PID: 7844)
      • Wememo Service.exe (PID: 7668)

    • Reads the Windows owner or organization settings

      • OroraBrowserInstaller2.2.tmp (PID: 4512)

    • Drops a system driver (possible attempt to evade defenses)

      • secureconnection_install.exe (PID: 7616)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 7852)
      • schtasks.exe (PID: 3836)

    • Creates a new Windows service

      • sc.exe (PID: 8056)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8008)

    • Starts CMD.EXE for commands execution

      • wememo Setup 1.2.0.exe (PID: 7844)

    • Get information on the list of running processes

      • wememo Setup 1.2.0.exe (PID: 7844)
      • cmd.exe (PID: 5908)

    • Drops 7-zip archiver for unpacking

      • wememo Setup 1.2.0.exe (PID: 7844)

    • Searches for installed software

      • Wememo Service.exe (PID: 7668)
      • Wememo Service.exe (PID: 6232)

    • Reads the date of Windows installation

      • inchanter.exe (PID: 592)

    • The process checks if it is being run in the virtual environment

      • GOM.EXE (PID: 1712)

    • Starts application with an unusual extension

      • GOM.EXE (PID: 1712)
      • Toast.gom (PID: 7800)

    • Application launched itself

      • Toast.gom (PID: 7800)
      • updater.exe (PID: 2132)

    • Process requests binary or script from the Internet

      • GOM.EXE (PID: 1712)

    • The process executes via Task Scheduler

      • updater.exe (PID: 2132)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 6860)
      • msedge.exe (PID: 4116)
      • msedge.exe (PID: 7580)
      • msedge.exe (PID: 8020)
      • msedge.exe (PID: 7064)
      • msedge.exe (PID: 2520)
      • msedge.exe (PID: 7800)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 6860)

    • Create files in a temporary directory

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • GrLauncher.exe (PID: 7552)
      • secureconnection_install.exe (PID: 7616)
      • OroraBrowserInstaller2.2.exe (PID: 2692)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)
      • wememo Setup 1.2.0.exe (PID: 7844)
      • GOM.EXE (PID: 1712)
      • GrLauncher.exe (PID: 7756)

    • Checks supported languages

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • KillGom.exe (PID: 3196)
      • GOM.EXE (PID: 2952)
      • GOM.EXE (PID: 7448)
      • GrLauncher.exe (PID: 7552)
      • secureconnection_install.exe (PID: 7616)
      • OroraBrowserInstaller2.2.exe (PID: 2692)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)
      • wememo Setup 1.2.0.exe (PID: 7844)
      • GOM.EXE (PID: 7744)
      • tabservicepack.exe (PID: 6360)
      • Wememo Service.exe (PID: 7668)
      • msiexec.exe (PID: 7260)
      • inchanter.exe (PID: 592)
      • identity_helper.exe (PID: 7844)
      • Wememo Service.exe (PID: 6232)
      • GOM.EXE (PID: 1712)
      • Toast.gom (PID: 7800)
      • Toast.gom (PID: 7708)
      • ielowutil.exe (PID: 7748)
      • GrLauncher.exe (PID: 7756)
      • identity_helper.exe (PID: 7220)
      • updater.exe (PID: 2132)
      • updater.exe (PID: 7108)

    • The sample compiled with korean language support

      • chrome.exe (PID: 6860)
      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • secureconnection_install.exe (PID: 7616)

    • Reads the computer name

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • GOM.EXE (PID: 2952)
      • OroraBrowserInstaller2.2.exe (PID: 2692)
      • GOM.EXE (PID: 7448)
      • GrLauncher.exe (PID: 7552)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)
      • secureconnection_install.exe (PID: 7616)
      • GOM.EXE (PID: 7744)
      • wememo Setup 1.2.0.exe (PID: 7844)
      • tabservicepack.exe (PID: 6360)
      • Wememo Service.exe (PID: 7668)
      • msiexec.exe (PID: 7260)
      • inchanter.exe (PID: 592)
      • identity_helper.exe (PID: 7844)
      • Wememo Service.exe (PID: 6232)
      • GOM.EXE (PID: 1712)
      • Toast.gom (PID: 7708)
      • ielowutil.exe (PID: 7748)
      • GrLauncher.exe (PID: 7756)
      • identity_helper.exe (PID: 7220)
      • updater.exe (PID: 2132)

    • The sample compiled with english language support

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • secureconnection_install.exe (PID: 7616)
      • wememo Setup 1.2.0.exe (PID: 7844)

    • Reads the software policy settings

      • slui.exe (PID: 7300)
      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • GrLauncher.exe (PID: 7552)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)
      • secureconnection_install.exe (PID: 7616)
      • tabservicepack.exe (PID: 6360)
      • Wememo Service.exe (PID: 7668)
      • inchanter.exe (PID: 592)
      • Wememo Service.exe (PID: 6232)
      • GOM.EXE (PID: 1712)
      • Toast.gom (PID: 7708)
      • GrLauncher.exe (PID: 7756)

    • Reads the machine GUID from the registry

      • GOM.EXE (PID: 2952)
      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • GrLauncher.exe (PID: 7552)
      • GOM.EXE (PID: 7448)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)
      • secureconnection_install.exe (PID: 7616)
      • GOM.EXE (PID: 7744)
      • Wememo Service.exe (PID: 7668)
      • tabservicepack.exe (PID: 6360)
      • inchanter.exe (PID: 592)
      • Wememo Service.exe (PID: 6232)
      • GOM.EXE (PID: 1712)
      • Toast.gom (PID: 7708)
      • GrLauncher.exe (PID: 7756)

    • Checks proxy server information

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • slui.exe (PID: 7300)
      • GrLauncher.exe (PID: 7552)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)
      • secureconnection_install.exe (PID: 7616)
      • tabservicepack.exe (PID: 6360)
      • Wememo Service.exe (PID: 7668)
      • inchanter.exe (PID: 592)
      • Wememo Service.exe (PID: 6232)
      • GOM.EXE (PID: 1712)
      • Toast.gom (PID: 7708)
      • GrLauncher.exe (PID: 7756)
      • ielowutil.exe (PID: 7748)

    • Creates files or folders in the user directory

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • GrLauncher.exe (PID: 7552)
      • GOM.EXE (PID: 7448)
      • secureconnection_install.exe (PID: 7616)
      • wememo Setup 1.2.0.exe (PID: 7844)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)
      • Wememo Service.exe (PID: 7668)
      • inchanter.exe (PID: 592)
      • Wememo Service.exe (PID: 6232)
      • GOM.EXE (PID: 1712)
      • Toast.gom (PID: 7708)
      • GrLauncher.exe (PID: 7756)

    • Creates files in the program directory

      • GOMPLAYERKORSETUP.EXE (PID: 7628)
      • GrLauncher.exe (PID: 7552)
      • secureconnection_install.exe (PID: 7616)
      • tabservicepack.exe (PID: 6360)
      • GOM.EXE (PID: 1712)

    • The sample compiled with chinese language support

      • GOMPLAYERKORSETUP.EXE (PID: 7628)

    • SQLite executable

      • wememo Setup 1.2.0.exe (PID: 7844)

    • Disables trace logs

      • tabservicepack.exe (PID: 6360)
      • Wememo Service.exe (PID: 7668)
      • inchanter.exe (PID: 592)
      • Wememo Service.exe (PID: 6232)

    • Detects InnoSetup installer (YARA)

      • OroraBrowserInstaller2.2.exe (PID: 2692)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)

    • Compiled with Borland Delphi (YARA)

      • OroraBrowserInstaller2.2.exe (PID: 2692)
      • OroraBrowserInstaller2.2.tmp (PID: 4512)

    • Manual execution by a user

      • msedge.exe (PID: 8020)
      • GOM.EXE (PID: 1712)

    • Process checks computer location settings

      • Wememo Service.exe (PID: 7668)
      • inchanter.exe (PID: 592)

    • Reads Environment values

      • inchanter.exe (PID: 592)
      • identity_helper.exe (PID: 7220)
      • identity_helper.exe (PID: 7844)

    • Reads product name

      • inchanter.exe (PID: 592)

    • Creates a software uninstall entry

      • OroraBrowserInstaller2.2.tmp (PID: 4512)

    • Process checks whether UAC notifications are on

      • GOM.EXE (PID: 1712)
      • updater.exe (PID: 2132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
273
Monitored processes
122
Malicious processes
7
Suspicious processes
7

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs gomplayerkorsetup.exe no specs gomplayerkorsetup.exe chrome.exe no specs killgom.exe no specs chrome.exe no specs gom.exe no specs gom.exe no specs VSUtil no specs grlauncher.exe secureconnection_install.exe ororabrowserinstaller2.2.exe no specs ororabrowserinstaller2.2.tmp schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs wememo setup 1.2.0.exe no specs gom.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs VSUtil no specs tabservicepack.exe wememo service.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs inchanter.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs wememo service.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs gom.exe toast.gom no specs toast.gom ielowutil.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs grlauncher.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs updater.exe no specs updater.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
480C:\WINDOWS\system32\schtasks.exe /Create /SC ONLOGON /TN SecureConnectionCheck /TR "'C:\ProgramData\secureconnection\secureconnection.exe' /sch2" /RL HIGHESTC:\Windows\SysWOW64\schtasks.exe—secureconnection_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
592"C:\Users\admin\AppData\Local\Programs\wememo\wememo service\inchanter.exe" 2.3.5 2.3.0 963C68AA8270 gB7y0nLx6sQS gom_rs https://api.socialfriendsinc.comC:\Users\admin\AppData\Local\Programs\wememo\wememo service\inchanter.exe
Wememo Service.exe
User:
admin
Integrity Level:
HIGH
Description:
inchanter
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\programs\wememo\wememo service\inchanter.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4388,i,15731759779797035597,15117780289019133253,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4092 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,14599297774573090777,2137758823408800024,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
868"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3648,i,18132792858669382130,16990556559809227416,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
868"msiexec" /x {FBF3373F-624F-470B-BC17-8EE4B4933C63} /qnC:\Windows\SysWOW64\msiexec.exe—Wememo Service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
1605
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
892"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5776,i,14599297774573090777,2137758823408800024,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --disable-quic --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=3996,i,14599297774573090777,2137758823408800024,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1160"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3960,i,14599297774573090777,2137758823408800024,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
61 397
Read events
58 474
Write events
2 800
Delete events
123

Modification events

(PID) Process:(6860) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6860) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6860) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6860) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6860) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6860) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling\Dictionaries
Operation:delete valueName:en-US
Value:
(PID) Process:(6860) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling\Dictionaries
Operation:delete valueName:en
Value:
(PID) Process:(6860) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling\Dictionaries
Operation:delete valueName:_Global_
Value:
(PID) Process:(7628) GOMPLAYERKORSETUP.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\GOM
Operation:writeName:USMID
Value:
E3F863121B7E46E28A1AB25E5C840E5E
(PID) Process:(7628) GOMPLAYERKORSETUP.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
152
Suspicious files
636
Text files
1 280
Unknown types
0

Dropped files

PID
Process
Filename
Type
6860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF1759d8.TMP —
MD5:—
SHA256:—
6860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old~RF1759e7.TMP —
MD5:—
SHA256:—
6860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
6860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF175a07.TMP —
MD5:—
SHA256:—
6860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF175a07.TMP —
MD5:—
SHA256:—
6860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old~RF175a16.TMP —
MD5:—
SHA256:—
6860chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
92
TCP/UDP connections
560
DNS requests
534
Threats
63

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1944
chrome.exe
GET
200
142.250.186.78:80
http://clients2.google.com/time/1/current?cup2key=8:y2rffzGZl_CSZ-PW7C-HdPSARrmPlctQDvYZWHdMv24&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
7680
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAtN2FlY2ZjMDg0NmNj/1.0.0.17_llkgjffcdpffmhiakmfcdcblohccpfmo.crx
unknown
—
—
whitelisted
6700
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7628
GOMPLAYERKORSETUP.EXE
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
7628
GOMPLAYERKORSETUP.EXE
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
7628
GOMPLAYERKORSETUP.EXE
GET
200
104.78.173.167:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAsItdjkZt4h6uHSonYxKRY%3D
unknown
—
—
whitelisted
7628
GOMPLAYERKORSETUP.EXE
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
7628
GOMPLAYERKORSETUP.EXE
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQCTi7COYph7T3X5jLalBFyW
unknown
—
—
whitelisted
7628
GOMPLAYERKORSETUP.EXE
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRyyuDOSqb8BtprWZSAvBT9kFoYdwQU%2BftQxItnu2dk%2FoMhpqnOP1WEk5kCEQCuCRPcOletDZfT3qqvgrvv
unknown
—
—
whitelisted
7628
GOMPLAYERKORSETUP.EXE
GET
200
151.101.194.133:80
http://ocsp2.globalsign.com/rootr3/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCDQHuXyId%2FGI71DM6hVc%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4112
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1944
chrome.exe
216.58.206.42:443
safebrowsingohttpgateway.googleapis.com
GOOGLE
US
whitelisted
1944
chrome.exe
142.250.186.78:80
google.com
GOOGLE
US
whitelisted
1944
chrome.exe
23.48.205.14:80
www.naver.com
AKAMAI-AS
US
whitelisted
1944
chrome.exe
74.125.206.84:443
accounts.google.com
GOOGLE
US
whitelisted
1944
chrome.exe
23.48.205.14:443
www.naver.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 216.58.206.42
  • 142.250.185.106
  • 142.250.74.202
  • 172.217.18.106
  • 142.250.186.106
  • 142.250.185.138
  • 142.250.186.74
  • 142.250.185.74
  • 142.250.185.234
  • 142.250.181.234
  • 142.250.185.202
  • 172.217.16.202
  • 216.58.206.74
  • 172.217.18.10
  • 142.250.186.42
  • 142.250.185.170
whitelisted
clients2.google.com
  • 142.250.186.78
whitelisted
www.naver.com
  • 23.48.205.14
whitelisted
accounts.google.com
  • 74.125.206.84
whitelisted
ssl.pstatic.net
  • 23.212.205.62
  • 23.201.244.241
whitelisted
pm.pstatic.net
  • 2.18.160.195
whitelisted
nam.veta.naver.com
  • 203.104.162.225
whitelisted
ntm.pstatic.net
  • 2.18.160.195
whitelisted

Threats

PID
Process
Class
Message
1944
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
1944
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
1944
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
1944
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
1944
chrome.exe
Misc activity
INFO [ANY.RUN] Possible short link service (t .co)
1944
chrome.exe
Misc activity
INFO [ANY.RUN] Possible short link service (t .co)
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
1944
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
1944
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
1944
chrome.exe
Misc activity
INFO [ANY.RUN] Possible short link service (t .co)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
www.naver.com