File name:

YTDSetup.exe

Full analysis: https://app.any.run/tasks/b0f62ae2-ffad-49d1-a23e-577f91cfd7c2
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: October 05, 2019, 14:40:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

0C83C1F4A99FD88601449B7F482836B2

SHA1:

6C36F5A4D830AF4D1BD2FA2BD12266A888E30D87

SHA256:

72587A466B4D4136F9BB6DE4AD4FA2A90F9DC1444D36F79E75A813AEDC83CD07

SSDEEP:

196608:yJt+KxTcPj3FkpIsixwG9wo87gpIJvfdsD3OPQPOkpxd9OHX/Z2Sa/BpEvB:4tcPj3EXU587QIv2D3OPyfH9OvQvpEZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • YTDSetup.exe (PID: 2348)
      • ytd.exe (PID: 2428)

    • Application was dropped or rewritten from another process

      • ytd.exe (PID: 2428)
      • FFMPEG.EXE (PID: 3040)
      • ffmpeg.exe (PID: 3856)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • YTDSetup.exe (PID: 2348)

    • Reads internet explorer settings

      • ytd.exe (PID: 2428)

    • Executed via COM

      • explorer.exe (PID: 2688)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3468)

    • Starts Internet Explorer

      • explorer.exe (PID: 2688)

    • Creates files in the program directory

      • YTDSetup.exe (PID: 2348)
      • ytd.exe (PID: 2428)

    • Creates files in the user directory

      • ytd.exe (PID: 2428)

    • Reads Internet Cache Settings

      • ytd.exe (PID: 2428)

    • Starts CMD.EXE for commands execution

      • ytd.exe (PID: 2428)

    • Creates a software uninstall entry

      • YTDSetup.exe (PID: 2348)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3776)

    • Reads settings of System Certificates

      • ytd.exe (PID: 2428)

    • Creates files in the user directory

      • iexplore.exe (PID: 3184)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3468)
      • iexplore.exe (PID: 3776)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3184)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 23:24:36+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x34a5
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.9.13.5
ProductVersionNumber: 5.9.13.5
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileDescription: YTD Video Downloader Application
FileVersion: 5.9.13.5
LegalCopyright: Copyright © 2007-2019 GreenTree Applications SRL
OriginalFileName: Setup.exe
ProductName: YTD Video Downloader Application
ProductVersion: 5.9.13.5

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Dec-2018 22:24:36
Detected languages:
  • English - United States
FileDescription: YTD Video Downloader Application
FileVersion: 5.9.13.5
LegalCopyright: Copyright © 2007-2019 GreenTree Applications SRL
OriginalFilename: Setup.exe
ProductName: YTD Video Downloader Application
ProductVersion: 5.9.13.5

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 15-Dec-2018 22:24:36
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006409
0x00006600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41619
.rdata
0x00008000
0x00001396
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.15491
.data
0x0000A000
0x00020358
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.0044
.ndata
0x0002B000
0x0002E000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00059000
0x0000C728
0x0000C800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.79206

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28794
1070
UNKNOWN
English - United States
RT_MANIFEST
2
4.48451
9640
UNKNOWN
English - United States
RT_ICON
3
4.63086
4264
UNKNOWN
English - United States
RT_ICON
4
5.39833
3752
UNKNOWN
English - United States
RT_ICON
5
6.01171
2216
UNKNOWN
English - United States
RT_ICON
6
6.35747
1384
UNKNOWN
English - United States
RT_ICON
7
5.04145
1128
UNKNOWN
English - United States
RT_ICON
103
2.71858
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.67385
512
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
11
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start ytdsetup.exe explorer.exe no specs explorer.exe no specs ytd.exe iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs cmd.exe no specs ffmpeg.exe no specs ffmpeg.exe no specs ytdsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672cmd /c C:\PROGRA~1\GREENT~1\YTDVID~1\ffmpeg.exe -i "C:\Users\admin\Desktop\dhow.rtf" 2> "C:\Users\admin\AppData\Local\Temp\~ytF064.tmp" /yC:\Windows\system32\cmd.exe—ytd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
912"C:\Windows\explorer.exe" "http://www.ytddownloader.com/thankyou.html?isn=EC367E83CE8B4118A8816531AD73CE80&lang=1033&cid=b8c47e36061a092184ea8cb9b1a64aa2&oldVer=&newVer=5.9.13&kt=cnet&pv=0"C:\Windows\explorer.exe—YTDSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2348"C:\Users\admin\AppData\Local\Temp\YTDSetup.exe" C:\Users\admin\AppData\Local\Temp\YTDSetup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
YTD Video Downloader Application
Exit code:
0
Version:
5.9.13.5
Modules
Images
c:\users\admin\appdata\local\temp\ytdsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2428"C:\Program Files\GreenTree Applications\YTD Video Downloader\ytd.exe"C:\Program Files\GreenTree Applications\YTD Video Downloader\ytd.exe
YTDSetup.exe
User:
admin
Company:
GreenTree Applications SRL
Integrity Level:
MEDIUM
Description:
Video Downloader
Exit code:
0
Version:
5, 9, 13, 5
Modules
Images
c:\program files\greentree applications\ytd video downloader\ytd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2688C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3040C:\PROGRA~1\GREENT~1\YTDVID~1\ffmpeg.exe -i "C:\Users\admin\Desktop\dhow.rtf" /yC:\PROGRA~1\GREENT~1\YTDVID~1\FFMPEG.EXE—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\progra~1\greent~1\ytdvid~1\ffmpeg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\avicap32.dll
c:\windows\system32\user32.dll
3184"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3776 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3468C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3636"C:\Users\admin\AppData\Local\Temp\YTDSetup.exe" C:\Users\admin\AppData\Local\Temp\YTDSetup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
YTD Video Downloader Application
Exit code:
3221226540
Version:
5.9.13.5
Modules
Images
c:\systemroot\system32\ntdll.dll
3776"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 633
Read events
1 360
Write events
269
Delete events
4

Modification events

(PID) Process:(2348) YTDSetup.exeKey:HKEY_CURRENT_USER\Software\GreenTree Applications\YTD
Operation:writeName:ISN
Value:
EC367E83CE8B4118A8816531AD73CE80
(PID) Process:(2348) YTDSetup.exeKey:HKEY_CURRENT_USER\Software\GreenTree Applications\YTD
Operation:writeName:
Value:
C:\Program Files\GreenTree Applications\YTD Video Downloader
(PID) Process:(2348) YTDSetup.exeKey:HKEY_CURRENT_USER\Software\GreenTree Applications\YTD
Operation:writeName:Language
Value:
1033
(PID) Process:(2348) YTDSetup.exeKey:HKEY_CURRENT_USER\Software\GreenTree Applications\YTD
Operation:writeName:kitType
Value:
cnet
(PID) Process:(2348) YTDSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Operation:writeName:DisplayIcon
Value:
C:\Program Files\GreenTree Applications\YTD Video Downloader\ytd.exe,0
(PID) Process:(2348) YTDSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Operation:writeName:DisplayName
Value:
YTD Video Downloader 5.9.13
(PID) Process:(2348) YTDSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Operation:writeName:UninstallString
Value:
"C:\Program Files\GreenTree Applications\YTD Video Downloader\uninstall.exe"
(PID) Process:(2348) YTDSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Operation:writeName:Publisher
Value:
GreenTree Applications SRL
(PID) Process:(2348) YTDSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Operation:writeName:URLInfoAbout
Value:
http://www.ytddownloader.com
(PID) Process:(2348) YTDSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Operation:writeName:NoModify
Value:
1
Executable files
24
Suspicious files
8
Text files
76
Unknown types
10

Dropped files

PID
Process
Filename
Type
2348YTDSetup.exeC:\Users\admin\AppData\Local\Temp\nsq2118.tmp\inst_start.txt —
MD5:—
SHA256:—
2348YTDSetup.exeC:\Users\admin\AppData\Local\Temp\nsq2118.tmp\modern-header.bmpimage
MD5:3FD933AE9F031241E079AF6BAC356206
SHA256:3EDA2CF101377503BAE145E54351636DD117A89D9D680A3D49ED7F6026485590
2348YTDSetup.exeC:\Users\admin\AppData\Local\Temp\nsq2118.tmp\nsisdl.dllexecutable
MD5:BA2CC9634EBED71CEA697A31144AF802
SHA256:9A3C2FE5490C34F73F1A05899EF60CFEF05E0C9599CD704E524EF7A46EAD67BA
2348YTDSetup.exeC:\Users\admin\AppData\Local\Temp\nsq2118.tmp\nsDialogs.dllexecutable
MD5:466179E1C8EE8A1FF5E4427DBB6C4A01
SHA256:1E40211AF65923C2F4FD02CE021458A7745D28E2F383835E3015E96575632172
2348YTDSetup.exeC:\Program Files\GreenTree Applications\YTD Video Downloader\COPYING.Apachev2text
MD5:D273D63619C9AEAF15CDAF76422C4F87
SHA256:3DDF9BE5C28FE27DAD143A5DC76EEA25222AD1DD68934A047064E56ED2FA40C5
2348YTDSetup.exeC:\Users\admin\AppData\Local\Temp\nsq2118.tmp\UserInfo.dllexecutable
MD5:9EB662F3B5FBDA28BFFE020E0AB40519
SHA256:9AA388C7DE8E96885ADCB4325AF871B470AC50EDB60D4B0D876AD43F5332FFD1
2348YTDSetup.exeC:\Program Files\GreenTree Applications\YTD Video Downloader\FFMPEG.EXEexecutable
MD5:39D11C773B46D3084EF4AAC1F9863146
SHA256:7F2B4BBB0C2FF94DBD2DC04D040EB20D5441B85FF1FF3D74E812C9440626A843
2348YTDSetup.exeC:\Users\admin\AppData\Local\Temp\nsq2118.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
2348YTDSetup.exeC:\Users\admin\AppData\Local\Temp\nsq2118.tmp\NSISHelper.dllexecutable
MD5:1E0C14216A8DC89CBCE95EF46CEE2B75
SHA256:F6E06A2CD7B73E9888A68F75EEE39607F268BE9DB93AD7E958B48F8E3D1090D5
2348YTDSetup.exeC:\Program Files\GreenTree Applications\YTD Video Downloader\manual.battext
MD5:AAE0878136D8C1559FAC69F5C5B895E2
SHA256:FD8839722BA7FFD3FBE48149FD909DB3E66E9A5213FA88E511286214BE109B9D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
29
DNS requests
14
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2348
YTDSetup.exe
GET
—
52.57.85.106:80
http://www.ytddownloader.com/images/pixel.gif?action=install&point=start&version=5.9.13&lngid=1033&cid=b8c47e36061a092184ea8cb9b1a64aa2&isn=EC367E83CE8B4118A8816531AD73CE80&kt=cnet&lt=0
DE
—
—
suspicious
2348
YTDSetup.exe
GET
—
52.57.85.106:80
http://www.ytddownloader.com/images/pixel.gif?action=install&point=finish&oldver=&version=5.9.13&lngid=1033&cid=b8c47e36061a092184ea8cb9b1a64aa2&isn=EC367E83CE8B4118A8816531AD73CE80&kt=cnet&br=1&ai=0&lt=0
DE
—
—
suspicious
3184
iexplore.exe
GET
302
172.217.16.206:80
http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=2035478967&utmhn=www.ytddownloader.com&utmcs=utf-8&utmsr=1280x720&utmvp=788x444&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=26.0%20r0&utmdt=YTD%20Video%20Converter&utmhid=2054861174&utmr=-&utmp=%2Fthankyou.html%3Fisn%3DEC367E83CE8B4118A8816531AD73CE80%26lang%3D1033%26cid%3Db8c47e36061a092184ea8cb9b1a64aa2%26oldVer%3D%26newVer%3D5.9.13%26kt%3Dcnet%26pv%3D0&utmht=1570286452891&utmac=UA-25210420-2&utmcc=__utma%3D135583929.585863535.1570286452.1570286452.1570286452.1%3B%2B__utmz%3D135583929.1570286452.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1875580094&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
US
html
370 b
whitelisted
3184
iexplore.exe
GET
200
52.57.85.106:80
http://www.ytddownloader.com/thankyou.html?isn=EC367E83CE8B4118A8816531AD73CE80&lang=1033&cid=b8c47e36061a092184ea8cb9b1a64aa2&oldVer=&newVer=5.9.13&kt=cnet&pv=0
DE
html
2.07 Kb
suspicious
3184
iexplore.exe
GET
200
52.57.85.106:80
http://www.ytddownloader.com/styles.css
DE
text
6.86 Kb
suspicious
3184
iexplore.exe
GET
200
52.57.85.106:80
http://www.ytddownloader.com/js/main.js
DE
text
3.40 Kb
suspicious
3184
iexplore.exe
GET
200
52.57.85.106:80
http://www.ytddownloader.com/images/sprite.png
DE
image
228 Kb
suspicious
3184
iexplore.exe
GET
200
212.124.115.196:80
http://www.exactbridge.com/js/show_ads_supp.js?pubId=5742
DE
text
9.17 Kb
suspicious
3184
iexplore.exe
GET
200
185.60.216.19:80
http://connect.facebook.net/en_US/all.js
IE
text
1.74 Kb
whitelisted
2428
ytd.exe
GET
200
52.59.78.246:80
http://www.ytddownloader.com/ads/def19/win.php?inst=2019-10-05&kt=cnet&isn=EC367E83CE8B4118A8816531AD73CE80&lt=2&ver=5.9.13
DE
html
1.32 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2348
YTDSetup.exe
52.57.85.106:80
www.ytddownloader.com
Amazon.com, Inc.
DE
malicious
2428
ytd.exe
52.59.78.246:443
www.ytddownloader.com
Amazon.com, Inc.
DE
malicious
—
—
72.21.81.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3776
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3184
iexplore.exe
52.57.85.106:80
www.ytddownloader.com
Amazon.com, Inc.
DE
malicious
3184
iexplore.exe
172.217.23.170:80
ajax.googleapis.com
Google Inc.
US
whitelisted
3184
iexplore.exe
23.210.248.44:443
s7.addthis.com
Akamai International B.V.
NL
whitelisted
3184
iexplore.exe
212.124.115.196:80
www.exactbridge.com
True Records Inc.
DE
suspicious
3184
iexplore.exe
172.217.16.206:80
www.google-analytics.com
Google Inc.
US
whitelisted
3184
iexplore.exe
185.60.216.19:80
connect.facebook.net
Facebook, Inc.
IE
whitelisted

DNS requests

Domain
IP
Reputation
www.ytddownloader.com
  • 52.57.85.106
  • 52.59.78.246
suspicious
x.ss2.us
  • 13.32.222.244
  • 13.32.222.61
  • 13.32.222.222
  • 13.32.222.55
whitelisted
www.download.windowsupdate.com
  • 72.21.81.240
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.exactbridge.com
  • 212.124.115.196
  • 212.124.124.178
suspicious
ajax.googleapis.com
  • 172.217.23.170
  • 172.217.21.202
  • 216.58.205.234
  • 172.217.21.234
  • 172.217.22.10
  • 172.217.18.170
  • 216.58.206.10
  • 172.217.23.106
  • 216.58.207.74
  • 172.217.16.170
  • 172.217.16.138
  • 172.217.22.42
whitelisted
s7.addthis.com
  • 23.210.248.44
whitelisted
www.google-analytics.com
  • 172.217.16.206
whitelisted
connect.facebook.net
  • 185.60.216.19
whitelisted
stats.g.doubleclick.net
  • 64.233.166.155
  • 64.233.166.156
  • 64.233.166.154
  • 64.233.166.157
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ADWARE [PTsecurity] Spigot (Ytdownloader)
—
—
Misc activity
ADWARE [PTsecurity] Spigot (Ytdownloader)
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
YTDSetup.exe