Malware Analysis Report

2025-08-11 00:59

Sample ID 240518-bvtebsdg4s
Target 2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer
SHA256 4688ce4c9472819a7624da8903385b504fb85661b520b7bd5ff4b65a34321d7a
Tags
blackmoon banker evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4688ce4c9472819a7624da8903385b504fb85661b520b7bd5ff4b65a34321d7a

Threat Level: Known bad

The file 2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer was found to be: Known bad.

Malicious Activity Summary

blackmoon banker evasion persistence spyware stealer trojan

UAC bypass

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Drops file in Drivers directory

Adds policy Run key to start application

Disables RegEdit via registry modification

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Adds Run key to start application

Checks whether UAC is enabled

Drops autorun.inf file

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-18 01:28

Signatures

Blackmoon family

blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 01:28

Reported

2024-05-18 01:30

Platform

win7-20240221-en

Max time kernel

37s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ctfmon.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\MigAutoPlay.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\setup16.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\setx.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\tzutil.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\format.com C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ARP.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\extrac32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\PresentationHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\secinit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SetIEInstalledDate.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\chcp.com C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\DWWIN.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\dllhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\getmac.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\PushPrinterConnections.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\user.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cscript.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\icsunattend.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\RMActivate_ssp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\runas.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\vssadmin.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wextract.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wscript.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\bthudtask.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\sethc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\verclsid.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wbem\WinMgmt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Ribbons.scr C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ComputerDefaults.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\EhStorAuthn.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\icacls.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ipconfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\netbtugc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\sfc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\dxdiag.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_amd64_neutral_67b5984f8e8ff717\BrmfRsmg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cmstp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\PATHPING.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\proquota.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\rekeywiz.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\migwiz\PostMig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\dvdupgrd.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ftp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\mshta.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\regini.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\DeviceProperties.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\msiexec.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ntoskrnl.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\openfiles.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wininit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\mode.com C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\iscsicpl.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\dfrgui.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\eudcedit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\fltMC.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\sbunattend.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\xwizard.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\choice.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\makecab.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\clock.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Internet Explorer\ieinstal.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Media Player\wmpenc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Media Player\wmprph.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\README.HTM C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Green Bubbles.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplateRTL.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewFrame.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\amd64_microsoft-windows-timeout_31bf3856ad364e35_6.1.7600.16385_none_e8595e67dff5b7f4\timeout.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad\unlodctr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-infdefaultinstall_31bf3856ad364e35_6.1.7600.16385_none_6c6ad9e2fd62ff6a\InfDefaultInstall.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\Backup\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_6.1.7600.16385_none_82523ed4cbbd035a_etfsboot.com_ef11feb5 C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\403-9.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\537950d9c71af966e1d8c9deb550f842\WsatConfig.ni.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7601.17514_none_b9e7a42ab571bbb9\slui.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_02bb0612dc529329\diantz.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\MigAutoPlay.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_6.1.7600.16385_none_498d334c14a3b9bb\hwrreg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_9da1b3254ff796e9\msra.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_fbf2cfb573e03306\takeown.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_31173e7d19fe591a\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\403-11.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_6.1.7601.17514_none_e2a1ffe0ca40cff2\recdisc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-waitfor_31bf3856ad364e35_6.1.7600.16385_none_125aa78894e49f8f\waitfor.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-isoburn_31bf3856ad364e35_6.1.7601.17514_none_e83a110af77d5aa7\isoburn.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8734fb86705288a7\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\IMEPADSV.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-verclsid_31bf3856ad364e35_6.1.7600.16385_none_bbbd275974c7e191\verclsid.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-4.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-7.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-autofmt_31bf3856ad364e35_6.1.7601.17514_none_441a424cd5cda219\autofmt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-mystify_31bf3856ad364e35_6.1.7601.17514_none_f21904fdbd9f5e08\Mystify.scr C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6c1ecf50d014f9d9\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0098688ad232f281\cpu.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\401-5.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPDADM.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3d8bb37f97ba22ff\sdbinst.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\web.config.comments C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_de-de_330b92f4e4356a4b\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_92dafd34e62c3942\weather.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_51e5e402131afc4a\AppLaunch.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\attrib.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-2.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_96421d40c0e2903e\aspnet_regbrowsers.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_6d6b3cfb6a5a1e5a\newdev.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-proquota_31bf3856ad364e35_6.1.7601.17514_none_29ce61c2f0a740f4\proquota.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\500-14.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\401.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970\clrgc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_es-es_397fc58b493f7a97\calendar.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2ae1bce6b81c0916\flyout.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7600.16385_none_9e59e11166b683d3\PDIALOG.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPMGR.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_009cfaa696afe78b\fc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0accb12490597570\clock.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Orange Circles.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-a..ime-upgrade-results_31bf3856ad364e35_6.1.7601.17514_none_21de7e134213566a\WindowsAnytimeUpgradeResults.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\iissetup.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-at_31bf3856ad364e35_6.1.7600.16385_none_4cd7fa8ce5381b26\at.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-winver_31bf3856ad364e35_6.1.7600.16385_none_b627d45ffdcc6f00\winver.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\ehome\CreateDisc\SonicResources\ClickMe.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-5.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-terminalservices-theme_31bf3856ad364e35_6.1.7600.16385_none_d5bc65ffdc22ec35\TSTheme.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-credwiz_31bf3856ad364e35_6.1.7600.16385_none_fbcfa2528586252f\credwiz.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-security-spp_31bf3856ad364e35_6.1.7601.17514_none_78875ce737927d27\sppsvc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-synchost_31bf3856ad364e35_6.1.7600.16385_none_c575fec016436d8a\SyncHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7601.22172_none_86ab4a318a459fda\taskhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: 33 N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe"

C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"

Network

N/A

Files

memory/2512-0-0x0000000000400000-0x0000000000453000-memory.dmp

memory/2512-1-0x0000000000400000-0x0000000000453000-memory.dmp

\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

MD5 b17f007b29bec3489eab9dd1f9b7fd6a
SHA1 e132a7f550fb314bc9e1eaeda7d781ee9c1752bc
SHA256 4688ce4c9472819a7624da8903385b504fb85661b520b7bd5ff4b65a34321d7a
SHA512 0d2e9f834363dd5e47e41a04168317ac324dca264553cbf84a203f64f442f4c1055976d845b621e604cd63fe4cd5e488aaae3a8719516dbd6c5e1bb2320cb8c6

memory/2160-9-0x0000000000400000-0x0000000000453000-memory.dmp

memory/2512-7-0x0000000000400000-0x0000000000453000-memory.dmp

memory/2160-10-0x0000000000400000-0x0000000000453000-memory.dmp

memory/2160-376-0x0000000000400000-0x0000000000453000-memory.dmp

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html

MD5 ffbe89b376301d5a5e1602502f3a049e
SHA1 4fd73b0508a04073411bfb0af9f1e77a2009850a
SHA256 fd516ab385f8dabba0da1377f5dfdc0dbdefdd224d823313eff24e8fb00c6217
SHA512 25807dacb22621f69dfc9b85464e566a11b6f417632c9d2dac92b5112a8495aacc5edb2938e5515a59843fe79f25b5c65a280b41fb9b0c27bfce2b4da48cfa02

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html

MD5 33f73419b8fc156a8a5e0eee311a2639
SHA1 7ebd3842e080ed34f4675eea740c3e90d8db7bc2
SHA256 442c6bfe7c011e24f8c0bb1c0584b96cf804eb7198d4aacffa4c5f6769ff4215
SHA512 1f9e3a64bfc78cea57f4d9fce2ff4f9adfbe7526ef10e40eaa7cd9b8109cfa124b306f6d3be5e1a777bb604dc2c497623aa9298f580cd7e9a6e3bb9818e819ad

C:\vcredist2010_x86.log.html

MD5 14d3a30b38fc98ff0edf7f7111193d1a
SHA1 16975ffadb334e485f3a6f4296f2479164fa2a98
SHA256 551ed26ab10ebe9c9175e3cd53dc36e61ea2b9d346b5b49cdb50d1a36569856c
SHA512 6f5cd3a589c61399c719ef28754aafec2b29bf2a0d372059c4b1ff9bde612b59aebdba783afc2fa1e9199cb9d588cadd4e0615f67171baf86a981d4b5ae7047a

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html

MD5 24bed74a2a49536d75ebfd9c87d105eb
SHA1 ec830db2834d33dd61437ccf330ca2ad6b73e377
SHA256 3cc5fa1f9ed7884a08539190a1670bbe64b0e64d1d585d4c1befcf7f91960682
SHA512 a29b8c9f0a3f354e36c805b3956f637a9024ba3df8085c20f148ee4e550603191725e40d0c784192022b637227b06d831cc83a3790cc372e94431d5685545265

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html

MD5 17f3bbed916ce900652433f2593ff684
SHA1 85d4fbf534aa8acd759a489d31e06ac27677f3a7
SHA256 aa21cb6b8fd8ee6e90ecc5b858dbcbecd3a97efa1f58145a26e619c2ab457bb5
SHA512 81a01663f9d577882d82744d063af5fd570ee2d98cd5f6995f3f5aedaa99b45b215ef0e081056001026f45fe79ce811bef5979ce8973df8527b1920ad2215bdf

memory/2160-751-0x0000000000400000-0x0000000000453000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-18 01:28

Reported

2024-05-18 01:30

Platform

win10v2004-20240426-en

Max time kernel

143s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\stordiag.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\UserAccountBroker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wevtutil.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\curl.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\fc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\provlaunch.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\setx.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Com\MigRegDB.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setup.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wbem\WMIC.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cttune.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\msra.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\systray.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\TRACERT.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\pcaui.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\sdchange.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\waitfor.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\winver.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ARP.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\dxdiag.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\finger.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\gpresult.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\TSTheme.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ttdinject.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wiaacmgr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cmmon32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\fsquirt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\odbcad32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\prevhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wbem\mofcomp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\replace.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cscript.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\eventcreate.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\instnm.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\PackagedCWALauncher.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cacls.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\setup16.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\winrs.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\runas.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\sethc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\svchost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\InstallShield\_isdel.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\bthudtask.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\DevicePairingWizard.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\dtdump.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\fsutil.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\gpupdate.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\schtasks.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\sort.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\iscsicpl.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\msiexec.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Robocopy.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SearchProtocolHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\at.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\find.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\subst.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wsmprovhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\fltMC.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{F3190C87-06A4-407A-A58A-3F71181B4541}\chrome_installer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notificationCenter.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_eventviewersettings_31bf3856ad364e35_10.0.19041.1_none_b53d8fdcd7716c78\eventvwr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_be8a8ad4892e651d\f\printui.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\500-15.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\CloudExperienceHostBroker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\msinfo32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.1266_none_e6ebbe2a02425392\autopilotwhitegloveresult-main.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\network\network.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\f\AgentService.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_63b0fc68ee30f2cb\IMESEARCH.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\r\dwm.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_72c6a00123f43c47\r\quickassist.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_6bac6724a4ab4460\svchost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_f3a9dc0fe254a157\wmpconfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\403-2.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-3.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\winload.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.867_none_099246ae3a45708c\f\printfilterpipelinesvc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.746_none_b7a67ddd8bcc7470\ApplicationFrameHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\f\XGpuEjectDialog.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_eda92e20fee7d318\r\PhotoScreensaver.scr C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\common-listview-template.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-5.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_19c9b562d4b65581\IMTCPROP.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.746_none_58702f801199ce06\NetCfgNotifyObjectHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-2.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1202_none_c26e06f4b82585b5\f\dmclient.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.19041.746_none_9043799a93dba365\f\LicenseManagerShellext.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1_none_eae66734659b60d0\wowreg32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\r\EaseOfAccessDialog.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\http_500.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc\WinMgmt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmpshare.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\forbidframingedge.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\403-14.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.1165_none_a82485b8f343811f\r\WaaSMedicAgent.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.1_none_2a38e2996ee84e57\TapiUnattend.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\unifiedEnrollmentProgress.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\winresume.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.19041.1_none_c1efa43e415898e4\getmac.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-r..pdate-oob-component_31bf3856ad364e35_10.0.19041.84_none_e539abe3d27f675f\f\rdvgm.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.264_none_31474dbf12ce5adc\r\XblGameSaveTask.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\unifiedEnrollment\views\unifiedEnrollmentProgress.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\bash.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f\sppsvc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.264_none_6ea6dfb6393e5f06\DataStoreCacheDumpTool.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_a068a30a6853aaec\ByteCodeGenerator.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1_none_595f2a7acaf53bba\WpcUapApp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_6e05a6bb2291b4c6\IMESEARCH.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_e43cebe9807e08e3\r\setupugc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\servbusy.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\defaultbrowser.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.19041.1_none_c9157ddc38b83b1b\aspnet_regsql.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\gpresult.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\usocoreworker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\f\upnpcont.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_fbaeb6d5afb287f7\gpupdate.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.19041.1_none_a4a8dfd6e5f1aab8\dsmgmt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\wslconfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\r\wscadminui.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: 33 N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-18_b17f007b29bec3489eab9dd1f9b7fd6a_icedid_xiaobaminer.exe"

C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
BE 2.17.196.137:443 www.bing.com tcp
US 8.8.8.8:53 137.196.17.2.in-addr.arpa udp
BE 2.17.196.137:443 www.bing.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/2660-0-0x0000000000400000-0x0000000000453000-memory.dmp

memory/2660-1-0x0000000000400000-0x0000000000453000-memory.dmp

C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

MD5 b17f007b29bec3489eab9dd1f9b7fd6a
SHA1 e132a7f550fb314bc9e1eaeda7d781ee9c1752bc
SHA256 4688ce4c9472819a7624da8903385b504fb85661b520b7bd5ff4b65a34321d7a
SHA512 0d2e9f834363dd5e47e41a04168317ac324dca264553cbf84a203f64f442f4c1055976d845b621e604cd63fe4cd5e488aaae3a8719516dbd6c5e1bb2320cb8c6

memory/2660-13-0x0000000000400000-0x0000000000453000-memory.dmp

memory/3216-354-0x0000000000400000-0x0000000000453000-memory.dmp

C:\vcredist2010_x86.log.html

MD5 81c35fe848c0383ffea47697999d08b5
SHA1 f8fbda7a7e4c1b5c6857cd7bacee2c6ac6e1431d
SHA256 4fde901666cd1657b931d5f3e6b28cfc668544c8c7a759bd5729733bb0c79147
SHA512 b067b7664a297e11ec94e0776a889d34f47057662a470e7a3d907e7158fa2d0ab476e4dd21c390fadd22efc27be9add81441deddb596e4005e809ca8514ab913

memory/3216-493-0x0000000000400000-0x0000000000453000-memory.dmp