File name:

UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe

Full analysis: https://app.any.run/tasks/28a2bd1a-86a8-4c39-b38f-b78be3b2ef9f
Verdict: Malicious activity
Analysis date: October 03, 2018, 15:44:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
UCBrowser
Browser
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

41F04143113A759524BD13993AFA4B8E

SHA1:

213FB7A5317293B22AE9CF076997A94CC7FA49B7

SHA256:

76A40DC24A8AD150407F98ED0E69E68CC6481543DB7DA7C6615140805A07721F

SSDEEP:

49152:dErSOG06fu8EirLITO8KlcsDsRe0TaIlAiJWtptzfwhK:VOG0wFEirLb8KlnIBlAiYPzos

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • stats_uploader.exe (PID: 4060)
      • stats_uploader.exe (PID: 3384)
      • stats_uploader.exe (PID: 4044)
      • stats_uploader.exe (PID: 3688)
      • stats_uploader.exe (PID: 3264)
      • setup.exe (PID: 1720)
      • ucbrowser_installer.exe (PID: 1552)
      • stats_uploader.exe (PID: 3420)
      • UCService.exe (PID: 124)
      • UCBrowser.exe (PID: 1392)
      • UCBrowser.exe (PID: 2260)
      • UCBrowser.exe (PID: 1968)
      • UCService.exe (PID: 1908)
      • UCBrowser.exe (PID: 3676)
      • stats_uploader.exe (PID: 2828)
      • UCBrowser.exe (PID: 3904)
      • stats_uploader.exe (PID: 3312)
      • UCService.exe (PID: 2600)
      • UCBrowser.exe (PID: 3268)
      • UCBrowser.exe (PID: 1404)
      • UCBrowser.exe (PID: 3700)
      • UCBrowser.exe (PID: 2240)
      • UCBrowser.exe (PID: 2596)
      • setup.exe (PID: 3692)
      • UCBrowser.exe (PID: 2716)
      • UCBrowser.exe (PID: 3272)
      • UCBrowser.exe (PID: 2796)
      • chrmstp.exe (PID: 2772)
      • UCBrowser.exe (PID: 1152)
      • UCBrowser.exe (PID: 2392)
      • UCBrowser.exe (PID: 3764)
      • UCBrowser.exe (PID: 2900)
      • stats_uploader.exe (PID: 3684)
      • UCBrowser.exe (PID: 3760)
      • UCBrowser.exe (PID: 4012)
      • UCBrowser.exe (PID: 624)
      • UCBrowser.exe (PID: 3840)
      • UCBrowser.exe (PID: 568)
      • UCBrowser.exe (PID: 1220)
      • stats_uploader.exe (PID: 2316)
      • stats_uploader.exe (PID: 3496)

    • Changes the autorun value in the registry

      • setup.exe (PID: 1720)

    • Adds new firewall rule via NETSH.EXE

      • setup.exe (PID: 1720)

    • Loads dropped or rewritten executable

      • UCBrowser.exe (PID: 2260)
      • UCBrowser.exe (PID: 1968)
      • UCBrowser.exe (PID: 1392)
      • UCBrowser.exe (PID: 3676)
      • UCBrowser.exe (PID: 3904)
      • UCBrowser.exe (PID: 3268)
      • UCBrowser.exe (PID: 1404)
      • UCBrowser.exe (PID: 2596)
      • UCBrowser.exe (PID: 2240)
      • UCBrowser.exe (PID: 2716)
      • UCBrowser.exe (PID: 3700)
      • UCBrowser.exe (PID: 2392)
      • UCBrowser.exe (PID: 3272)
      • UCBrowser.exe (PID: 2796)
      • UCBrowser.exe (PID: 1152)
      • UCBrowser.exe (PID: 2900)
      • UCBrowser.exe (PID: 3764)
      • UCBrowser.exe (PID: 3760)
      • UCBrowser.exe (PID: 4012)
      • UCBrowser.exe (PID: 568)
      • UCBrowser.exe (PID: 3840)
      • UCBrowser.exe (PID: 624)
      • UCBrowser.exe (PID: 1220)

    • Loads the Task Scheduler DLL interface

      • UCBrowser.exe (PID: 1968)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ucbrowser_installer.exe (PID: 1552)
      • UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe (PID: 2020)
      • setup.exe (PID: 1720)

    • Creates a software uninstall entry

      • setup.exe (PID: 1720)

    • Creates files in the user directory

      • setup.exe (PID: 1720)
      • UCBrowser.exe (PID: 3268)

    • Starts SC.EXE for service management

      • setup.exe (PID: 1720)

    • Uses NETSH.EXE for network configuration

      • setup.exe (PID: 1720)

    • Creates files in the program directory

      • UCBrowser.exe (PID: 2260)
      • UCService.exe (PID: 124)
      • UCBrowser.exe (PID: 1392)
      • UCBrowser.exe (PID: 1968)
      • setup.exe (PID: 1720)
      • ucbrowser_installer.exe (PID: 1552)
      • UCBrowser.exe (PID: 3676)
      • UCBrowser.exe (PID: 3268)
      • UCBrowser.exe (PID: 3760)

    • Modifies the open verb of a shell class

      • UCBrowser.exe (PID: 1392)
      • setup.exe (PID: 3692)
      • UCBrowser.exe (PID: 3268)

    • Application launched itself

      • UCBrowser.exe (PID: 1968)
      • UCBrowser.exe (PID: 3268)
      • UCBrowser.exe (PID: 2796)
      • UCBrowser.exe (PID: 3760)

    • Creates files in the Windows directory

      • UCBrowser.exe (PID: 1968)
      • stats_uploader.exe (PID: 2828)
      • stats_uploader.exe (PID: 2316)

    • Removes files from Windows directory

      • stats_uploader.exe (PID: 2828)
      • stats_uploader.exe (PID: 2316)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • setup.exe (PID: 1720)
      • UCBrowser.exe (PID: 3676)
      • UCBrowser.exe (PID: 3268)
      • UCBrowser.exe (PID: 3760)

    • Reads settings of System Certificates

      • UCBrowser.exe (PID: 3268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (78.5)
.exe | Win32 Executable (generic) (11.3)
.exe | Generic Win/DOS Executable (5)
.exe | DOS Executable Generic (5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:12:20 06:42:56+01:00
PEType: PE32
LinkerVersion: 14
CodeSize: 757760
InitializedDataSize: 929792
UninitializedDataSize: -
EntryPoint: 0x92dd7
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 7.0.185.1002
ProductVersionNumber: 7.0.185.1002
FileFlagsMask: 0x003f
FileFlags: Private build, Special build
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Windows, Chinese (Simplified)
CompanyName: UCWeb Inc.
FileDescription: UCBrowser Online Installer
FileVersion: 7.0.185.1002
InternalName: online_installer_exe
LegalCopyright: Copyright 2008-2017 UCWeb Inc. All rights reserved.
ProductName: UC Browser
ProductVersion: 7.0.185.1002
CompanyShortName: UCWeb Inc.
ProductShortName: UC Browser
LastChange: 80c44ef8676ce2ef96c98d57958e86cc328431ef-bus-1218-185
OfficialBuild: 1

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 20-Dec-2017 05:42:56
Detected languages:
  • Chinese - PRC
  • English - United States
TLS Callbacks: 1 callback(s) detected.
Debug artifacts:
  • D:\webapps\b\build\slave\repo\build\src\out\Release\online_installer.exe.pdb
CompanyName: UCWeb Inc.
FileDescription: UCBrowser Online Installer
FileVersion: 7.0.185.1002
InternalName: online_installer_exe
LegalCopyright: Copyright 2008-2017 UCWeb Inc. All rights reserved.
ProductName: UC Browser
ProductVersion: 7.0.185.1002
CompanyShortName: UCWeb Inc.
ProductShortName: UC Browser
LastChange: 80c44ef8676ce2ef96c98d57958e86cc328431ef-bus-1218-185
Official Build: 1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000140

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 20-Dec-2017 05:42:56
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000B8E2B
0x000B9000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62223
.rdata
0x000BA000
0x00022F48
0x00023000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.00964
.data
0x000DD000
0x00008A44
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.87706
.gfids
0x000E6000
0x00000330
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.28892
.tls
0x000E7000
0x00000002
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x000E8000
0x000B7494
0x000B7600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.59515
.reloc
0x001A0000
0x00006C9C
0x00006E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.70248

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.55414
1072
Latin 1 / Western European
Chinese - PRC
RT_VERSION
2
5.84529
9640
Latin 1 / Western European
Chinese - PRC
RT_ICON
3
4.55272
1128
Latin 1 / Western European
Chinese - PRC
RT_ICON
8
1.57841
58
Latin 1 / Western European
Chinese - PRC
RT_STRING
127
2.44441
48
Latin 1 / Western European
Chinese - PRC
RT_GROUP_ICON
129
2.3448
284
Latin 1 / Western European
Chinese - PRC
RT_DIALOG
376
2.85186
236
Latin 1 / Western European
Chinese - PRC
RT_STRING
377
3.10207
656
Latin 1 / Western European
Chinese - PRC
RT_STRING
378
3.08434
510
Latin 1 / Western European
Chinese - PRC
RT_STRING
379
2.97937
402
Latin 1 / Western European
Chinese - PRC
RT_STRING

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
IPHLPAPI.DLL
KERNEL32.dll
MSIMG32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
USER32.dll

Exports

Title
Ordinal
Address
GetHandleVerifier
1
0x000263F0
curl_easy_cleanup
2
0x00066EF8
curl_easy_duphandle
3
0x00066F09
curl_easy_escape
4
0x00085A4C
curl_easy_getinfo
5
0x000670D7
curl_easy_init
6
0x000670ED
curl_easy_pause
7
0x00067124
curl_easy_perform
8
0x00067221
curl_easy_recv
9
0x000672B8
curl_easy_reset
10
0x00067302
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
109
Monitored processes
49
Malicious processes
22
Suspicious processes
8

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start drop and start start drop and start drop and start drop and start drop and start ucbrowser_v7.0.185.1002_windows_pf101_(build18010215).exe stats_uploader.exe stats_uploader.exe stats_uploader.exe stats_uploader.exe ucbrowser_installer.exe stats_uploader.exe stats_uploader.exe setup.exe sc.exe no specs sc.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs ucbrowser.exe no specs ucservice.exe ucbrowser.exe no specs ucservice.exe stats_uploader.exe ucbrowser.exe ucbrowser.exe stats_uploader.exe ucbrowser.exe no specs ucservice.exe ucbrowser.exe ucbrowser.exe no specs setup.exe ucbrowser.exe no specs ucbrowser.exe no specs ucbrowser.exe no specs ucbrowser.exe no specs ucbrowser.exe no specs chrmstp.exe no specs ucbrowser.exe no specs ucbrowser.exe no specs ucbrowser.exe no specs ucbrowser.exe no specs ucbrowser.exe no specs stats_uploader.exe ucbrowser.exe ucbrowser.exe no specs ucbrowser.exe no specs ucbrowser.exe no specs ucbrowser.exe no specs ucbrowser.exe no specs stats_uploader.exe stats_uploader.exe ucbrowser_v7.0.185.1002_windows_pf101_(build18010215).exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\UCBrowser\Application\UCService.exe" --install --startC:\Program Files\UCBrowser\Application\UCService.exe
setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\ucbrowser\application\ucservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\userenv.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
564netsh advfirewall firewall add rule name="UC浏览器" description="UC浏览器" dir=in program="C:\Program Files\UCBrowser\Application\UCBrowser.exe" action=allowC:\Windows\system32\netsh.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
568"C:\Program Files\UCBrowser\Application\UCBrowser.exe" --type=renderer --enable-features=AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,AutofillProfileCleanup<AutofillProfileCleanup,AutomaticTabDiscarding<AutomaticTabDiscarding,BlockSmallPluginContent<PluginPowerSaverTiny,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,ExpectCTReporting<ExpectCTReporting,IncidentReportingDisableUpload<SafeBrowsingIncidentReportingService,IncidentReportingModuleLoadAnalysis<SafeBrowsingIncidentReportingServiceFeatures,IncidentReportingSuspiciousModuleReporting<SafeBrowsingIncidentReportingServiceFeatures,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NetworkTimeServiceQuerying<NetworkTimeQueries,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,NonValidatingReloadOnNormalReload<NonValidatingReloadOnNormalReload,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PassiveDocumentEventListeners<PassiveDocumentEventListeners,PassiveEventListenersDueToFling<PassiveEventListenersDueToFling,PersistentHistograms<PersistentHistograms,PointerEvent<PointerEvent,PreconnectMore<PreconnectMore,PreferHtmlOverPlugins<PreferHtmlOverPlugins,RafAlignedInput<RafAlignedInput,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SpeculativeLaunchServiceWorker<SpeculativeLaunchServiceWorker,TranslateRankerEnforcement<TranslateRanker,UsePasswordSeparatedSigninFlow<PasswordSeparatedSigninFlow,WebRTC-EnableWebRtcEcdsa<WebRTC-EnableWebRtcEcdsa,WebRTC-H264WithOpenH264FFmpeg<WebRTC-H264WithOpenH264FFmpeg,token-binding<TokenBinding,use-new-media-cache<use-new-media-cache --disable-features=DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame --force-fieldtrials=AutofillClassifier/Enabled/AutofillCreditCardSigninPromo/EnabledFive/AutofillFieldMetadata/Enabled/*AutofillProfileCleanup/Enabled/AutofillProfileOrderByFrecency/EnabledLimitTo3/*AutomaticTabDiscarding/Enabled_Once_10-gen2/*BrowserBlacklist/Enabled/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Enabled/ChromotingQUIC/Enabled/DataReductionProxyUseQuic/Enabled/DefaultBrowserInfobar/SettingsTextNotNow/DefaultEnableGpuRasterization/DefaultEnableGpuRasterization/*DisallowFetchForDocWrittenScriptsInMainFrame/DocumentWriteScriptBlockGroup/EnableAppContainer/Enabled/EnableGoogleCachedCopyTextExperiment/Button/*EnableMediaRouter/Enabled/EnableMediaRouterWithCastExtension/Enabled/EnableSessionCrashedBubbleUI/Enabled/EnableWin32kLockDownMimeTypes/PPAPILockdown_Enabled/ExpectCTReporting/ExpectCTReportingEnabled/ExtensionActionRedesign/Enabled/*ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleBrandedContextMenu/branded/GoogleNow/Enable/*IconNTP/Default/*InstanceID/Enabled/IntelligentSessionRestore/Enabled/MaterialDesignDownloads/Enabled/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/MojoChannel/Enabled/*NetworkQualityEstimator/Enabled/*NetworkTimeQueries/NetworkTimeQueriesEnabled/NewAudioRenderingMixingStrategy/Enabled/*NewProfileManagement/Enabled/NonValidatingReloadOnNormalReload/Enabled/OfferUploadCreditCards/Enabled/OutOfProcessPac/Enabled/*PageRevisitInstrumentation/Enabled/*ParseHTMLOnMainThread/Enabled/PassiveDocumentEventListeners/Enabled/PassiveEventListenersDueToFling/Enabled/PasswordBranding/SmartLockBrandingSavePromptOnly/PasswordGeneration/Disabled/*PasswordManagerSettingsMigration/Enable/PasswordSeparatedSigninFlow/Enabled/PasswordSmartBubble/3-Times/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PointerEvent/Enabled/PreconnectMore/Enabled/PreferHtmlOverPlugins/Enabled/*QUIC/Enabled/RafAlignedInput/Enabled/RefreshTokenDeviceId/Enabled/ReportCertificateErrors/ShowAndPossiblySend/SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingIncidentReportingServiceFeatures/WithSuspiciousModuleReporting/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingUpdateFrequency/UpdateTime15m/SafeBrowsingV4LocalDatabaseManagerEnabled/Enabled/SchedulerExpensiveTaskBlocking/Enabled/SdchPersistence/Enabled/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/*SettingsEnforcement/enforce_always_with_extensions_and_dse/SignInPasswordPromo/Enable2/*SiteEngagement/AggressiveAccumulation/SpeculativeLaunchServiceWorker/Enabled/StrictSecureCookies/Enabled/SyncHttpContentCompression/Enabled/TabSyncByRecency/Enabled/*TokenBinding/TokenBinding/*TranslateRanker/EnforcementEnabled/*TriggeredResetFieldTrial/On/V8CacheStrategiesForCacheStorage/default/WebBluetoothBlacklist/TestGroup/WebFontsInterventionV2/Enabled-slow2g/WebRTC-EnableWebRtcEcdsa/Enabled/WebRTC-H264WithOpenH264FFmpeg/Enabled/WebRTC-LocalIPPermissionCheck/Enabled/use-new-media-cache/Enabled/ --primordial-pipe-token=C7FB2BF29D54259B634E294D673A045E --wow-extension-center-url=https://chrome.google.com/webstore/category/extensions --lang=en-US --extension-process --enable-webrtc-hw-h264-encoding --wow-extension-center-url=https://chrome.google.com/webstore/category/extensions --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true,parseHTMLOnMainThreadCoalesceChunks=false,parseHTMLOnMainThreadSyncTokenize=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --wow-user-agent=UBrowser/7.0.185.1002 --service-request-channel-token=C7FB2BF29D54259B634E294D673A045E --mojo-platform-channel-handle=2064 /prefetch:1C:\Program Files\UCBrowser\Application\UCBrowser.exe—UCBrowser.exe
User:
admin
Company:
UCWeb Inc.
Integrity Level:
LOW
Description:
UC Browser
Exit code:
0
Version:
7.0.185.1002
Modules
Images
c:\program files\ucbrowser\application\ucbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ucbrowser\application\7.0.185.1002\chrome_elf.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
572sc.exe delete UCBrowserSvcC:\Windows\system32\sc.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
624"C:\Program Files\UCBrowser\Application\UCBrowser.exe" --type=renderer --enable-features=AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,AutofillProfileCleanup<AutofillProfileCleanup,AutomaticTabDiscarding<AutomaticTabDiscarding,BlockSmallPluginContent<PluginPowerSaverTiny,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,ExpectCTReporting<ExpectCTReporting,IncidentReportingDisableUpload<SafeBrowsingIncidentReportingService,IncidentReportingModuleLoadAnalysis<SafeBrowsingIncidentReportingServiceFeatures,IncidentReportingSuspiciousModuleReporting<SafeBrowsingIncidentReportingServiceFeatures,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NetworkTimeServiceQuerying<NetworkTimeQueries,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,NonValidatingReloadOnNormalReload<NonValidatingReloadOnNormalReload,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PassiveDocumentEventListeners<PassiveDocumentEventListeners,PassiveEventListenersDueToFling<PassiveEventListenersDueToFling,PersistentHistograms<PersistentHistograms,PointerEvent<PointerEvent,PreconnectMore<PreconnectMore,PreferHtmlOverPlugins<PreferHtmlOverPlugins,RafAlignedInput<RafAlignedInput,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SpeculativeLaunchServiceWorker<SpeculativeLaunchServiceWorker,TranslateRankerEnforcement<TranslateRanker,UsePasswordSeparatedSigninFlow<PasswordSeparatedSigninFlow,WebRTC-EnableWebRtcEcdsa<WebRTC-EnableWebRtcEcdsa,WebRTC-H264WithOpenH264FFmpeg<WebRTC-H264WithOpenH264FFmpeg,token-binding<TokenBinding,use-new-media-cache<use-new-media-cache --disable-features=DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame --force-fieldtrials=AutofillClassifier/Enabled/AutofillCreditCardSigninPromo/EnabledFive/AutofillFieldMetadata/Enabled/*AutofillProfileCleanup/Enabled/AutofillProfileOrderByFrecency/EnabledLimitTo3/*AutomaticTabDiscarding/Enabled_Once_10-gen2/BrowserBlacklist/Enabled/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Enabled/ChromotingQUIC/Enabled/DataReductionProxyUseQuic/Enabled/DefaultBrowserInfobar/SettingsTextNotNow/DefaultEnableGpuRasterization/DefaultEnableGpuRasterization/DisallowFetchForDocWrittenScriptsInMainFrame/DocumentWriteScriptBlockGroup/EnableAppContainer/Enabled/EnableGoogleCachedCopyTextExperiment/Button/EnableMediaRouter/Enabled/EnableMediaRouterWithCastExtension/Enabled/EnableSessionCrashedBubbleUI/Enabled/EnableWin32kLockDownMimeTypes/PPAPILockdown_Enabled/ExpectCTReporting/ExpectCTReportingEnabled/ExtensionActionRedesign/Enabled/*ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleBrandedContextMenu/branded/GoogleNow/Enable/*IconNTP/Default/*InstanceID/Enabled/IntelligentSessionRestore/Enabled/MaterialDesignDownloads/Enabled/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/MojoChannel/Enabled/*NetworkQualityEstimator/Enabled/*NetworkTimeQueries/NetworkTimeQueriesEnabled/NewAudioRenderingMixingStrategy/Enabled/*NewProfileManagement/Enabled/NonValidatingReloadOnNormalReload/Enabled/OfferUploadCreditCards/Enabled/OutOfProcessPac/Enabled/*PageRevisitInstrumentation/Enabled/ParseHTMLOnMainThread/Enabled/PassiveDocumentEventListeners/Enabled/PassiveEventListenersDueToFling/Enabled/PasswordBranding/SmartLockBrandingSavePromptOnly/PasswordGeneration/Disabled/*PasswordManagerSettingsMigration/Enable/PasswordSeparatedSigninFlow/Enabled/PasswordSmartBubble/3-Times/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/PointerEvent/Enabled/PreconnectMore/Enabled/PreferHtmlOverPlugins/Enabled/*QUIC/Enabled/RafAlignedInput/Enabled/RefreshTokenDeviceId/Enabled/ReportCertificateErrors/ShowAndPossiblySend/SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingIncidentReportingServiceFeatures/WithSuspiciousModuleReporting/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingUpdateFrequency/UpdateTime15m/SafeBrowsingV4LocalDatabaseManagerEnabled/Enabled/SchedulerExpensiveTaskBlocking/Enabled/SdchPersistence/Enabled/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/*SettingsEnforcement/enforce_always_with_extensions_and_dse/SignInPasswordPromo/Enable2/*SiteEngagement/AggressiveAccumulation/SpeculativeLaunchServiceWorker/Enabled/StrictSecureCookies/Enabled/SyncHttpContentCompression/Enabled/TabSyncByRecency/Enabled/*TokenBinding/TokenBinding/*TranslateRanker/EnforcementEnabled/*TriggeredResetFieldTrial/On/V8CacheStrategiesForCacheStorage/default/WebBluetoothBlacklist/TestGroup/WebFontsInterventionV2/Enabled-slow2g/WebRTC-EnableWebRtcEcdsa/Enabled/WebRTC-H264WithOpenH264FFmpeg/Enabled/WebRTC-LocalIPPermissionCheck/Enabled/use-new-media-cache/Enabled/ --primordial-pipe-token=B32543CB8B37E30B3E84089D548B0F79 --wow-extension-center-url=https://chrome.google.com/webstore/category/extensions --lang=en-US --wow-extension-center-url=https://chrome.google.com/webstore/category/extensions --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true,parseHTMLOnMainThreadCoalesceChunks=false,parseHTMLOnMainThreadSyncTokenize=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --wow-user-agent=UBrowser/7.0.185.1002 --service-request-channel-token=B32543CB8B37E30B3E84089D548B0F79 --mojo-platform-channel-handle=1540 /prefetch:1C:\Program Files\UCBrowser\Application\UCBrowser.exe—UCBrowser.exe
User:
admin
Company:
UCWeb Inc.
Integrity Level:
LOW
Description:
UC Browser
Exit code:
0
Version:
7.0.185.1002
Modules
Images
c:\program files\ucbrowser\application\ucbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ucbrowser\application\7.0.185.1002\chrome_elf.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1152"C:\Program Files\UCBrowser\Application\UCBrowser.exe" --type=renderer --lang=en-US --wow-warm-up --wow-silent-launch-child-processC:\Program Files\UCBrowser\Application\UCBrowser.exe—UCService.exe
User:
admin
Company:
UCWeb Inc.
Integrity Level:
MEDIUM
Description:
UC Browser
Exit code:
0
Version:
7.0.185.1002
Modules
Images
c:\program files\ucbrowser\application\ucbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ucbrowser\application\7.0.185.1002\chrome_elf.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1220"C:\Program Files\UCBrowser\Application\UCBrowser.exe" --type=renderer --enable-features=AutofillCreditCardSigninPromo<AutofillCreditCardSigninPromo,AutofillProfileCleanup<AutofillProfileCleanup,AutomaticTabDiscarding<AutomaticTabDiscarding,BlockSmallPluginContent<PluginPowerSaverTiny,DefaultEnableGpuRasterization<DefaultEnableGpuRasterization,ExpectCTReporting<ExpectCTReporting,IncidentReportingDisableUpload<SafeBrowsingIncidentReportingService,IncidentReportingModuleLoadAnalysis<SafeBrowsingIncidentReportingServiceFeatures,IncidentReportingSuspiciousModuleReporting<SafeBrowsingIncidentReportingServiceFeatures,MaterialDesignUserManager<MaterialDesignUserManager,MediaFoundationH264Encoding<MediaFoundationH264Encoding,MetricsReporting<MetricsAndCrashSampling,NetworkTimeServiceQuerying<NetworkTimeQueries,NewAudioRenderingMixingStrategy<NewAudioRenderingMixingStrategy,NonValidatingReloadOnNormalReload<NonValidatingReloadOnNormalReload,ParseHTMLOnMainThread<ParseHTMLOnMainThread,PassiveDocumentEventListeners<PassiveDocumentEventListeners,PassiveEventListenersDueToFling<PassiveEventListenersDueToFling,PersistentHistograms<PersistentHistograms,PointerEvent<PointerEvent,PreconnectMore<PreconnectMore,PreferHtmlOverPlugins<PreferHtmlOverPlugins,RafAlignedInput<RafAlignedInput,SecurityChip<SecurityChip,SecurityWarningIconUpdate<SecurityWarningIconUpdate,SpeculativeLaunchServiceWorker<SpeculativeLaunchServiceWorker,TranslateRankerEnforcement<TranslateRanker,UsePasswordSeparatedSigninFlow<PasswordSeparatedSigninFlow,WebRTC-EnableWebRtcEcdsa<WebRTC-EnableWebRtcEcdsa,WebRTC-H264WithOpenH264FFmpeg<WebRTC-H264WithOpenH264FFmpeg,token-binding<TokenBinding,use-new-media-cache<use-new-media-cache --disable-features=DocumentWriteEvaluator<DisallowFetchForDocWrittenScriptsInMainFrame --force-fieldtrials=AutofillClassifier/Enabled/AutofillCreditCardSigninPromo/EnabledFive/AutofillFieldMetadata/Enabled/*AutofillProfileCleanup/Enabled/AutofillProfileOrderByFrecency/EnabledLimitTo3/*AutomaticTabDiscarding/Enabled_Once_10-gen2/*BrowserBlacklist/Enabled/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Enabled/ChromotingQUIC/Enabled/DataReductionProxyUseQuic/Enabled/DefaultBrowserInfobar/SettingsTextNotNow/DefaultEnableGpuRasterization/DefaultEnableGpuRasterization/*DisallowFetchForDocWrittenScriptsInMainFrame/DocumentWriteScriptBlockGroup/EnableAppContainer/Enabled/EnableGoogleCachedCopyTextExperiment/Button/*EnableMediaRouter/Enabled/EnableMediaRouterWithCastExtension/Enabled/EnableSessionCrashedBubbleUI/Enabled/EnableWin32kLockDownMimeTypes/PPAPILockdown_Enabled/ExpectCTReporting/ExpectCTReportingEnabled/ExtensionActionRedesign/Enabled/*ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleBrandedContextMenu/branded/GoogleNow/Enable/*IconNTP/Default/*InstanceID/Enabled/IntelligentSessionRestore/Enabled/MaterialDesignDownloads/Enabled/MaterialDesignUserManager/Enabled/MediaFoundationH264Encoding/Enabled/MetricsAndCrashSampling/InReportingSample/MojoChannel/Enabled/*NetworkQualityEstimator/Enabled/*NetworkTimeQueries/NetworkTimeQueriesEnabled/NewAudioRenderingMixingStrategy/Enabled/*NewProfileManagement/Enabled/*NonValidatingReloadOnNormalReload/Enabled/OfferUploadCreditCards/Enabled/OutOfProcessPac/Enabled/*PageRevisitInstrumentation/Enabled/*ParseHTMLOnMainThread/Enabled/*PassiveDocumentEventListeners/Enabled/*PassiveEventListenersDueToFling/Enabled/PasswordBranding/SmartLockBrandingSavePromptOnly/*PasswordGeneration/Disabled/*PasswordManagerSettingsMigration/Enable/PasswordSeparatedSigninFlow/Enabled/PasswordSmartBubble/3-Times/*PersistentHistograms/EnabledInMemory/PluginPowerSaverTiny/Enabled/*PointerEvent/Enabled/*PreconnectMore/Enabled/PreferHtmlOverPlugins/Enabled/*QUIC/Enabled/*RafAlignedInput/Enabled/RefreshTokenDeviceId/Enabled/ReportCertificateErrors/ShowAndPossiblySend/SRTPromptFieldTrial/On/SSLCommonNameMismatchHandling/Enabled/*SafeBrowsingIncidentReportingService/Enabled/SafeBrowsingIncidentReportingServiceFeatures/WithSuspiciousModuleReporting/SafeBrowsingReportPhishingErrorLink/Enabled/SafeBrowsingUpdateFrequency/UpdateTime15m/SafeBrowsingV4LocalDatabaseManagerEnabled/Enabled/SchedulerExpensiveTaskBlocking/Enabled/SdchPersistence/Enabled/*SecurityChip/Enabled/SecurityWarningIconUpdate/Enabled/*SettingsEnforcement/enforce_always_with_extensions_and_dse/SignInPasswordPromo/Enable2/*SiteEngagement/AggressiveAccumulation/*SpeculativeLaunchServiceWorker/Enabled/*StrictSecureCookies/Enabled/SyncHttpContentCompression/Enabled/TabSyncByRecency/Enabled/*TokenBinding/TokenBinding/*TranslateRanker/EnforcementEnabled/*TriggeredResetFieldTrial/On/*V8CacheStrategiesForCacheStorage/default/WebBluetoothBlacklist/TestGroup/*WebFontsInterventionV2/Enabled-slow2g/WebRTC-EnableWebRtcEcdsa/Enabled/WebRTC-H264WithOpenH264FFmpeg/Enabled/WebRTC-LocalIPPermissionCheck/Enabled/use-new-media-cache/Enabled/ --primordial-pipe-token=67A1CCBAF8D304F6F255B81FED7B8548 --wow-extension-center-url=https://chrome.google.com/webstore/category/extensions --lang=en-US --wow-extension-center-url=https://chrome.google.com/webstore/category/extensions --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true,parseHTMLOnMainThreadCoalesceChunks=false,parseHTMLOnMainThreadSyncTokenize=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --wow-user-agent=UBrowser/7.0.185.1002 --service-request-channel-token=67A1CCBAF8D304F6F255B81FED7B8548 --mojo-platform-channel-handle=3168 /prefetch:1C:\Program Files\UCBrowser\Application\UCBrowser.exe—UCBrowser.exe
User:
admin
Company:
UCWeb Inc.
Integrity Level:
LOW
Description:
UC Browser
Exit code:
0
Version:
7.0.185.1002
Modules
Images
c:\program files\ucbrowser\application\ucbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ucbrowser\application\7.0.185.1002\chrome_elf.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1308"C:\Users\admin\AppData\Local\Temp\UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe" C:\Users\admin\AppData\Local\Temp\UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe—explorer.exe
User:
admin
Company:
UCWeb Inc.
Integrity Level:
MEDIUM
Description:
UCBrowser Online Installer
Exit code:
3221226540
Version:
7.0.185.1002
Modules
Images
c:\users\admin\appdata\local\temp\ucbrowser_v7.0.185.1002_windows_pf101_(build18010215).exe
c:\systemroot\system32\ntdll.dll
1392"C:\Program Files\UCBrowser\Application\UCBrowser.exe" --make-default-browserC:\Program Files\UCBrowser\Application\UCBrowser.exe—setup.exe
User:
admin
Company:
UCWeb Inc.
Integrity Level:
HIGH
Description:
UC Browser
Exit code:
0
Version:
7.0.185.1002
Modules
Images
c:\program files\ucbrowser\application\ucbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ucbrowser\application\7.0.185.1002\chrome_elf.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1404"C:\Program Files\UCBrowser\Application\UCBrowser.exe" --type=crashpad-handler /prefetch:7 "--database=C:\Program Files\UCBrowser\Application\7.0.185.1002" "--metrics-dir=C:\Program Files\UCBrowser\Application\7.0.185.1002" --annotation=channel= --annotation=plat=Win32 "--annotation=prod=UC Browser" --annotation=ver=7.0.185.1002 --handshake-handle=0x98C:\Program Files\UCBrowser\Application\UCBrowser.exe—UCBrowser.exe
User:
admin
Company:
UCWeb Inc.
Integrity Level:
MEDIUM
Description:
UC Browser
Exit code:
0
Version:
7.0.185.1002
Modules
Images
c:\program files\ucbrowser\application\ucbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ucbrowser\application\7.0.185.1002\chrome_elf.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
2 101
Read events
1 152
Write events
923
Delete events
26

Modification events

(PID) Process:(2020) UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\UCBrowserPID
Operation:writeName:MachineID
Value:
d4f69db701b194d48215e4b27e30aab6
(PID) Process:(2020) UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exeKey:HKEY_CURRENT_USER\Software\UCBrowserPID
Operation:writeName:MachineID
Value:
d4f69db701b194d48215e4b27e30aab6
(PID) Process:(2020) UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\UCBrowserPID
Operation:writeName:MachineIDEx
Value:
2538367513ae5e28001ca6e504f18d27v0000002662c9e74
(PID) Process:(2020) UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exeKey:HKEY_CURRENT_USER\Software\UCBrowserPID
Operation:writeName:MachineIDEx
Value:
2538367513ae5e28001ca6e504f18d27v0000002662c9e74
(PID) Process:(3688) stats_uploader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stats_uploader_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3688) stats_uploader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stats_uploader_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3688) stats_uploader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stats_uploader_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3688) stats_uploader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stats_uploader_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3688) stats_uploader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stats_uploader_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3688) stats_uploader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stats_uploader_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
31
Suspicious files
94
Text files
169
Unknown types
59

Dropped files

PID
Process
Filename
Type
2020UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exeC:\Users\admin\AppData\Local\UCBrowser\Online_Downloader\installer_url_config.tmp —
MD5:—
SHA256:—
2020UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exeC:\Users\admin\AppData\Local\UCBrowser\Online_Downloader\installer_channel.md5.tmp —
MD5:—
SHA256:—
2020UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exeC:\Users\admin\AppData\Local\UCBrowser\Online_Downloader\installer_channel.zip.tmp —
MD5:—
SHA256:—
2020UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exeC:\Users\admin\AppData\Local\UCBrowser\Online_Downloader\installer_channel.zip —
MD5:—
SHA256:—
2020UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exeC:\Users\admin\AppData\Local\UCBrowser\Online_Downloader\unzip_installer_temp\UCBrowserInstaller\chrome.packed.7z —
MD5:—
SHA256:—
1720setup.exeC:\Program Files\UCBrowser\Temp\source1720_7790\chrome.7z —
MD5:—
SHA256:—
1720setup.exeC:\Program Files\UCBrowser\Temp\source1720_7790\564E.tmp —
MD5:—
SHA256:—
4060stats_uploader.exeC:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dathiv
MD5:—
SHA256:—
3688stats_uploader.exeC:\Users\Administrator\NTUSER.DAThiv
MD5:—
SHA256:—
4060stats_uploader.exeC:\Users\Administrator\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1log
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
142
TCP/UDP connections
149
DNS requests
125
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2020
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
GET
302
195.27.31.250:80
http://umpackpc.ucweb.com/pcbrowser_i18n/down.php?id=101&type=md5&pid=4601
DE
—
—
malicious
2020
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
GET
302
195.27.31.250:80
http://umpackpc.ucweb.com/pcbrowser_i18n/down.php?id=101&type=zip&pid=4601
DE
—
—
malicious
3268
UCBrowser.exe
GET
—
106.15.15.135:80
http://ip.taobao.com/service/getIpInfo.php?ip=myip
CN
—
—
malicious
2020
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
GET
200
2.16.186.106:80
http://umcdnpc.ucweb.com/down/i18n/35151/4601/UCBrowser_V7.0.185.1002_4601_(Build1801021540)_(en-us).exe.md5
unknown
text
68 b
whitelisted
2020
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
GET
200
168.235.193.157:80
http://ucip.uc.cn/get_ip_attr?type=1&format=0&caller=gj_pcbrowser&key=097a6150b0c772f7952807c0cb48fb86
US
text
112 b
unknown
2020
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
GET
200
47.89.65.224:80
http://www.uc123.com/pcbrowser_i18n/downloader.php?pid=4601&version=7.0.185.1002&os=win&arch=x86
US
text
656 b
malicious
2020
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
GET
200
2.16.186.106:80
http://umcdnpc.ucweb.com/down/i18n/35151/4601/UCBrowser_V7.0.185.1002_4601_(Build1801021540)_(en-us).exe.zip
unknown
compressed
41.0 Mb
whitelisted
1552
ucbrowser_installer.exe
GET
200
168.235.193.157:80
http://ucip.uc.cn/get_ip_attr?type=1&format=0&caller=gj_pcbrowser&key=097a6150b0c772f7952807c0cb48fb86
US
text
112 b
unknown
3268
UCBrowser.exe
GET
200
213.244.178.250:80
http://en.uc123.com/
GB
html
4.81 Kb
suspicious
3268
UCBrowser.exe
GET
200
213.244.178.250:80
http://g.alicdn.com/browser/i18n_uc123/0.1.5/en_index/css/uc.index.pkg.min.css
GB
text
5.17 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2020
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
168.235.193.157:80
ucip.uc.cn
QUANTIL, INC
US
unknown
3688
stats_uploader.exe
168.235.193.143:443
i18nmmstat.ucweb.com
QUANTIL, INC
US
unknown
4060
stats_uploader.exe
168.235.193.143:443
i18nmmstat.ucweb.com
QUANTIL, INC
US
unknown
3264
stats_uploader.exe
168.235.193.143:443
i18nmmstat.ucweb.com
QUANTIL, INC
US
unknown
2020
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
195.27.31.250:80
umpackpc.ucweb.com
CW Vodafone Group PLC
DE
unknown
2020
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
47.89.65.224:80
www.uc123.com
Zhejiang Taobao Network Co.,Ltd
US
unknown
2020
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
2.16.186.106:80
umcdnpc.ucweb.com
Akamai International B.V.
—
whitelisted
3384
stats_uploader.exe
168.235.193.143:443
i18nmmstat.ucweb.com
QUANTIL, INC
US
unknown
1552
ucbrowser_installer.exe
168.235.193.157:80
ucip.uc.cn
QUANTIL, INC
US
unknown
3420
stats_uploader.exe
168.235.193.143:443
i18nmmstat.ucweb.com
QUANTIL, INC
US
unknown

DNS requests

Domain
IP
Reputation
ucip.uc.cn
  • 168.235.193.157
unknown
i18nmmstat.ucweb.com
  • 168.235.193.143
unknown
www.uc123.com
  • 47.89.65.224
  • 47.89.65.44
  • 47.89.65.43
  • 47.89.65.194
  • 47.89.65.41
  • 47.89.65.225
  • 47.89.65.42
  • 47.89.65.195
malicious
umpackpc.ucweb.com
  • 195.27.31.250
  • 195.27.31.240
unknown
umcdnpc.ucweb.com
  • 2.16.186.106
  • 2.16.186.105
whitelisted
pcus.ucweb.com
  • 14.116.143.164
unknown
www.google.com
  • 216.58.206.4
malicious
chromium-i18n.appspot.com
  • 172.217.21.244
whitelisted
en.uc123.com
  • 213.244.178.250
  • 213.244.178.240
suspicious
clients2.google.com
  • 172.217.23.174
whitelisted

Threats

Found threats are available for the paid subscriptions
3 ETPRO signatures available at the full report
Process
Message
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
[2020:3728:1003/164525:INFO:wow_locale_util.cc(118)] Country Code: IT
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
[2020:1960:1003/164525:WARNING:wow_install_downloader_proxy.cc(190)] clear temp download data
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
[2020:3948:1003/164525:ERROR:wow_wmi_utils.cc(149)] Failed to initialize security. result = -2147417831
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
[2020:1960:1003/164525:INFO:wow_stats_helper.cc(325)] bluesky.1.2.3.1.1?cache=6035999000&ka=&kb=d4f69db701b194d48215e4b27e30aab6&kc=2538367513ae5e28001ca6e504f18d27v0000002662c9e74&firstpid=4595&bid=35151&os_ver=6.1.7601_SP1&ver=7.0.185.1002&installpid=4601&lang=en-US
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
[2020:1960:1003/164525:INFO:wow_stats_helper.cc(329)] https://i18nmmstat.ucweb.com/lv=1.0&encrypt_data=bTkwAgShACD8ahrZgktoY+v5lz2DId0XJ5e4CwyWohhkSSL0F9SbIb56YXOM4VuWqCYZW8r9YY1k24P3CYsK4SaJ0S8bnGv1HLwoEdqoiMzYaXOgy7r2rMUIuBRQQ662U2T0HBRdSkFfsZbmgGFlacySFUOWdEZ51kRTTlMAPQMQJqCwFRXARzdkvFiReaUwrtI8toad9Z3riw7rat9RimHWB1Rs4GT/f3SQvu39cu7aGvup+ck1nujMPQdjn82kMv17q3P3zfVf8hOUsOykWUxfhB30Fho+iyWFvwI1vUs=
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
[2020:1960:1003/164525:INFO:wow_stats_helper.cc(325)] bluesky.1.2.3.1.15?cache=6036015000&ka=&kb=d4f69db701b194d48215e4b27e30aab6&kc=2538367513ae5e28001ca6e504f18d27v0000002662c9e74&firstpid=4595&bid=35151&os_ver=6.1.7601_SP1&ver=7.0.185.1002&from=1&avproducts=&lang=en-US
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
[2020:1960:1003/164525:INFO:wow_stats_helper.cc(329)] https://i18nmmstat.ucweb.com/lv=1.0&encrypt_data=bTkwAhmhAv/RagT+dUtqAjX5m//pIcHZZJ3eZM+dpaebTykOtN2buMd6YVU9vbp+I3m0zR6tUhr9jvbvz9hw197ZzS3gmCvcD+wDfMOry+XtPV+nEeTlfegDmYR4QYArHWC82EdXqtVP43JCwDFagOTFeGGucXsNEUSxv64CG3BEd9r8FxYyN6V/g4gyYIq4KdMcCC/Zos4BhVJS39usVNn6xuunr0cLKWv/5KD8ZlcLezgvHN5G7p7ScREPkiSwy/1JRzT/nAYmo4CNh/67RvMLnILOBJXZgSFPcLMD6+drQiIN
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
[2020:1960:1003/164529:INFO:wow_stats_helper.cc(325)] bluesky.1.2.3.1.2?cache=6040109000&ka=&kb=d4f69db701b194d48215e4b27e30aab6&kc=2538367513ae5e28001ca6e504f18d27v0000002662c9e74&firstpid=4595&bid=35151&os_ver=6.1.7601_SP1&ver=7.0.185.1002&installpid=4601&lang=en-US
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
[2020:1960:1003/164529:INFO:wow_stats_helper.cc(329)] https://i18nmmstat.ucweb.com/lv=1.0&encrypt_data=bTkwAiCkEp3YZfRcfkha5CPz+yPbOyEdWI5ygKBvmKH0tW2Fr8nTNSpph+IY1vEFEBCNaTLr/bOoNgEATf6IdEbhQTc79PudGJv2vNaD6nOwSy/Go5hKThlpYresolTX40CsMESxYn3rmoAfNE4PglT8EZkeWlovupFB4TdtL77QFoDA1WUgl1M7cg3NKpdnpihweL5XiafXwqQQRhbrQzGar5A8JIy7q7cW/xk6+K2iXE/rYY+pUGRxn0Dn2q/hkiXLY9OPHU2bhS1p/LdmlmSNuMscpCZsl/S/7B7koZo=
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
[2020:1904:1003/164529:INFO:wow_install_downloader_proxy.cc(425)] Config url: http://www.uc123.com/pcbrowser_i18n/downloader.php?pid=4601&version=7.0.185.1002&os=win&arch=x86
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe