download:

GOMPLAYERGLOBALSETUP_CHROME.EXE

Full analysis: https://app.any.run/tasks/3199616c-9634-443f-aa9e-5787ec856e5d
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: August 08, 2019, 16:43:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
pua
lavasoft
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

ABA1B17CED973160AAE3405B32F42895

SHA1:

6EF21C43927B200B9E5CD8367154A4E45D525209

SHA256:

D51782B1E50F80202767E89440B57CC7A2A876ECC28192B3D2D8416F7DC6B788

SSDEEP:

393216:LRqE6KfHoOz4uIfVl5k5Q5THbme9el1ivJPXI7WQWu6p3SY5tlzU07mOhor:LcK/lI9l5k5Q5d9a1QPUW9pttlwWhi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • GOMPLAYERGLOBALSETUP_CHROME.EXE (PID: 2672)
      • GOM.exe (PID: 2060)
      • GOM.exe (PID: 2940)
      • svchost.exe (PID: 684)
      • GOM.exe (PID: 2416)
      • GenericSetup.exe (PID: 764)
      • DllHost.exe (PID: 2056)
      • DllHost.exe (PID: 1296)
      • explorer.exe (PID: 128)
      • GenericSetup.exe (PID: 3240)
      • OfferInstaller.exe (PID: 1864)
      • GOM.exe (PID: 3524)

    • Application was dropped or rewritten from another process

      • KillGom.exe (PID: 4000)
      • KillGom.exe (PID: 3740)
      • GOM.exe (PID: 2060)
      • GRLauncher.exe (PID: 3916)
      • GOM.exe (PID: 2940)
      • GOM.exe (PID: 2416)
      • RunAfter.Exe (PID: 3808)
      • GenericSetup.exe (PID: 764)
      • installer.exe (PID: 2668)
      • GenericSetup.exe (PID: 3240)
      • OfferInstaller.exe (PID: 1864)
      • GrLauncher.exe (PID: 2996)
      • GOM.exe (PID: 3524)

    • LAVASOFT was detected

      • installer.exe (PID: 2668)

  • SUSPICIOUS

    • Reads internet explorer settings

      • GOMPLAYERGLOBALSETUP_CHROME.EXE (PID: 2672)
      • GOM.exe (PID: 3524)

    • Executable content was dropped or overwritten

      • GOMPLAYERGLOBALSETUP_CHROME.EXE (PID: 2672)
      • RunAfter.Exe (PID: 3808)

    • Reads Internet Cache Settings

      • GOMPLAYERGLOBALSETUP_CHROME.EXE (PID: 2672)
      • explorer.exe (PID: 128)
      • GOM.exe (PID: 2940)
      • GOM.exe (PID: 2416)
      • GOM.exe (PID: 3524)

    • Creates files in the user directory

      • GOMPLAYERGLOBALSETUP_CHROME.EXE (PID: 2672)
      • GRLauncher.exe (PID: 3916)
      • GOM.exe (PID: 3524)
      • explorer.exe (PID: 128)

    • Creates COM task schedule object

      • GOMPLAYERGLOBALSETUP_CHROME.EXE (PID: 2672)

    • Modifies the open verb of a shell class

      • GOM.exe (PID: 2940)
      • GOM.exe (PID: 2060)
      • GOMPLAYERGLOBALSETUP_CHROME.EXE (PID: 2672)
      • DllHost.exe (PID: 2056)
      • GOM.exe (PID: 2416)

    • Creates a software uninstall entry

      • GOMPLAYERGLOBALSETUP_CHROME.EXE (PID: 2672)

    • Changes IE settings (feature browser emulation)

      • GOMPLAYERGLOBALSETUP_CHROME.EXE (PID: 2672)

    • Executed via COM

      • DllHost.exe (PID: 1296)
      • DllHost.exe (PID: 2056)

    • Reads Environment values

      • GenericSetup.exe (PID: 764)
      • GenericSetup.exe (PID: 3240)
      • OfferInstaller.exe (PID: 1864)

    • Reads the Windows organization settings

      • GenericSetup.exe (PID: 764)
      • GenericSetup.exe (PID: 3240)

    • Creates files in the program directory

      • GOMPLAYERGLOBALSETUP_CHROME.EXE (PID: 2672)
      • GOM.exe (PID: 3524)

    • Application launched itself

      • GenericSetup.exe (PID: 764)

    • Reads Windows owner or organization settings

      • GenericSetup.exe (PID: 764)
      • GenericSetup.exe (PID: 3240)

    • Starts Internet Explorer

      • GenericSetup.exe (PID: 3240)

    • Searches for installed software

      • GenericSetup.exe (PID: 3240)
      • explorer.exe (PID: 128)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • GOMPLAYERGLOBALSETUP_CHROME.EXE (PID: 2672)

    • Changes internet zones settings

      • iexplore.exe (PID: 2968)

    • Reads internet explorer settings

      • iexplore.exe (PID: 272)

    • Creates files in the user directory

      • iexplore.exe (PID: 272)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:07:25 02:55:51+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x33b6
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.3.43.5305
ProductVersionNumber: 2.3.43.5305
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
Comments: GOMPlayerGlobal Setup File
CompanyName: GOM & Company
FileDescription: GOMPlayerGlobal Setup File
FileVersion: 2.3
LegalCopyright: Copyright 2003 GOM & Company All Rights Reserved.
ProductName: GOMPlayerGlobal
ProductVersion: 2.3.43.5305

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Jul-2016 00:55:51
Detected languages:
  • English - United States
Comments: GOMPlayerGlobal Setup File
CompanyName: GOM & Company
FileDescription: GOMPlayerGlobal Setup File
FileVersion: 2.3
LegalCopyright: Copyright 2003 GOM & Company All Rights Reserved.
ProductName: GOMPlayerGlobal
ProductVersion: 2.3.43.5305

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 25-Jul-2016 00:55:51
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000615D
0x00006200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.45023
.rdata
0x00008000
0x000013A4
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.163
.data
0x0000A000
0x00020338
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.9824
.ndata
0x0002B000
0x000B0000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x000DB000
0x0006C5B0
0x0006C600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.65254

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28717
1069
UNKNOWN
English - United States
RT_MANIFEST
2
3.47045
67624
UNKNOWN
English - United States
RT_ICON
3
3.65747
38056
UNKNOWN
English - United States
RT_ICON
4
3.82093
16936
UNKNOWN
English - United States
RT_ICON
5
4.04606
9640
UNKNOWN
English - United States
RT_ICON
6
4.12208
4264
UNKNOWN
English - United States
RT_ICON
7
3.21467
1128
UNKNOWN
English - United States
RT_ICON
102
2.69372
180
UNKNOWN
English - United States
RT_DIALOG
103
2.86354
104
UNKNOWN
English - United States
RT_GROUP_ICON
104
2.65531
344
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
21
Malicious processes
10
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start drop and start start drop and start gomplayerglobalsetup_chrome.exe killgom.exe no specs killgom.exe no specs gom.exe no specs gom.exe no specs VSUtil no specs grlauncher.exe svchost.exe no specs gom.exe no specs VSUtil no specs runafter.exe #LAVASOFT installer.exe genericsetup.exe no specs explorer.exe no specs genericsetup.exe iexplore.exe iexplore.exe offerinstaller.exe gom.exe grlauncher.exe no specs gomplayerglobalsetup_chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
272"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2968 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
684C:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\rpcepmap.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\secur32.dll
764C:\Users\admin\AppData\Local\Temp\7zS0EEB5B08\GenericSetup.exe hhwnd=1180132 hasync hthankyoupage="http://www.gomlab.com/gom/installThanks.gom?product=gomplayer&lang=eng" title="GOM Player Setup"C:\Users\admin\AppData\Local\Temp\7zS0EEB5B08\GenericSetup.exe—installer.exe
User:
admin
Company:
adaware
Integrity Level:
HIGH
Description:
GOMPlayerGlobal Setup File
Exit code:
0
Version:
2.7.2.1624
Modules
Images
c:\users\admin\appdata\local\temp\7zs0eeb5b08\genericsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1296C:\Windows\system32\DllHost.exe /Processid:{2DB4F9B7-144E-4319-B14A-432AC74C0CEF}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1864"C:\Users\admin\AppData\Local\Temp\7zS0EEB5B08\OfferInstaller.exe" C:\Users\admin\AppData\Local\Temp\7zS0EEB5B08\OfferInstaller.exe
GenericSetup.exe
User:
admin
Integrity Level:
HIGH
Description:
GOMPlayerGlobal Setup File
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\7zs0eeb5b08\offerinstaller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2056C:\Windows\system32\DllHost.exe /Processid:{2DB4F9B7-144E-4319-B14A-432AC74C0CEF}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2060"C:\Program Files\GRETECH\GOMPlayer\GOM.exe" /RegServerC:\Program Files\GRETECH\GOMPlayer\GOM.exe—GOMPLAYERGLOBALSETUP_CHROME.EXE
User:
admin
Company:
GOM & Company
Integrity Level:
HIGH
Description:
GOM Player
Exit code:
0
Version:
2, 3, 43, 5305
Modules
Images
c:\program files\gretech\gomplayer\gom.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2296"C:\Users\admin\AppData\Local\Temp\GOMPLAYERGLOBALSETUP_CHROME.EXE" C:\Users\admin\AppData\Local\Temp\GOMPLAYERGLOBALSETUP_CHROME.EXE—explorer.exe
User:
admin
Company:
GOM & Company
Integrity Level:
MEDIUM
Description:
GOMPlayerGlobal Setup File
Exit code:
3221226540
Version:
2.3
Modules
Images
c:\users\admin\appdata\local\temp\gomplayerglobalsetup_chrome.exe
c:\systemroot\system32\ntdll.dll
2416"C:\Program Files\GRETECH\GOMPlayer\GOM.exe" /regassocC:\Program Files\GRETECH\GOMPlayer\GOM.exe—GOMPLAYERGLOBALSETUP_CHROME.EXE
User:
admin
Company:
GOM & Company
Integrity Level:
HIGH
Description:
GOM Player
Exit code:
0
Version:
2, 3, 43, 5305
Modules
Images
c:\program files\gretech\gomplayer\gom.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
11 015
Read events
7 155
Write events
3 849
Delete events
11

Modification events

(PID) Process:(128) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:P:\Hfref\nqzva\NccQngn\Ybpny\Grzc\TBZCYNLRETYBONYFRGHC_PUEBZR.RKR
Value:
000000000000000000000000DE0F0000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
(PID) Process:(128) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000001C00000025000000CFAA0C00090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E006500780065000000740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0051007500690063006B0020004C00610075006E00630068005C0055007300650072002000500069006E006E006500000000000034FF01F832FF01D4E3E1013DA94A7600000000FBFFFF7FF8E3E101987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000534275066D42750653427506000000000000000000000000080000002E006C00E72F0A77A48EF37600000000AC032E0000002E00E72F0A77B08EF37603005B019604010000002E005B148D23020000006CE4E101B07F0A7744E5E1010000000058005A0044E5E1010200000010E5E101F2700A7791830A771C8FF37611000000B8453100B045310078192F00F8FD580600E500008F148D23B0E4E10182914A7600E5E101B4E4E10127954A7600000000CC90FF01DCE4E101CD944A76CC90FF0188E5E101408CFF01E1944A7600000000408CFF0188E5E101E4E4E101090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E006500780065000000740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0051007500690063006B0020004C00610075006E00630068005C0055007300650072002000500069006E006E006500000000000034FF01F832FF01D4E3E1013DA94A7600000000FBFFFF7FF8E3E101987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000534275066D42750653427506000000000000000000000000080000002E006C00E72F0A77A48EF37600000000AC032E0000002E00E72F0A77B08EF37603005B019604010000002E005B148D23020000006CE4E101B07F0A7744E5E1010000000058005A0044E5E1010200000010E5E101F2700A7791830A771C8FF37611000000B8453100B045310078192F00F8FD580600E500008F148D23B0E4E10182914A7600E5E101B4E4E10127954A7600000000CC90FF01DCE4E101CD944A76CC90FF0188E5E101408CFF01E1944A7600000000408CFF0188E5E101E4E4E101090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E006500780065000000740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0051007500690063006B0020004C00610075006E00630068005C0055007300650072002000500069006E006E006500000000000034FF01F832FF01D4E3E1013DA94A7600000000FBFFFF7FF8E3E101987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000534275066D42750653427506000000000000000000000000080000002E006C00E72F0A77A48EF37600000000AC032E0000002E00E72F0A77B08EF37603005B019604010000002E005B148D23020000006CE4E101B07F0A7744E5E1010000000058005A0044E5E1010200000010E5E101F2700A7791830A771C8FF37611000000B8453100B045310078192F00F8FD580600E500008F148D23B0E4E10182914A7600E5E101B4E4E10127954A7600000000CC90FF01DCE4E101CD944A76CC90FF0188E5E101408CFF01E1944A7600000000408CFF0188E5E101E4E4E101
(PID) Process:(128) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:P:\Hfref\nqzva\NccQngn\Ybpny\Grzc\TBZCYNLRETYBONYFRGHC_PUEBZR.RKR
Value:
0000000000000000000000005D2F0000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
(PID) Process:(128) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000001C000000250000004ECA0C00090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E006500780065000000740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0051007500690063006B0020004C00610075006E00630068005C0055007300650072002000500069006E006E006500000000000034FF01F832FF01D4E3E1013DA94A7600000000FBFFFF7FF8E3E101987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000534275066D42750653427506000000000000000000000000080000002E006C00E72F0A77A48EF37600000000AC032E0000002E00E72F0A77B08EF37603005B019604010000002E005B148D23020000006CE4E101B07F0A7744E5E1010000000058005A0044E5E1010200000010E5E101F2700A7791830A771C8FF37611000000B8453100B045310078192F00F8FD580600E500008F148D23B0E4E10182914A7600E5E101B4E4E10127954A7600000000CC90FF01DCE4E101CD944A76CC90FF0188E5E101408CFF01E1944A7600000000408CFF0188E5E101E4E4E101090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E006500780065000000740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0051007500690063006B0020004C00610075006E00630068005C0055007300650072002000500069006E006E006500000000000034FF01F832FF01D4E3E1013DA94A7600000000FBFFFF7FF8E3E101987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000534275066D42750653427506000000000000000000000000080000002E006C00E72F0A77A48EF37600000000AC032E0000002E00E72F0A77B08EF37603005B019604010000002E005B148D23020000006CE4E101B07F0A7744E5E1010000000058005A0044E5E1010200000010E5E101F2700A7791830A771C8FF37611000000B8453100B045310078192F00F8FD580600E500008F148D23B0E4E10182914A7600E5E101B4E4E10127954A7600000000CC90FF01DCE4E101CD944A76CC90FF0188E5E101408CFF01E1944A7600000000408CFF0188E5E101E4E4E101090000000D000000CC19050033003000380030003400360042003000410046003400410033003900430042000000460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E006500780065000000740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0051007500690063006B0020004C00610075006E00630068005C0055007300650072002000500069006E006E006500000000000034FF01F832FF01D4E3E1013DA94A7600000000FBFFFF7FF8E3E101987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000534275066D42750653427506000000000000000000000000080000002E006C00E72F0A77A48EF37600000000AC032E0000002E00E72F0A77B08EF37603005B019604010000002E005B148D23020000006CE4E101B07F0A7744E5E1010000000058005A0044E5E1010200000010E5E101F2700A7791830A771C8FF37611000000B8453100B045310078192F00F8FD580600E500008F148D23B0E4E10182914A7600E5E101B4E4E10127954A7600000000CC90FF01DCE4E101CD944A76CC90FF0188E5E101408CFF01E1944A7600000000408CFF0188E5E101E4E4E101
(PID) Process:(2672) GOMPLAYERGLOBALSETUP_CHROME.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GOMPLAYERGLOBALSETUP_CHROME_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2672) GOMPLAYERGLOBALSETUP_CHROME.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GOMPLAYERGLOBALSETUP_CHROME_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2672) GOMPLAYERGLOBALSETUP_CHROME.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GOMPLAYERGLOBALSETUP_CHROME_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2672) GOMPLAYERGLOBALSETUP_CHROME.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GOMPLAYERGLOBALSETUP_CHROME_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2672) GOMPLAYERGLOBALSETUP_CHROME.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GOMPLAYERGLOBALSETUP_CHROME_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2672) GOMPLAYERGLOBALSETUP_CHROME.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\GOMPLAYERGLOBALSETUP_CHROME_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
66
Suspicious files
2
Text files
1 293
Unknown types
9

Dropped files

PID
Process
Filename
Type
2672GOMPLAYERGLOBALSETUP_CHROME.EXEC:\Users\admin\AppData\Local\Temp\nsj8B1.tmp\default_banner.png —
MD5:—
SHA256:—
2672GOMPLAYERGLOBALSETUP_CHROME.EXEC:\Users\admin\AppData\Local\Temp\nsj8B1.tmp\nsz3CC2.tmptext
MD5:—
SHA256:—
2672GOMPLAYERGLOBALSETUP_CHROME.EXEC:\Users\admin\AppData\Local\Temp\nsj8B1.tmp\nsb428F.tmphtml
MD5:—
SHA256:—
2672GOMPLAYERGLOBALSETUP_CHROME.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\GOMTotalPromotion[1].EXEexecutable
MD5:—
SHA256:—
2672GOMPLAYERGLOBALSETUP_CHROME.EXEC:\Users\admin\AppData\Local\Temp\nsj8B1.tmp\nsx43F8.tmphtml
MD5:E60648F873ED76ED0DF606F175FBF6E2
SHA256:D6812484787E7E18E416DB8412FAB498C7BF0F6A90E566350830694208F0BF9A
2672GOMPLAYERGLOBALSETUP_CHROME.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\GomEncorde_en[1].bmpimage
MD5:F0FB4BA2D66158BBB87C5172B380B857
SHA256:E8BFC6466526DE6010B109A3EE2EFB39285440039907558E7C5DB3863B3A6F6B
2672GOMPLAYERGLOBALSETUP_CHROME.EXEC:\Users\admin\AppData\Local\Temp\nsj8B1.tmp\nsJSON.dllexecutable
MD5:E89C7CD9336D61BB500AC3E581601878
SHA256:431FC2ED27D0B7A1CE80DE07989595EFFCC3FFB1DEA1AF6C0E178B53F6BD2F1E
2672GOMPLAYERGLOBALSETUP_CHROME.EXEC:\Users\admin\AppData\Local\Temp\NSISTrigger.dllexecutable
MD5:4A8178519A84A5AEFD06C9C720360C69
SHA256:FDD180C2C1006D1538BAE0E968D24AE70F7386F30B42E13E9CF45A48D1B0BBC0
2672GOMPLAYERGLOBALSETUP_CHROME.EXEC:\Users\admin\AppData\Local\Temp\atl110.dllexecutable
MD5:315D47153122903C52051B7027988F85
SHA256:C7E81FCE9D5F071361774F3755690A8CFEFDCFF714BC1DEBDB35066F64BCCCE0
2672GOMPLAYERGLOBALSETUP_CHROME.EXEC:\Users\admin\AppData\Local\Temp\nsj8B1.tmp\System.dllexecutable
MD5:A4DD044BCD94E9B3370CCF095B31F896
SHA256:2E226715419A5882E2E14278940EE8EF0AA648A3EF7AF5B3DC252674111962BC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
36
DNS requests
18
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
272
iexplore.exe
GET
—
54.230.94.109:80
http://www.gomlab.com/gomlab_v2/ui/css/browser_info.css?version=20190729
US
—
—
malicious
2672
GOMPLAYERGLOBALSETUP_CHROME.EXE
GET
200
54.230.95.18:80
http://playinfo.gomlab.com/setup_v2/bundle.gom?bundle=avast&resource=true&country=LV&setup=player
US
html
1.49 Kb
whitelisted
2672
GOMPLAYERGLOBALSETUP_CHROME.EXE
GET
200
54.230.95.18:80
http://playinfo.gomlab.com/setup_v2/index.gom?setup=player&name=GOMPLAYERGLOBALSETUP_CHROME&bit=32&lang=eng&version=2.3.43.5305&checkdate=201907231009
US
text
9.66 Kb
whitelisted
272
iexplore.exe
GET
200
54.230.94.109:80
http://www.gomlab.com/gomlab_v2/ui/css/browser_info.css?version=20190729
US
text
1.91 Kb
malicious
272
iexplore.exe
GET
200
54.230.94.109:80
http://www.gomlab.com/browser.gom?language=eng
US
html
9.51 Kb
malicious
272
iexplore.exe
GET
200
54.230.94.109:80
http://www.gomlab.com/gomlab_v2/ui/img/gmp/ico_gmp.png?v=2
US
image
2.96 Kb
malicious
272
iexplore.exe
GET
200
54.230.94.109:80
http://www.gomlab.com/gomlab_v2/ui/img/common/ico_browser1.png
US
image
3.30 Kb
malicious
2672
GOMPLAYERGLOBALSETUP_CHROME.EXE
GET
200
54.230.95.18:80
http://playinfo.gomlab.com/cms/bundle/log.gom?log=gom_audio,LV,LV,159.148.186.246&mode=new&type=show
US
html
1.88 Kb
whitelisted
2668
installer.exe
POST
200
104.18.88.101:80
http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
US
text
29 b
whitelisted
2672
GOMPLAYERGLOBALSETUP_CHROME.EXE
GET
200
54.230.95.18:80
http://playinfo.gomlab.com/cms/bundle/log.gom?log=avast,LV,LV,159.148.186.246&mode=new&type=check
US
html
1.88 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2672
GOMPLAYERGLOBALSETUP_CHROME.EXE
54.230.95.18:80
playinfo.gomlab.com
Amazon.com, Inc.
US
suspicious
2672
GOMPLAYERGLOBALSETUP_CHROME.EXE
163.171.138.220:443
cdn.gomlab.com
—
US
suspicious
3916
GRLauncher.exe
220.242.140.173:443
cdn.gomlab.com
—
CN
unknown
2672
GOMPLAYERGLOBALSETUP_CHROME.EXE
3.225.109.40:80
log.gomlab.com
—
US
unknown
2668
installer.exe
104.18.88.101:80
flow.lavasoft.com
Cloudflare Inc
US
shared
3240
GenericSetup.exe
104.16.235.79:443
sos.adaware.com
Cloudflare Inc
US
shared
3240
GenericSetup.exe
104.18.87.101:443
flow.lavasoft.com
Cloudflare Inc
US
shared
272
iexplore.exe
54.230.94.109:80
www.gomlab.com
Amazon.com, Inc.
US
unknown
1864
OfferInstaller.exe
104.18.87.101:443
flow.lavasoft.com
Cloudflare Inc
US
shared
2968
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
playinfo.gomlab.com
  • 54.230.95.18
  • 54.230.95.91
  • 54.230.95.161
  • 54.230.95.165
whitelisted
cdn.gomlab.com
  • 163.171.138.220
  • 220.242.140.173
suspicious
img.gomlab.com
  • 54.230.95.92
  • 54.230.95.95
  • 54.230.95.195
  • 54.230.95.91
whitelisted
cdn2.gomlab.com
  • 220.242.140.173
  • 163.171.138.220
suspicious
log.gomlab.com
  • 3.225.109.40
  • 34.236.24.237
unknown
flow.lavasoft.com
  • 104.18.88.101
  • 104.18.87.101
whitelisted
www.google.com
  • 172.217.21.228
malicious
sos.adaware.com
  • 104.16.235.79
  • 104.16.236.79
whitelisted
www.gomlab.com
  • 54.230.94.109
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

PID
Process
Class
Message
2672
GOMPLAYERGLOBALSETUP_CHROME.EXE
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
2672
GOMPLAYERGLOBALSETUP_CHROME.EXE
Misc activity
SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
2668
installer.exe
A Network Trojan was detected
ET MALWARE Lavasoft PUA/Adware Client Install
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GOMPLAYERGLOBALSETUP_CHROME.EXE