49126 |
2020-07-08 12:58
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware Code Injection Creates executable files exploit crash unpack itself Windows utilities AppData folder Windows Exploit crashed |
|
2
app.gomtv.com(58.228.255.24) 58.228.255.24
|
|
|
3.6 |
|
3 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49127 |
2020-07-08 12:56
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware Code Injection Check memory Creates executable files unpack itself Windows utilities Check virtual network interfaces AppData folder malicious URLs Interception Windows Browser |
11
http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=relatedpop&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=check&log=avast,KR,KR http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark_mo&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=zum_component&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ncube.gomtv.com/gom/Promotion.ini http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=gomhelper2&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=show&log=avast,KR,KR http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://log.gomlab.com/player/cancel?build=new_kor&fpb=&version=2.3.54.5318&bit=32bit&os=windows764bit&lang=kor&step=Avast&guid=2c56e83259713e1d2a72c5546392b215 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=clipdown&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 https://app.gomtv.com/gom/NEW_GOMPLAYERSETUP.EXE
|
13
log.gomlab.com(52.20.25.14) app.gomtv.com(183.111.235.201) sqm.telemetry.microsoft.com(65.55.252.93) ana.gomtv.com(183.110.10.189) kr.msn.com(13.75.94.74) ncube.gomtv.com(183.110.10.192) playinfo.gomlab.com(13.227.76.44) 13.227.76.16 183.110.10.189 183.110.10.192 35.169.10.202 58.228.255.24 65.55.252.93
|
|
|
9.2 |
M |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49128 |
2020-07-08 12:53
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware |
|
|
|
|
0.4 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49129 |
2020-07-08 12:26
|
http://91.198.220.225/microsof... 94c6d80841f357cce8fd364b5f76a62b VirusTotal Malware Code Injection Malicious Traffic unpack itself Windows utilities malicious URLs Windows DNS |
1
http://91.198.220.225/microsoft.hta
|
1
|
|
|
4.6 |
M |
4 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49130 |
2020-07-08 12:24
|
http://xaxiefei.com/ 2f18129e8ae56bc42f88a8813091c83f Malware Code Injection Malicious Traffic buffers extracted wscript.exe payload download Creates executable files exploit crash unpack itself Windows utilities suspicious process AppData folder malicious URLs Windows Exploit DNS crashed |
8
http://185.104.113.233/?MzM2ODU2&KDlFRiHHh&sIN=border&hTbFj=callous&t4dgf4=ho_AlL7VSaQqyhU3Te1BhmIdVWlwRpqupixfdzEWbiZfWrBCEZwJ1z6LRVvQ82w&PYS=callous&piaYjk=disagree&f5fghs=wHfQMvXcJwDGFYbGMvrESKNbNknQA0-PxpH2_drWdZqxKGni2Ob5UUSk6FSCEh3&iuQOFyt=mustard&Iuz=consignment&mUo=difference&lKhAbP=abettor&lPS=filly&IEOE=professional&WoMGRG=dinamic&IRgDq=filly&OmLEfrNDYxNzI2 http://185.104.113.233/favicon.ico http://clkfeed.com/adServe/feed?pid=277439&cid=294967874220200708112213&ip=175.208.134.150&q=xaxiefei.com&ref=http%3A%2F%2Fclick.com.cn&num=1&ua=Mozilla%2F4.0+%28compatible%3B+MSIE+8.0%3B+Windows+NT+6.1%3B+Trident%2F4.0%3B+SLCC2%3B+.NET+CLR+2.0.50727%3B+.NET+CLR+3.5.30729%3B+.NET+CLR+3.0.30729%3B+Media+Center+PC+6.0%3B+InfoPath.2%29&ar=sr&format=jsonp&callback=jCallBack http://makemoneynowwith.me/landclick17?utm_id=10893&utm_campaign=Worldwide&utm_source=195924228&utm_cost=0.0017 http://xaxiefei.com/ http://185.104.113.233/?MTY1NTU3&PycYLcK&nxj=abettor&MxycLNfRm=irreverent&f5fghs=xXjQMvWbbRXQDJ3EKvzcT6NCMVHRGkCL2YmdmrHZefjafFWkzrTFTF_6ozKAQwSG6_ttdfJYDVXii&IwzlXN=irreverent&zqno=electrical&yZF=callous&WHe=disagree&t4dgf4=keHeQw1ld1UWgkT_vyuikjdwRCbgsaA-xDbaQJArJWdFOVq3lj8ybgkdsMvxx-G4GdR_O1AElkX0Q&khOPBW=abettor&yVQYji=accelerator&MPf=mustard&NRjVzKeq=border&EuiDD=dinamic&dZB=filly&BNUpNTU0MDcz http://p277439.infopicked.com/adServe/domainClick?ai=QZA1Kz1Z7btlho2dXM3Tb4O-mcJ3GLX19Key8xfvkO5-7UOYsYXG3X-C20gmsJf7qsW0Wo45dLVqgEE0f5Fjh8XnLiFpVgC8Bvf4RIcbQkeDZG8TCuTZ6lsLtTfRMmnZ_V2QX4bPqEuNbp_BoGPeTOvaI8tzj08RUtZp3-rIIFmjucowCqyzzpScUWzLbIQ2CysoxRyIOqhySZRxKc-NU2hwnlBsGKtgUT9USpKqJvi-wHSK4m9oDiX-MgTUZasXT5xISGsNs7ESRyc3Q7-jufs31EvJ1VNOHxXMSdErUoadrNP9-AgE1Lh2c3kkE4JMhb_2mUAuQOK-BQzncPOfLSJmznl89uGVUWNFyyPsNurVo64vPAXoOmaJ1nv1bZfR2IBu2n015Mg&ui=Ilxxar-4JDjHYSZnQRV0rY-50-QI18VbLWXp3on882KiNKxwAofaTKesgDqN0BcmIxXZIbFqDP_oRgWG4IYSQMfVdqZdkx-iG_S2PAvd7Xm0_uSrKxOxH0IgtsRxNiue8ZidTzZrFmc&si=1&oref=d3c2837da0e02e3a4a67f0afabcb8712&rb=ejKb-f9jF6I&rr=1&isco=t http://infopicked.com/aS/feedclick?s=Ilxxar-4JDjHYSZnQRV0rUoLXZk8gkPQ5BTSTVNwlg_EcH_5IZLpRatmSGSPIFZmrtKGeLDN2bDp6O7CY8H5ouesbwTUN9D1Q57WzBF2czkWE365F5gTS3p_DRrQ0jsCiUnMKG1xv31r6HPqc5_T5XfmENYXbWzNNl6RGTsBSknipUdQkBxwwvXUJLXEL5w2d8sOkaR9z5TgLRmd0SMTRYVaWsixJpTpLuxbHBKxXA7m61BEDHiI1SR5FUSP-2UgRid3uFu13a8EP05JFwPpHTu0NGmJsg-xPSo0LPbeBvZtCvrvvHOxBxYQHFOTDKhk4lkQ_4bcjHikhP9XSvApfZFg6JI6xei-m-vVptjCUoxysgLpImwyiVmMruPsO25N6co9xpjxztp70QaLdSMBPYjjgAcQHeREdhf0WdBtRFmNNFDb-1ZToBYgklGKeHAe0880OFpz0YYgrYZiHH8isdGbUG1ktJNQoOq072sGOctFclte7v93f1fHiUbBRfoC4cJPczfHppRbxV0k8w-a8tdjr_ZruvJqTRYG1e6n9Bcth9GabMfLhUXJstCC4zCAlaoCm0QdCWdAYROvdvINI3yU1QZXmZVr3cAsvKUP1x0xDogT3P593OLvQqjtmGDf03axtODwZWe0BVXnYl9GsewdX7MlEvFdlh5ShcpasALK6MjGjHTiTs_Vb_Z31kmMwODIRU2d7KvZjtPYvcepiYeMBv4hXm28Uud9ob4mUU224D6eJqcqZzUDTmW8cFvdpYiQj5ZT_i1sQTBg7WkQ29L2YPcl-Gc0FPx8tetvPMJAksn97dDb5euY0sH-JxMcl0KfDX-2GOIjKJrxzTNRbcjJRB_Z-w_1ERzDxgRTS7JalUgUAzBqwzxEMPkHVgVs_Ls3E__MUDIXKZLbNLOQfuHxHeN3pBA4FZRXc_6obQBGHhGjJPO7GVZRyf4cfF2a-iDovL9lPIu5-xlGe0EOpX_yPuGh34NznLNlGHWKq9BnDLUDJnlahs5lxogrJVi5I8z1hX-jh2ufxRzXxISqKBRlpSBcG3GiFNYnRtQwe8ZoZUjUpicgJdLyrvwxUuBTxmMVbj2SlpK3e6pTdjPT91of1dy8EvrSNGE-73JCmtVWCwJzWmyg5VfKiRDASH32frT8_r91symsCsDctB8_PZfJ9lXNqQOkLvuU-RbcQuslHUhZLIe9Inv8ObfHet5uX1MKU4tearJZyISTfD8HTsAUcnKgNcpIax1ahkm2as_CMPlMuRZtnkQhw5f5QlOTJstYZiEdIz87Npjqqxb6BzZY69YHngPDn4rCDQynF0gD-RtqD0DhJ0pK0YoAfBLoSuGLSyxBQp57OYcjt7Rj61IEEmrMl5c5r-tTuVJCv5J7OYcjt7Rj61IEEmrMl5c5xiMVdntXIxs
|
10
p277439.infopicked.com(173.192.101.24) infopicked.com(173.192.101.24) clkfeed.com(173.192.101.21) makemoneynowwith.me(188.225.75.54) xaxiefei.com(47.245.8.67) 173.192.101.21 173.192.101.24 185.104.113.233 188.225.75.54 47.245.8.67
|
|
|
15.0 |
M |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49131 |
2020-07-08 11:43
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware Code Injection Check memory Creates executable files unpack itself Windows utilities Check virtual network interfaces AppData folder malicious URLs Interception Windows Browser |
13
http://log.gomlab.com/player/cancel?build=new_kor&fpb=&version=2.3.54.5318&bit=32bit&os=windows764bit&lang=kor&step=welcome&guid=ea299130506d89714623eafea2b304fa http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=relatedpop&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=check&log=avast,KR,KR http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark_mo&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=zum_component&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ncube.gomtv.com/gom/Promotion.ini http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=gomhelper2&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQC306pR6D9PJ5yVNi6FzKUE http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEE9Y%2FAVCbMS2XbwMLC468wQ%3D http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=clipdown&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 https://app.gomtv.com/gom/NEW_GOMPLAYERSETUP.EXE
|
15
playinfo.gomlab.com(13.227.76.12) sv.symcd.com(23.43.11.27) s2.symcb.com(23.43.11.27) ana.gomtv.com(183.110.10.189) log.gomlab.com(52.20.25.14) ncube.gomtv.com(183.110.10.192) kr.msn.com(13.75.94.74) app.gomtv.com(183.11 13.227.76.16 151.139.128.14 183.110.10.189 183.110.10.192 183.111.235.201 23.43.11.27 35.169.10.202
|
|
|
8.2 |
M |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49132 |
2020-07-08 11:41
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware Code Injection Check memory Creates executable files exploit crash unpack itself Windows utilities Check virtual network interfaces AppData folder malicious URLs Interception Windows Exploit Browser DNS crashed |
18
http://log.gomlab.com/player/cancel?build=new_kor&fpb=&version=2.3.54.5318&bit=32bit&os=windows764bit&lang=kor&step=eula&guid=cabf5ed6018a46020b02447d37824dfb http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=relatedpop&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=check&log=avast,KR,KR http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgSnpbKtCqR9Oin%2BnzJgtszNYw%3D%3D http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=zum_component&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQphfxhPb4vsBIPXkIOTJ7D1Z79fAQUCP4ln3TqhwTCvLuOqDhfM8bRbGUCEy0ACT6jyC8wXTpAKkoAAAAJPqM%3D http://ncube.gomtv.com/gom/Promotion.ini http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=gomhelper2&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQC306pR6D9PJ5yVNi6FzKUE http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEE9Y%2FAVCbMS2XbwMLC468wQ%3D http://ocsp.trustwave.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQ1mI4Ww4R5LZiQ295pj4OF%2F44yyAQUyk7dWyc1Kdn27sPlU%2B%2BkwBmWHa8CEQCSuHRPcc7Q4mxyo9jV2SWy http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark_mo&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=clipdown&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 https://app.gomtv.com/gom/NEW_GOMPLAYERSETUP.EXE
|
21
log.gomlab.com(52.20.25.14) playinfo.gomlab.com(13.227.76.7) ncube.gomtv.com(183.110.10.192) sv.symcd.com(23.43.11.27) s2.symcb.com(23.43.11.27) www.download.windowsupdate.com(8.255.35.254) ana.gomtv.com(183.110.10.189) 104.18.24.243 119.207.64.18 119.207.65.56 13.227.76.12 151.139.128.14 183.110.10.189 183.110.10.192 183.111.235.201 23.43.11.27 23.67.53.106 23.67.53.115 52.158.209.219 52.20.25.14 52.84.186
|
|
|
10.4 |
M |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49133 |
2020-07-08 11:39
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware Code Injection Check memory Creates executable files unpack itself Windows utilities Check virtual network interfaces AppData folder malicious URLs Interception Windows Browser |
13
http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=relatedpop&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=check&log=avast,KR,KR http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark_mo&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=zum_component&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://log.gomlab.com/player/cancel?build=new_kor&fpb=&version=2.3.54.5318&bit=32bit&os=windows764bit&lang=kor&step=welcome&guid=1714917d4bb3a01cb7c81b8fcf54f759 http://ncube.gomtv.com/gom/Promotion.ini http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=gomhelper2&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQC306pR6D9PJ5yVNi6FzKUE http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEE9Y%2FAVCbMS2XbwMLC468wQ%3D http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=clipdown&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 https://app.gomtv.com/gom/NEW_GOMPLAYERSETUP.EXE
|
15
log.gomlab.com(35.169.10.202) ncube.gomtv.com(183.110.10.192) sv.symcd.com(23.43.11.27) s2.symcb.com(23.43.11.27) playinfo.gomlab.com(13.227.76.16) ana.gomtv.com(183.110.10.189) kr.msn.com(13.75.94.74) app.gomtv.com(58.2 13.227.76.16 151.139.128.14 183.110.10.189 183.110.10.192 23.43.11.27 52.20.25.14 58.228.255.24
|
|
|
8.2 |
M |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49134 |
2020-07-08 11:37
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware |
|
|
|
|
0.4 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49135 |
2020-07-08 11:32
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware Code Injection Check memory Creates executable files unpack itself Windows utilities Check virtual network interfaces AppData folder malicious URLs Interception Windows Browser |
13
http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=relatedpop&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=check&log=avast,KR,KR http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark_mo&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=zum_component&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://log.gomlab.com/player/cancel?build=new_kor&fpb=&version=2.3.54.5318&bit=32bit&os=windows764bit&lang=kor&step=welcome&guid=34bde54090178fe815b31809bd6c5079 http://ncube.gomtv.com/gom/Promotion.ini http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=gomhelper2&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQC306pR6D9PJ5yVNi6FzKUE http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEE9Y%2FAVCbMS2XbwMLC468wQ%3D http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=clipdown&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 https://app.gomtv.com/gom/NEW_GOMPLAYERSETUP.EXE
|
15
log.gomlab.com(52.20.25.14) ncube.gomtv.com(183.110.10.192) sv.symcd.com(23.43.11.27) s2.symcb.com(23.43.11.27) playinfo.gomlab.com(13.227.76.7) ana.gomtv.com(183.110.10.189) kr.msn.com(13.75.94.74) app.gomtv.com(58.228. 13.227.76.12 151.139.128.14 183.110.10.189 183.110.10.192 183.111.235.201 23.43.11.27 35.169.10.202
|
|
|
8.2 |
M |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49136 |
2020-07-08 11:30
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware |
|
|
|
|
0.4 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49137 |
2020-07-08 11:12
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware Code Injection Check memory Creates executable files unpack itself Windows utilities Check virtual network interfaces AppData folder malicious URLs Interception Windows Browser DNS |
17
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=relatedpop&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=check&log=avast,KR,KR http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark_mo&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=zum_component&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://log.gomlab.com/player/cancel?build=new_kor&fpb=&version=2.3.54.5318&bit=32bit&os=windows764bit&lang=kor&step=Avast&guid=9684cd9d3ddd00c5c4bec0d76cf4077d http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQphfxhPb4vsBIPXkIOTJ7D1Z79fAQUCP4ln3TqhwTCvLuOqDhfM8bRbGUCEy0ACT6jyC8wXTpAKkoAAAAJPqM%3D http://ncube.gomtv.com/gom/Promotion.ini http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=gomhelper2&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=show&log=avast,KR,KR http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQC306pR6D9PJ5yVNi6FzKUE http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEE9Y%2FAVCbMS2XbwMLC468wQ%3D http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=clipdown&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 https://app.gomtv.com/gom/NEW_GOMPLAYERSETUP.EXE
|
19
www.download.windowsupdate.com(23.53.228.40) ncube.gomtv.com(183.110.10.192) sv.symcd.com(23.43.11.27) s2.symcb.com(23.43.11.27) sqm.telemetry.microsoft.com(65.55.252.93) playinfo.gomlab.com(13.227.76.16) o.ss2.us(52.84.186.1 104.18.24.243 13.227.76.12 151.139.128.14 183.110.10.189 183.110.10.192 23.43.11.27 23.53.228.57 23.67.53.115 35.169.10.202 52.84.186.108 58.228.255.24 65.55.252.93
|
|
|
9.8 |
M |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49138 |
2020-07-08 11:10
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware Code Injection Check memory Creates executable files unpack itself Windows utilities Check virtual network interfaces AppData folder malicious URLs Interception Windows Browser DNS |
17
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=relatedpop&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=check&log=avast,KR,KR http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark_mo&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=zum_component&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQphfxhPb4vsBIPXkIOTJ7D1Z79fAQUCP4ln3TqhwTCvLuOqDhfM8bRbGUCEy0ACT6jyC8wXTpAKkoAAAAJPqM%3D http://ncube.gomtv.com/gom/Promotion.ini http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=gomhelper2&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=show&log=avast,KR,KR http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQC306pR6D9PJ5yVNi6FzKUE http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEE9Y%2FAVCbMS2XbwMLC468wQ%3D http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=clipdown&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://log.gomlab.com/player/cancel?build=new_kor&fpb=&version=2.3.54.5318&bit=32bit&os=windows764bit&lang=kor&step=Avast&guid=48d967b42e64a7b0ae6f18047876b8d2 https://app.gomtv.com/gom/NEW_GOMPLAYERSETUP.EXE
|
20
www.download.windowsupdate.com(23.53.228.57) ncube.gomtv.com(183.110.10.192) sv.symcd.com(23.43.11.27) s2.symcb.com(23.43.11.27) sqm.telemetry.microsoft.com(65.55.252.93) playinfo.gomlab.com(13.227.76.44) o.ss2.us(52.84.186.1 13.227.76.7 104.18.25.243 13.227.76.16 151.139.128.14 183.110.10.189 183.110.10.192 23.43.11.27 23.53.228.40 23.67.53.115 35.169.10.202 52.84.186.113 58.228.255.24 65.55.252.93
|
|
|
9.8 |
M |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49139 |
2020-07-08 11:06
|
https://app.gomtv.com/gom/NEW_... cdf0ee07031e51f2fb8648e1abe9f1f4 VirusTotal Malware Code Injection Check memory Creates executable files RWX flags setting unpack itself Windows utilities Check virtual network interfaces AppData folder malicious URLs Interception Windows Browser DNS |
16
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=relatedpop&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=check&log=avast,KR,KR http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark_mo&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=zum_component&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQphfxhPb4vsBIPXkIOTJ7D1Z79fAQUCP4ln3TqhwTCvLuOqDhfM8bRbGUCEy0ACT6jyC8wXTpAKkoAAAAJPqM%3D http://ncube.gomtv.com/gom/Promotion.ini http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=gomhelper2&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://playinfo.gomlab.com/cms/bundle/log.gom?mode=new&type=show&log=avast,KR,KR http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=coupang_bookmark&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQC306pR6D9PJ5yVNi6FzKUE http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEE9Y%2FAVCbMS2XbwMLC468wQ%3D http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D http://ana.gomtv.com/cgi-bin/prdpromo.cgi?promo=clipdown&prd=gomplayer&type=view¶m=KOR,2.3.54.5318&uKey=14440 https://app.gomtv.com/gom/NEW_GOMPLAYERSETUP.EXE
|
18
www.download.windowsupdate.com(119.207.66.155) ncube.gomtv.com(183.110.10.192) sv.symcd.com(23.43.11.27) s2.symcb.com(23.43.11.27) sqm.telemetry.microsoft.com(65.55.252.93) playinfo.gomlab.com(13.227.76.7) o.ss2.us(52.84.186. 104.18.24.243 119.207.65.41 13.227.76.7 151.139.128.14 183.110.10.189 183.110.10.192 23.43.11.27 23.67.53.115 52.84.186.113 58.228.255.24 65.55.252.93
|
|
|
10.2 |
M |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
49140 |
2020-07-08 11:02
|
https://download.nullsoft.com/... 3017f921a6c42a267842cc8bae9384c1 VirusTotal Malware Code Injection Malicious Traffic Check memory buffers extracted Creates shortcut Creates executable files ICMP traffic unpack itself Windows utilities AppData folder malicious URLs Firewall state off human activity check Ransomware Windows DNS |
11
http://download.nullsoft.com/redist/dx/d3dx9_31_42_x86_embed.exe http://tl.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEDug3mjunM7W9gtPzXUgPAU%3D http://cert.int-x3.letsencrypt.org/ http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQphfxhPb4vsBIPXkIOTJ7D1Z79fAQUCP4ln3TqhwTCvLuOqDhfM8bRbGUCEy0ACT6jyC8wXTpAKkoAAAAJPqM%3D http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgP2%2FC94cD5Qp5Cy3ayfhaN4Iw%3D%3D http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D http://crl.microsoft.com/pki/crl/products/CSPCA.crl http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab http://t2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D https://download.nullsoft.com/winamp/client/winamp58_3660_beta_full_en-us.exe https://download.nullsoft.com/winamp/misc/winamp58_3660_beta_full_en-us.exe https://download.nullsoft.com/winamp/misc/winamp58_3660_beta_full_en-us.exe
|
19
tl.symcd.com(23.43.11.27) ocsp.int-x3.letsencrypt.org(119.207.65.27) www.google.com(172.217.175.68) o.ss2.us(52.84.186.127) www.download.windowsupdate.com(119.207.64.17) sqm.telemetry.microsoft.com(65.55.252.93) download.null 104.18.24.243 104.74.211.103 119.207.64.17 119.207.65.27 119.207.65.56 216.58.220.100 23.211.117.34 23.43.11.27 23.67.53.115 5.39.58.66 52.84.186.127 65.55.252.93
|
|
|
11.2 |
M |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|