Malware Analysis Report

2025-08-11 00:59

Sample ID 240518-bgflbacf3w
Target 2024-05-18_4cc405fa0ccf0a6a9f39ab346b9cb2eb_icedid_xiaobaminer
SHA256 cfb74d0076ebfc3f5f08fed10f768b88a9a85f849d67efda4d7bedc8cb046c5c
Tags
blackmoon banker evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cfb74d0076ebfc3f5f08fed10f768b88a9a85f849d67efda4d7bedc8cb046c5c

Threat Level: Known bad

The file 2024-05-18_4cc405fa0ccf0a6a9f39ab346b9cb2eb_icedid_xiaobaminer was found to be: Known bad.

Malicious Activity Summary

blackmoon banker evasion persistence spyware stealer trojan

UAC bypass

Detect Blackmoon payload

Blackmoon family

Blackmoon, KrBanker

Disables RegEdit via registry modification

Adds policy Run key to start application

Drops file in Drivers directory

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Checks whether UAC is enabled

Adds Run key to start application

Drops autorun.inf file

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-18 01:06

Signatures

Blackmoon family

blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 01:06

Reported

2024-05-18 01:09

Platform

win7-20240215-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-18_4cc405fa0ccf0a6a9f39ab346b9cb2eb_icedid_xiaobaminer.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\bitsadmin.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cscript.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\finger.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\printui.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wininit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_amd64_neutral_67b5984f8e8ff717\BrmfRsmg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\odbcad32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\sbunattend.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\shrpubw.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\TCPSVCS.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\more.com C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\InstallShield\_isdel.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cmdl32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\find.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ftp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\notepad.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\rasautou.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\setupugc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\where.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\bthudtask.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cttunesvr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\odbcconf.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SearchProtocolHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SecEdit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wevtutil.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\tree.com C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\driverquery.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\eventcreate.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\MuiUnattend.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wscript.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\dxdiag.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\fixmapi.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\forfiles.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\syskey.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\TsWpfWrp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\autoconv.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Dism.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\powercfg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wiaacmgr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Ribbons.scr C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cmstp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\logman.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\perfhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\PresentationHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\scrnsave.scr C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\AtBroker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cleanmgr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ctfmon.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\icardagt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\iscsicpl.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\mtstocom.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\compact.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\isoburn.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\taskeng.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\vssadmin.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\DeviceProperties.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\extrac32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\help.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\PkgMgr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\PushPrinterConnections.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\raserver.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsImageTemplate.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Media Player\WMPDMC.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Orange Circles.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\currency.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Shades of Blue.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUNGLE.HTM C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Media Player\setup_wm.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\README.HTM C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\currency.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Mail\wab.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\flyout.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_6.1.7601.17514_none_bf7bea0454c3f0cf\bcdboot.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\SearchFilterHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_9edcb4a706944d0a\convert.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\SMSvcHost\04d794428d635f6a82ac57dd3d6f3628\SMSvcHost.ni.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\doskey.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-6.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_6.1.7600.16385_none_5da314d233bb2676\dvdplay.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\misc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\404-8.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\find.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-10.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_6.1.7600.16385_none_94861149bb66249c\powershell_ise.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..xing-service-server_31bf3856ad364e35_6.1.7601.17514_none_0db5e5844ed6ffe9\CIDAEMON.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_658ca9e7eb14c76c\weather.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\401-3.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\403-12.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-9.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\showmount.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_es-es_92a65a18e6532ae7\weather.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_it-it_da156c29d2de7a95\cpu.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_402eca316047a0fe\dialer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-engine_31bf3856ad364e35_6.1.7601.17514_none_43d2529dd579f798\taskeng.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.2.9600.16428_none_caf2ec2ca6b08f27\ieinstal.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.5.7601.17514_none_1f3413afc64d10c5\wuauclt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8a5c3d2bac37e9\ntkrnlpa.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_092d6b9141f16aca\WinMgmt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-openfiles_31bf3856ad364e35_6.1.7600.16385_none_e6fcbd244bb7bf74\openfiles.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-findstr_31bf3856ad364e35_6.1.7601.17514_none_855590d1705431c5\findstr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_5ec90957e1a8fe95\shutdown.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\Backup\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7_ntoskrnl.exe_0fb0ab79 C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\icsunattend.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\posix.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpenc_31bf3856ad364e35_6.1.7600.16385_none_a3fa8a7d892f3cc9\wmpenc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-write_31bf3856ad364e35_6.1.7600.16385_none_5f5928533e6b72c0\write.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2260a04d0daf0ce1\clock.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\write.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\wow64_eventviewersettings_31bf3856ad364e35_6.1.7600.16385_none_5b41740051c4eca4\eventvwr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-autofmt_31bf3856ad364e35_6.1.7601.17514_none_e7fba6c91d7030e3\autofmt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\500-15.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-services-ehrecvr_31bf3856ad364e35_6.1.7601.17514_none_1b8f8373383de46a\ehrecvr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.1.7601.17514_none_7832a1aacb77df29\mcbuilder.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7600.16385_none_61573ee0c2c4be2b\wecutil.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\401-1.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_6.1.7600.16385_none_ad5854ca0a23343d\mount.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_73e472e09a1a05d1\wmpconfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-snmp-evntcmd_31bf3856ad364e35_6.1.7600.16385_none_b8db1dc46558b805\evntcmd.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-5.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_092d6b9141f16aca_winmgmt.exe_8f8eb7b1 C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_6.1.7600.16385_none_f71eddfb459a0155\SystemPropertiesAdvanced.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sonic-sbeserver_31bf3856ad364e35_6.1.7601.17514_none_7b380cb06fd9d81d\SBEServer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_es-es_dbc7c5d1d33a67b5\clock.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_6.1.7600.16385_none_b6cb9ed71c8b43d5\SystemPropertiesPerformance.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_6.1.7600.16385_none_0c9cb55c61e99805\dcomcnfg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_6.1.7601.17514_none_e2a1ffe0ca40cff2\recdisc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\Backup\x86_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.17514_none_da3cb85562df73c9_memtest.exe_01d80391 C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c1ab456ba37238a2\weather.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_f0686b7ca6acde00_mpnotify.exe_bd6992f8 C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-05-18_4cc405fa0ccf0a6a9f39ab346b9cb2eb_icedid_xiaobaminer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: 33 N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-18_4cc405fa0ccf0a6a9f39ab346b9cb2eb_icedid_xiaobaminer.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-18_4cc405fa0ccf0a6a9f39ab346b9cb2eb_icedid_xiaobaminer.exe"

C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"

Network

N/A

Files

memory/1268-0-0x0000000000400000-0x0000000000457000-memory.dmp

C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

MD5 4cc405fa0ccf0a6a9f39ab346b9cb2eb
SHA1 6fd3cc7b5ed824549b2a413f148b90205c032bec
SHA256 cfb74d0076ebfc3f5f08fed10f768b88a9a85f849d67efda4d7bedc8cb046c5c
SHA512 3853891cbf400aa227e893e1a01024217badbc08bae30eec6e3d85411d2ba5c31e83ad278ebecc8c180e62e10b9121cff25dea16f8db88ffaff11551d7085710

memory/1884-9-0x0000000000400000-0x0000000000457000-memory.dmp

memory/1268-8-0x0000000000400000-0x0000000000457000-memory.dmp

memory/1884-395-0x0000000000400000-0x0000000000457000-memory.dmp

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html

MD5 33f73419b8fc156a8a5e0eee311a2639
SHA1 7ebd3842e080ed34f4675eea740c3e90d8db7bc2
SHA256 442c6bfe7c011e24f8c0bb1c0584b96cf804eb7198d4aacffa4c5f6769ff4215
SHA512 1f9e3a64bfc78cea57f4d9fce2ff4f9adfbe7526ef10e40eaa7cd9b8109cfa124b306f6d3be5e1a777bb604dc2c497623aa9298f580cd7e9a6e3bb9818e819ad

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html

MD5 ffbe89b376301d5a5e1602502f3a049e
SHA1 4fd73b0508a04073411bfb0af9f1e77a2009850a
SHA256 fd516ab385f8dabba0da1377f5dfdc0dbdefdd224d823313eff24e8fb00c6217
SHA512 25807dacb22621f69dfc9b85464e566a11b6f417632c9d2dac92b5112a8495aacc5edb2938e5515a59843fe79f25b5c65a280b41fb9b0c27bfce2b4da48cfa02

C:\vcredist2010_x86.log.html

MD5 0a182919dc63ea32c6bf53ca8d76d7fb
SHA1 794f647d0c72dfc8891feae7a446eaec97c619d1
SHA256 c203ee0f7b45e55a1271525513f1a0638e86ebfd96ab08ad99f4b8bf6a24da1f
SHA512 0b4f6850ca39675c081be2c69df2ba9819d1485a384ebd35d70eddf14405404abcb5b33233ffcb7327b1d79440248a51b3d5ec36ae4e773c28436f88de5a1788

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html

MD5 17f3bbed916ce900652433f2593ff684
SHA1 85d4fbf534aa8acd759a489d31e06ac27677f3a7
SHA256 aa21cb6b8fd8ee6e90ecc5b858dbcbecd3a97efa1f58145a26e619c2ab457bb5
SHA512 81a01663f9d577882d82744d063af5fd570ee2d98cd5f6995f3f5aedaa99b45b215ef0e081056001026f45fe79ce811bef5979ce8973df8527b1920ad2215bdf

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html

MD5 24bed74a2a49536d75ebfd9c87d105eb
SHA1 ec830db2834d33dd61437ccf330ca2ad6b73e377
SHA256 3cc5fa1f9ed7884a08539190a1670bbe64b0e64d1d585d4c1befcf7f91960682
SHA512 a29b8c9f0a3f354e36c805b3956f637a9024ba3df8085c20f148ee4e550603191725e40d0c784192022b637227b06d831cc83a3790cc372e94431d5685545265

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html

MD5 b8723baac78bf9c17d116fe9b25c81b2
SHA1 7b04a048a42f9611afde747a57694574de887783
SHA256 b8dd69bd1f86b0f1889122b8376ea78d44f0f0689945858f247975f7f72ef86c
SHA512 1293a9aa28b83d6912ce041db03c8ebbe3aacceadf35d8cb59827abdaedefaac868ea77452bb34730073ed3b5c9679cf73d969cc3f9bd9be207a7a306db8c46e

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html

MD5 138687bae4d5ae5ecd9f49d4603846b6
SHA1 b9bd64f7c2f3a00ac7ad28d21d0f589e881eb5b5
SHA256 aa696a838bb49ef4a6c83890ffa39424a471a84bcbc57ae86867b1f9bba3994f
SHA512 c6b0b2a25e95a082695e658eb9086d67e2d517aed8adcb625e2b81a29887b4ae31d26cc99738703516ea9072773e06f8871b8775706aeec705f227a68fb7efa6

memory/1884-751-0x0000000000400000-0x0000000000457000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-18 01:06

Reported

2024-05-18 01:09

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-18_4cc405fa0ccf0a6a9f39ab346b9cb2eb_icedid_xiaobaminer.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-05-18_4cc405fa0ccf0a6a9f39ab346b9cb2eb_icedid_xiaobaminer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\doskey.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\UserAccountBroker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\dpnsvr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\makecab.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\prevhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\gpresult.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\OneDriveSetup.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\autoconv.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\CheckNetIsolation.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\colorcpl.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\dvdplay.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SyncHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\mavinject.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\OposHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\RMActivate_ssp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SndVol.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SecEdit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\systeminfo.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wextract.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\format.com C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\appidtel.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\finger.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\hh.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\mcbuilder.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\AtBroker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\msdt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\TapiUnattend.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\user.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\more.com C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cliconfg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\fltMC.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ktmutil.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SearchIndexer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\WPDShextAutoplay.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\write.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\driverquery.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\icsunattend.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\logagent.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\verclsid.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wlanext.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wbem\WinMgmt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\gpupdate.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\mshta.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\net.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\chcp.com C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\RMActivate_isv.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ROUTE.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cmmon32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Fondue.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\MRINFO.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\msinfo32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\rdrleakdiag.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\runas.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\whoami.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\pages\wefgalleryonenoteinsertwinrt.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Internet Explorer\ielowutil.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateCore.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\index.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95203\javaw.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Internet Explorer\ExtExport.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\README.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Media Player\wmpshare.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Media Player\wmlaunch.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.1202_none_05cd606e025d0d96\r\TrustedInstaller.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\emulation.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\unknownprotocol.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVNice.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\431.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\f\wbadmin.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.1_none_7da5a59f860f2406\DmNotificationBroker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\SysResetErr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\f\mstsc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\finger.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\ThumbnailExtractionHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\f\hvix64.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-7.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_5536c5683efe1dad\f\CameraSettingsUIHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobesettings-multipage-main.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_ee5c058bea34543e\r\WmiPrvSE.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\ssprerror-main.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\r\coredpussvr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\r\Microsoft.ECApp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.19041.1_none_5efb81c4b092852b\cvtres.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\PhishSite_Iframe.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\f\autochk.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\r\icsunattend.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\Temp\PendingDeletes\ad40614236e5d701629700001815341f.UwfServicingShell.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_c05346ae3e1a99a4\r\rundll32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.662_none_746c3bfaa509091f\dtdump.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\r\logagent.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a22e961d4bcae1e\UndockedDevKit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-setx_31bf3856ad364e35_10.0.19041.1_none_6cbc8da4ecceab64\setx.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\pdferrormfnotfound.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\401-2.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\403-8.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\sslnavcancel.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.746_none_ff3f6c27e956149f\f\LanguageComponentsInstallerComHandler.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf\mspaint.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\UpdateNotificationMgr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\501.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.746_none_ff3f6c27e956149f\LanguageComponentsInstallerComHandler.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.19041.1_none_8bf94097c23f5fb8\MDEServer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\r\OOBENetworkCaptivePortal.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.1202_none_05cd606e025d0d96\f\TrustedInstaller.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\404-6.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_8b021141ec175d3e\sdbinst.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\ApplySettingsTemplateCatalog.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\r\SecurityHealthService.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_10.0.19041.1_none_421bb61742382b2d\MSBuild.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\pdferrorrenewrentallicense.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\406.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\typeperf.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.19041.1_none_64d83b9e511c141f\SecEdit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_2e15548db03a22c8\CheckNetIsolation.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\defaultbrowser.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\acr_error.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-label_31bf3856ad364e35_10.0.19041.1_none_1774c39d9e06c822\label.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.19041.1_none_7c2c890be7329496\verclsid.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.19041.1_none_69cd9c22cfcf9358\plasrv.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-jsc_b03f5f7f11d50a3a_10.0.19041.1_none_014838ef8bea39e9\jsc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57\svchost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\http_403.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\winload.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-05-18_4cc405fa0ccf0a6a9f39ab346b9cb2eb_icedid_xiaobaminer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: 33 N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-18_4cc405fa0ccf0a6a9f39ab346b9cb2eb_icedid_xiaobaminer.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-18_4cc405fa0ccf0a6a9f39ab346b9cb2eb_icedid_xiaobaminer.exe"

C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 52.111.227.14:443 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp

Files

memory/668-1-0x0000000000400000-0x0000000000457000-memory.dmp

memory/668-0-0x0000000000400000-0x0000000000457000-memory.dmp

C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

MD5 4cc405fa0ccf0a6a9f39ab346b9cb2eb
SHA1 6fd3cc7b5ed824549b2a413f148b90205c032bec
SHA256 cfb74d0076ebfc3f5f08fed10f768b88a9a85f849d67efda4d7bedc8cb046c5c
SHA512 3853891cbf400aa227e893e1a01024217badbc08bae30eec6e3d85411d2ba5c31e83ad278ebecc8c180e62e10b9121cff25dea16f8db88ffaff11551d7085710

memory/1948-15-0x0000000000400000-0x0000000000457000-memory.dmp

memory/668-12-0x0000000000400000-0x0000000000457000-memory.dmp

memory/1948-356-0x0000000000400000-0x0000000000457000-memory.dmp

C:\vcredist2010_x86.log.html

MD5 e8b64a1c1156c2fc0f89b245b1806c4c
SHA1 523a4c5ee3221b4220ac28f3bed9717d6631bcf5
SHA256 e36e4838ae5badde44a77dd9ecfae860ea8ad48e1ff0bf07d87edb5e0f93fe54
SHA512 4c2cb18f9036809b41a64223033748a22622c884c004617e2f4f671c888253cbe8fd11c7f435941e7cacffba699b51e0563a86d7a9f0b2102b239bf3c02b3208

memory/1948-491-0x0000000000400000-0x0000000000457000-memory.dmp