URL:

http://pcclient.download.youku.com/youkuclient/youkuclient_setup_7.6.5.10245.exe

Full analysis: https://app.any.run/tasks/93de0697-5cd1-4e3c-ab9e-46f23db2e721
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: October 12, 2019, 10:57:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
Indicators:
MD5:

6EDFAA398BA131840F0F775691CA49B1

SHA1:

C8B7DAD4DA7DBD1352EB9C39213A2B43F71DE42A

SHA256:

9B3A28DB60970D2039D341B8AF42BD5A7AAE55B6FE2F9E71478E333D0D4066D8

SSDEEP:

3:N1KOGTALREWETJMeq/JMeyQQSLTCZ:COUAFnMMtBMgq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)
      • YoukuMediaCenter.exe (PID: 3304)
      • YoukuMediaCenter.exe (PID: 2668)
      • regsvr32.exe (PID: 2560)
      • regsvr32.exe (PID: 1024)
      • YoukuMediaCenter.exe (PID: 2292)
      • YoukuMediaCenter.exe (PID: 2980)
      • YoukuMediaCenter.exe (PID: 3012)
      • WebServe.exe (PID: 4000)
      • WebServe.exe (PID: 2892)
      • YoukuDesktop.exe (PID: 3240)
      • YoukuMediaCenter.exe (PID: 2624)
      • YoukuMediaCenter.exe (PID: 1916)
      • YoukuMediaCenter.exe (PID: 1764)
      • pc-sdk-setup.exe (PID: 2740)
      • pc-sdk-setup.exe (PID: 3120)
      • AlibabaProtect.exe (PID: 3400)
      • YoukuMediaCenter.exe (PID: 2496)
      • YoukuDesktop.exe (PID: 3904)

    • Application was dropped or rewritten from another process

      • youkuclient_setup_7.6.5.10245.exe (PID: 2840)
      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)
      • YoukuMediaCenter.exe (PID: 3304)
      • ns1DDE.tmp (PID: 944)
      • nsD5F6.tmp (PID: 2828)
      • YouKuBugReport.exe (PID: 2328)
      • ns41B.tmp (PID: 2772)
      • WebServe.exe (PID: 4000)
      • ns4E18.tmp (PID: 2520)
      • alibabaprotectCon.exe (PID: 3940)
      • WebServe.exe (PID: 2892)
      • YoukuMediaCenter.exe (PID: 2292)
      • alibabaprotectCon.exe (PID: 1516)
      • ns4C52.tmp (PID: 776)
      • YoukuMediaCenter.exe (PID: 2980)
      • YoukuMediaCenter.exe (PID: 3012)
      • ns6F1F.tmp (PID: 2116)
      • YoukuDesktop.exe (PID: 3240)
      • ns69FE.tmp (PID: 892)
      • InstallOnline_inside.exe (PID: 1024)
      • YoukuMediaCenter.exe (PID: 1764)
      • YoukuMediaCenter.exe (PID: 2668)
      • YoukuMediaCenter.exe (PID: 1916)
      • YoukuMediaCenter.exe (PID: 2624)
      • ikuacc.exe (PID: 3680)
      • InstallOnline_inside.exe (PID: 3508)
      • pc-sdk-setup.exe (PID: 2740)
      • AlibabaProtect.exe (PID: 792)
      • ns98F4.tmp (PID: 3824)
      • AlibabaProtect.exe (PID: 3400)
      • AlibabaProtect.exe (PID: 2064)
      • pc-sdk-setup.exe (PID: 3120)
      • AlibabaProtect.exe (PID: 3908)
      • YoukuDesktop.exe (PID: 3904)
      • YoukuMediaCenter.exe (PID: 2496)
      • InstallOnline_inside.exe (PID: 1028)
      • ns2AB4.tmp (PID: 2468)
      • ns972E.tmp (PID: 2424)

    • Downloads executable files from the Internet

      • chrome.exe (PID: 928)

    • Registers / Runs the DLL via REGSVR32.EXE

      • YouKuBugReport.exe (PID: 2328)

    • Changes the autorun value in the registry

      • YoukuMediaCenter.exe (PID: 2668)
      • YoukuMediaCenter.exe (PID: 2980)

    • Changes settings of System certificates

      • AlibabaProtect.exe (PID: 3400)

  • SUSPICIOUS

    • Creates a software uninstall entry

      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 532)
      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)
      • YouKuBugReport.exe (PID: 2328)
      • pc-sdk-setup.exe (PID: 2740)
      • pc-sdk-setup.exe (PID: 3120)

    • Reads internet explorer settings

      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)

    • Creates files in the user directory

      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)
      • YoukuMediaCenter.exe (PID: 2668)
      • YoukuMediaCenter.exe (PID: 2292)
      • YoukuMediaCenter.exe (PID: 2980)
      • YoukuMediaCenter.exe (PID: 3012)
      • YoukuMediaCenter.exe (PID: 2624)
      • YoukuMediaCenter.exe (PID: 1916)
      • ikuacc.exe (PID: 3680)
      • YoukuDesktop.exe (PID: 3240)
      • YoukuMediaCenter.exe (PID: 2496)

    • Reads Internet Cache Settings

      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)
      • YoukuMediaCenter.exe (PID: 2668)
      • YoukuMediaCenter.exe (PID: 2980)

    • Creates files in the Windows directory

      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)
      • WebServe.exe (PID: 2892)
      • AlibabaProtect.exe (PID: 3400)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2560)
      • regsvr32.exe (PID: 1024)
      • YoukuMediaCenter.exe (PID: 2668)
      • YoukuMediaCenter.exe (PID: 2980)

    • Starts application with an unusual extension

      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)
      • pc-sdk-setup.exe (PID: 2740)
      • pc-sdk-setup.exe (PID: 3120)

    • Creates files in the program directory

      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)
      • YoukuMediaCenter.exe (PID: 2292)
      • pc-sdk-setup.exe (PID: 2740)
      • AlibabaProtect.exe (PID: 792)
      • alibabaprotectCon.exe (PID: 1516)
      • AlibabaProtect.exe (PID: 3400)
      • alibabaprotectCon.exe (PID: 3940)
      • pc-sdk-setup.exe (PID: 3120)

    • Modifies the open verb of a shell class

      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)
      • YoukuMediaCenter.exe (PID: 2668)
      • YoukuMediaCenter.exe (PID: 2980)

    • Changes IE settings (feature browser emulation)

      • YoukuMediaCenter.exe (PID: 2668)
      • YoukuMediaCenter.exe (PID: 2980)

    • Removes files from Windows directory

      • WebServe.exe (PID: 2892)

    • Creates or modifies windows services

      • WebServe.exe (PID: 4000)

    • Starts CMD.EXE for commands execution

      • ns4E18.tmp (PID: 2520)
      • ns69FE.tmp (PID: 892)
      • ns6F1F.tmp (PID: 2116)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2392)
      • cmd.exe (PID: 564)
      • cmd.exe (PID: 3900)

    • Executed as Windows Service

      • WebServe.exe (PID: 2892)
      • AlibabaProtect.exe (PID: 3400)

    • Searches for installed software

      • YoukuMediaCenter.exe (PID: 2292)
      • YoukuMediaCenter.exe (PID: 2624)
      • YoukuMediaCenter.exe (PID: 2496)

    • Creates files in the driver directory

      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)

    • Low-level read access rights to disk partition

      • YoukuDesktop.exe (PID: 3240)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 532)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 532)
      • chrome.exe (PID: 928)
      • YoukuDesktop.exe (PID: 3240)

    • Dropped object may contain Bitcoin addresses

      • youkuclient_setup_7.6.5.10245.exe (PID: 2600)
      • YoukuDesktop.exe (PID: 3240)
      • pc-sdk-setup.exe (PID: 2740)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 532)

    • Application launched itself

      • chrome.exe (PID: 532)

    • Reads settings of System Certificates

      • YoukuDesktop.exe (PID: 3240)
      • AlibabaProtect.exe (PID: 3400)
      • YoukuMediaCenter.exe (PID: 2496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
122
Monitored processes
72
Malicious processes
24
Suspicious processes
5

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs youkuclient_setup_7.6.5.10245.exe no specs youkuclient_setup_7.6.5.10245.exe nsd5f6.tmp no specs youkumediacenter.exe no specs ns41b.tmp no specs youkubugreport.exe regsvr32.exe no specs regsvr32.exe no specs ns1dde.tmp no specs youkumediacenter.exe alibabaprotectcon.exe youkumediacenter.exe youkumediacenter.exe youkumediacenter.exe ns4c52.tmp no specs webserve.exe no specs ns4e18.tmp no specs cmd.exe no specs sc.exe no specs webserve.exe alibabaprotectcon.exe ns69fe.tmp no specs cmd.exe no specs sc.exe no specs ns6f1f.tmp no specs cmd.exe no specs sc.exe no specs installonline_inside.exe youkudesktop.exe youkumediacenter.exe youkumediacenter.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs youkumediacenter.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs installonline_inside.exe ikuacc.exe pc-sdk-setup.exe ns972e.tmp no specs alibabaprotect.exe no specs ns98f4.tmp no specs alibabaprotect.exe no specs alibabaprotect.exe pc-sdk-setup.exe ns2ab4.tmp no specs alibabaprotect.exe no specs youkudesktop.exe youkumediacenter.exe installonline_inside.exe

Process information

PID
CMD
Path
Indicators
Parent process
444"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=976,11730090466670949264,8819684291380496565,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15564705657380837435 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
532"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://pcclient.download.youku.com/youkuclient/youkuclient_setup_7.6.5.10245.exe"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
564cmd.exe /c "sc start npf"C:\Windows\system32\cmd.exe—ns6F1F.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
776"C:\Users\admin\AppData\Local\Temp\nszA86D.tmp\ns4C52.tmp" "C:\Program Files\YouKu\YoukuClient\WebServe.exe" -iC:\Users\admin\AppData\Local\Temp\nszA86D.tmp\ns4C52.tmp—youkuclient_setup_7.6.5.10245.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\nsza86d.tmp\ns4c52.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
792"C:\Program Files\AlibabaProtect\1.0.20.850\AlibabaProtect.exe" /startC:\Program Files\AlibabaProtect\1.0.20.850\AlibabaProtect.exe—ns98F4.tmp
User:
admin
Company:
阿里巴巴(中国)软件有限公司
Integrity Level:
HIGH
Description:
Alibaba PC Safe Service
Exit code:
1
Modules
Images
c:\program files\alibabaprotect\1.0.20.850\alibabaprotect.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
892"C:\Users\admin\AppData\Local\Temp\nszA86D.tmp\ns69FE.tmp" cmd.exe /c "sc create npf binPath= "C:\Windows\system32\drivers\npf.sys" type= kernel start= auto error= normal tag= no DisplayName= "NetGroup Packet Filter Driver"C:\Users\admin\AppData\Local\Temp\nszA86D.tmp\ns69FE.tmp—youkuclient_setup_7.6.5.10245.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsza86d.tmp\ns69fe.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
928"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=976,11730090466670949264,8819684291380496565,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=15170889836611902332 --mojo-platform-channel-handle=1460 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
940"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=976,11730090466670949264,8819684291380496565,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1410929385435340933 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
944"C:\Users\admin\AppData\Local\Temp\nszA86D.tmp\ns1DDE.tmp" "C:\Program Files\YouKu\YoukuClient\YoukuMediaCenter.exe" --utils --install --type=ikucmc --action=user --check-dll=0 --arg="repm=0|rm=1|sr=1|pid=youkuclient|pver=7.6.5.10245|tm=0|mf=0|box=1|guide=1|conf=1|path=C:\Program Files\YouKu\YoukuClient\proxy\YoukuDesktop.exe|install_type=new|spk=1|ykgame=0"C:\Users\admin\AppData\Local\Temp\nszA86D.tmp\ns1DDE.tmp—youkuclient_setup_7.6.5.10245.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\nsza86d.tmp\ns1dde.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
952"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=976,11730090466670949264,8819684291380496565,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6167781305525049157 --mojo-platform-channel-handle=4364 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
4 500
Read events
3 027
Write events
1 465
Delete events
8

Modification events

(PID) Process:(532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2176) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:532-13215351437995500
Value:
259
(PID) Process:(532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(532) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:1512-13197841398593750
Value:
0
(PID) Process:(532) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
212
Suspicious files
106
Text files
1 249
Unknown types
460

Dropped files

PID
Process
Filename
Type
532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\5d3e3494-6a4f-484f-b4e4-4cf6d6b02da2.tmp —
MD5:—
SHA256:—
532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp —
MD5:—
SHA256:—
532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF39a979.TMPtext
MD5:—
SHA256:—
532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF39a998.TMPtext
MD5:—
SHA256:—
532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.oldtext
MD5:—
SHA256:—
532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 —
MD5:—
SHA256:—
532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old~RF39a9f6.TMPtext
MD5:—
SHA256:—
532chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\MANIFEST-000001 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
476
TCP/UDP connections
776
DNS requests
90
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2292
YoukuMediaCenter.exe
GET
—
47.92.21.13:80
http://p.youku.com/location?rand=11106
CN
—
—
malicious
2600
youkuclient_setup_7.6.5.10245.exe
GET
200
47.246.43.228:80
http://pcclient.download.youku.com/ugc/iku_bdProName.ini
US
text
357 b
malicious
3940
alibabaprotectCon.exe
GET
—
203.119.169.168:80
http://pcs-sdk-server.alibaba.com/l?umid=&csid=&acnt=&hosttype=16&log=begin%20local_load
CN
—
—
unknown
2600
youkuclient_setup_7.6.5.10245.exe
GET
200
198.11.132.221:80
http://gm.mmstat.com/yt/yt_pcclient.pv.log?ver=7.6.5.10245&cid=installpack&key=1&os=6.1&hw_mac=52-54-00-4A-04-AF&partnerid=ywebapp&ext1=diamondInstall&ext2=0&ext3=1&ext4=new
US
image
43 b
whitelisted
928
chrome.exe
GET
200
47.246.43.230:80
http://pcclient.download.youku.com/youkuclient/youkuclient_setup_7.6.5.10245.exe
US
executable
81.7 Mb
malicious
2668
YoukuMediaCenter.exe
GET
301
198.11.132.53:80
http://pcapp.youku.com/checkpreload.php
US
html
357 b
suspicious
2600
youkuclient_setup_7.6.5.10245.exe
GET
200
198.11.132.221:80
http://gm.mmstat.com/yt/yt_pcclient.pv.log?ver=7.6.5.10245&cid=installpack&key=insFinish&os=6.1&hw_mac=52-54-00-4A-04-AF&partnerid=ywebapp&ext1=1
US
image
43 b
whitelisted
2600
youkuclient_setup_7.6.5.10245.exe
GET
200
198.11.132.221:80
http://gm.mmstat.com/yt/yt_pcclient.pv.log?ver=7.6.5.10245&cid=installpack&key=ikuInsLoc&os=6.1&hw_mac=52-54-00-4A-04-AF&partnerid=ywebapp&ext1=0&ext2=0&ext3=0&ext4=0
US
image
43 b
whitelisted
2668
YoukuMediaCenter.exe
GET
200
198.11.132.221:80
http://gm.mmstat.com/yt/yt_pcclient.initial.log?cid=mediacenter&pid=ywebapp&peerid=100000000000000000005DA1B1EF5254004A04AF&ver=7.6.5.10245&log_type=5000000&start_reason=no_reason&caller=ns1DDE%2Etmp&last_time=0&user_op=NU&hw_cpu=1F8BFBFF000506E3&hw_mem=&hw_w=1280&hw_h=720&hw_mac=5254004a04af&sw_os=win_6%2E1&sw_os_bit=32&sw_browser=ie%2Cfirefox%7Copera%7Cchrome%7Cie&ext_2=68&ext_3=0-0&ext_4=alihttp
US
image
43 b
whitelisted
2668
YoukuMediaCenter.exe
GET
200
198.11.132.221:80
http://gm.mmstat.com/yt/yt_pcclient.initial.log?cid=iku&pid=ywebapp&peerid=100000000000000000005DA1B1EF5254004A04AF&ver=7.6.5.10245&log_type=5000000&start_reason=no_reason&caller=ns1DDE%2Etmp&last_time=0&user_op=NU&hw_cpu=1F8BFBFF000506E3&hw_mem=&hw_w=1280&hw_h=720&hw_mac=5254004a04af&sw_os=win_6%2E1&sw_os_bit=32&sw_browser=ie%2Cfirefox%7Copera%7Cchrome%7Cie&ext_2=68&ext_3=0-0&ext_4=alihttp
US
image
43 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
928
chrome.exe
172.217.18.163:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
928
chrome.exe
47.246.43.230:80
pcclient.download.youku.com
—
US
malicious
928
chrome.exe
172.217.18.164:443
www.google.com
Google Inc.
US
whitelisted
928
chrome.exe
216.58.206.14:443
sb-ssl.google.com
Google Inc.
US
whitelisted
928
chrome.exe
216.58.206.13:443
accounts.google.com
Google Inc.
US
whitelisted
2600
youkuclient_setup_7.6.5.10245.exe
205.204.101.47:443
pcapp-update.youku.com
Alibaba (China) Technology Co., Ltd.
US
suspicious
2668
YoukuMediaCenter.exe
198.11.132.221:443
gm.mmstat.com
Alibaba (China) Technology Co., Ltd.
US
suspicious
—
—
172.217.23.131:443
www.gstatic.com
Google Inc.
US
whitelisted
2600
youkuclient_setup_7.6.5.10245.exe
47.246.43.228:80
pcclient.download.youku.com
—
US
malicious
2600
youkuclient_setup_7.6.5.10245.exe
198.11.132.221:80
gm.mmstat.com
Alibaba (China) Technology Co., Ltd.
US
suspicious

DNS requests

Domain
IP
Reputation
pcclient.download.youku.com
  • 47.246.43.230
  • 47.246.43.228
  • 47.246.43.229
  • 47.246.43.227
  • 47.246.43.226
  • 47.246.43.223
  • 47.246.43.224
  • 47.246.43.225
malicious
clientservices.googleapis.com
  • 172.217.18.163
whitelisted
accounts.google.com
  • 216.58.206.13
shared
www.google.com
  • 172.217.18.164
malicious
ssl.gstatic.com
  • 172.217.18.163
whitelisted
sb-ssl.google.com
  • 216.58.206.14
whitelisted
www.gstatic.com
  • 172.217.23.131
whitelisted
pcapp-update.youku.com
  • 205.204.101.47
  • 198.11.132.53
unknown
gm.mmstat.com
  • 198.11.132.221
whitelisted
safebrowsing.googleapis.com
  • 172.217.18.106
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
—
—
Misc activity
SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
—
—
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
—
—
Misc activity
SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
—
—
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
—
—
Misc activity
SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
—
—
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
—
—
Misc activity
SUSPICIOUS [PTsecurity] Suspicious HTTP header - Sometimes used by hostile installer
—
—
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
1 ETPRO signatures available at the full report
Process
Message
YoukuMediaCenter.exe
1: Hotfix present and filter active 2: Hotfix not present, filter active if this is an affected system 0: Hotfix present, filter not active Current Filter Status:2
YoukuMediaCenter.exe
openapicaller: sspi
YoukuMediaCenter.exe
1: Hotfix present and filter active 2: Hotfix not present, filter active if this is an affected system 0: Hotfix present, filter not active Current Filter Status:2
YoukuMediaCenter.exe
1: Hotfix present and filter active 2: Hotfix not present, filter active if this is an affected system 0: Hotfix present, filter not active Current Filter Status:2
YoukuMediaCenter.exe
1: Hotfix present and filter active 2: Hotfix not present, filter active if this is an affected system 0: Hotfix present, filter not active Current Filter Status:2
YoukuMediaCenter.exe
openapicaller: sspi
YoukuMediaCenter.exe
openapicaller: sspi
WebServe.exe
UTLog:UTReportImpl start
WebServe.exe
UTLog:UTinitFuncAddress start
WebServe.exe
UTLog:UTinit start
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://pcclient.download.youku.com/youkuclient/youkuclient_setup_7.6.5.10245.exe