Malware Analysis Report

2024-11-16 15:04

Sample ID 240607-ayk2pafe83
Target 2024-06-07_bdcd058b43314148b4c7e3422b3634e0_icedid_xiaobaminer
SHA256 eefc7401fcea87a29018df2ad0f172b7cbb420dd9a5398854cad8380a3b8601a
Tags
blackmoon banker evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eefc7401fcea87a29018df2ad0f172b7cbb420dd9a5398854cad8380a3b8601a

Threat Level: Known bad

The file 2024-06-07_bdcd058b43314148b4c7e3422b3634e0_icedid_xiaobaminer was found to be: Known bad.

Malicious Activity Summary

blackmoon banker evasion persistence spyware stealer trojan

Blackmoon, KrBanker

Detect Blackmoon payload

Blackmoon family

UAC bypass

Drops file in Drivers directory

Adds policy Run key to start application

Disables RegEdit via registry modification

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Drops file in System32 directory

Drops autorun.inf file

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-07 00:37

Signatures

Blackmoon family

blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-07 00:37

Reported

2024-06-07 00:44

Platform

win7-20240508-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-07_bdcd058b43314148b4c7e3422b3634e0_icedid_xiaobaminer.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\migwiz\PostMig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\instnm.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\rekeywiz.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\sdiagnhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\srdelayed.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\winver.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ctfmon.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\RegisterIEPKEYs.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wimserv.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\mshta.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\RpcPing.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\openfiles.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Bubbles.scr C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\regedit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\grpconv.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\sc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\verclsid.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\WPDShextAutoplay.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ntprint.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\perfmon.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\rrinstaller.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SearchProtocolHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\upnpcont.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wowreg32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\xwizard.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\fsquirt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\autochk.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\resmon.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\perfhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\proquota.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SearchIndexer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\UserAccountControlSettings.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\waitfor.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wlanext.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\choice.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\label.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wusa.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\msinfo32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\WerFault.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\EhStorAuthn.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\mcbuilder.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\TsWpfWrp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\BrmfRsmg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\chcp.com C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\diantz.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\psr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\logman.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\MigAutoPlay.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\netsh.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\nslookup.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Robocopy.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\auditpol.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ddodiag.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\InfDefaultInstall.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\netbtugc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\recover.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDSVR.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\DeviceProperties.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\hh.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\DisconnectPing.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Media Player\wmlaunch.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Media Player\wmprph.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Media Player\wmpenc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsColorChart.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\MCABOUT.HTM C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\amd64_microsoft-windows-gettingstarted_31bf3856ad364e35_6.1.7600.16385_none_dc7256ed0ded6c12\GettingStarted.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_59e6a839753b16d1\RSSFeeds.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_7addf2001d014646\dpnsvr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_fbf2cfb573e03306\takeown.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6c1ecf50d014f9d9\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\500-18.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-at_31bf3856ad364e35_6.1.7600.16385_none_a8f696109d958c5c\at.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-recover_31bf3856ad364e35_6.1.7600.16385_none_e2083f75ce4c0619\recover.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\InputPersonalization.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_51bcbc61a5466a58\CertEnrollCtrl.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sysinfo_31bf3856ad364e35_6.1.7600.16385_none_ef2b073e59e262f6\systeminfo.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1f85c65eb05726c7\weather.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_6.1.7601.17514_none_b7be8a14d61db17a\eudcedit.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedt32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_92dafd34e62c3942\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-2.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\tracerpt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\unsecapp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5e03773a5199eaf2\currency.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-14.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..yer-sideshow-gadget_31bf3856ad364e35_6.1.7600.16385_none_841e9494c8a32794\WMPSideShowGadget.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\PkgMgr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\finger.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\Backup\x86_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_f59e20ddece8f922_certenrollctrl.exe_9495aa75 C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\500.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\ehome\wow\ehexthost32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\msil_wsatconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_dd3a06567424a01b\WsatConfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_wpf-xamlviewer_31bf3856ad364e35_6.1.7600.16385_none_55e4a2a4de407800\XamlViewer_v0300.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_6.1.7600.16385_none_09320e5ae212b9d9\powercfg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-1.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-1.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\hh.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_d7ce65f32404434b\WsatConfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661_smss.exe_d7209c3a C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7601.22172_none_86ab4a318a459fda\taskhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-10.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_092d6b9141f16aca\WinMgmt.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Orange Circles.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_6.1.7601.17514_none_1229a6f0546e2346\lpq.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-taskkill_31bf3856ad364e35_6.1.7600.16385_none_8172f0ac75c192a6\taskkill.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\404-10.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_6.1.7600.16385_none_f9aeffb75a698a7f\RpcPing.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6d48bdce24e57241\slideShow.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_36bc61b12dcec80c\settings.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_6.1.7601.17514_none_c3b917fd89d834f3\LogonUI.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_402eca316047a0fe\dialer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\chcp.com C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_efed75e2fbac9517\cpu.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\500-16.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-15.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-4.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\splwow64.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_6.1.7600.16385_none_1426830c3ebb712d\telnet.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\500-15.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\406.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_6.1.7600.16385_none_0c9cb55c61e99805\dcomcnfg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..lified-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_763763505e93084b\IMSCPROP.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-07_bdcd058b43314148b4c7e3422b3634e0_icedid_xiaobaminer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: 33 N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-07_bdcd058b43314148b4c7e3422b3634e0_icedid_xiaobaminer.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-07_bdcd058b43314148b4c7e3422b3634e0_icedid_xiaobaminer.exe"

C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"

Network

N/A

Files

memory/616-0-0x0000000000400000-0x000000000044D000-memory.dmp

\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

MD5 bdcd058b43314148b4c7e3422b3634e0
SHA1 37eac5e92783c929f8a278c305261f11bc6ffd0a
SHA256 eefc7401fcea87a29018df2ad0f172b7cbb420dd9a5398854cad8380a3b8601a
SHA512 375a0c1b0dd0d2b27cde1c7c427d01659491ca56518395d33c5e30f499bc6ad61b59531142ba92ae678406565410c0753f988aa58a732163f9936c34bf4c65c8

memory/1804-7-0x0000000000400000-0x000000000044D000-memory.dmp

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html

MD5 33f73419b8fc156a8a5e0eee311a2639
SHA1 7ebd3842e080ed34f4675eea740c3e90d8db7bc2
SHA256 442c6bfe7c011e24f8c0bb1c0584b96cf804eb7198d4aacffa4c5f6769ff4215
SHA512 1f9e3a64bfc78cea57f4d9fce2ff4f9adfbe7526ef10e40eaa7cd9b8109cfa124b306f6d3be5e1a777bb604dc2c497623aa9298f580cd7e9a6e3bb9818e819ad

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html

MD5 ffbe89b376301d5a5e1602502f3a049e
SHA1 4fd73b0508a04073411bfb0af9f1e77a2009850a
SHA256 fd516ab385f8dabba0da1377f5dfdc0dbdefdd224d823313eff24e8fb00c6217
SHA512 25807dacb22621f69dfc9b85464e566a11b6f417632c9d2dac92b5112a8495aacc5edb2938e5515a59843fe79f25b5c65a280b41fb9b0c27bfce2b4da48cfa02

C:\vcredist2010_x86.log.html

MD5 5ada3219de669cea5578c4d802060870
SHA1 510095f27695adaf19ad1db75483c6f06ca3247b
SHA256 5a4c3b7070bf46e8b7b6f29c5e26d80d66542b8e9439845a8575decb033673b1
SHA512 379d0c6ac03366bcd335363d7b0d976bfb763f4412e23951391d0ca8d4b571af71049ea98855f9a05e65383629c8f7292a8c876959d142c8eec0e39345ab3abd

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html

MD5 b8723baac78bf9c17d116fe9b25c81b2
SHA1 7b04a048a42f9611afde747a57694574de887783
SHA256 b8dd69bd1f86b0f1889122b8376ea78d44f0f0689945858f247975f7f72ef86c
SHA512 1293a9aa28b83d6912ce041db03c8ebbe3aacceadf35d8cb59827abdaedefaac868ea77452bb34730073ed3b5c9679cf73d969cc3f9bd9be207a7a306db8c46e

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html

MD5 138687bae4d5ae5ecd9f49d4603846b6
SHA1 b9bd64f7c2f3a00ac7ad28d21d0f589e881eb5b5
SHA256 aa696a838bb49ef4a6c83890ffa39424a471a84bcbc57ae86867b1f9bba3994f
SHA512 c6b0b2a25e95a082695e658eb9086d67e2d517aed8adcb625e2b81a29887b4ae31d26cc99738703516ea9072773e06f8871b8775706aeec705f227a68fb7efa6

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html

MD5 24bed74a2a49536d75ebfd9c87d105eb
SHA1 ec830db2834d33dd61437ccf330ca2ad6b73e377
SHA256 3cc5fa1f9ed7884a08539190a1670bbe64b0e64d1d585d4c1befcf7f91960682
SHA512 a29b8c9f0a3f354e36c805b3956f637a9024ba3df8085c20f148ee4e550603191725e40d0c784192022b637227b06d831cc83a3790cc372e94431d5685545265

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html

MD5 17f3bbed916ce900652433f2593ff684
SHA1 85d4fbf534aa8acd759a489d31e06ac27677f3a7
SHA256 aa21cb6b8fd8ee6e90ecc5b858dbcbecd3a97efa1f58145a26e619c2ab457bb5
SHA512 81a01663f9d577882d82744d063af5fd570ee2d98cd5f6995f3f5aedaa99b45b215ef0e081056001026f45fe79ce811bef5979ce8973df8527b1920ad2215bdf

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-07 00:37

Reported

2024-06-07 00:44

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-07_bdcd058b43314148b4c7e3422b3634e0_icedid_xiaobaminer.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-06-07_bdcd058b43314148b4c7e3422b3634e0_icedid_xiaobaminer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification D:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created F:\autorun.inf C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\wscript.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\provlaunch.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\rasautou.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\RmClient.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\typeperf.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\upnpcont.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ttdinject.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\unlodctr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\chkntfs.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\grpconv.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\LaunchTM.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\netiougc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\recover.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Register-CimProvider.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SyncHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\comp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\find.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\makecab.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\PATHPING.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\Utilman.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\WerFaultSecure.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\AtBroker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\CertEnrollCtrl.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\getmac.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\driverquery.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\mobsync.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\printui.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\regsvr32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\shrpubw.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\svchost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\WSManHTTPConfig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\mtstocom.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\PackagedCWALauncher.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\PkgMgr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\psr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\RMActivate_ssp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\TCPSVCS.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\unregmp2.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\WerFault.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\fltMC.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\LaunchWinApp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\prevhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\regini.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\sc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\findstr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\isoburn.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setup.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\rrinstaller.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\verclsid.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\cmdkey.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\compact.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\ComputerDefaults.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\curl.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\explorer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\dcomcnfg.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SysWOW64\gpresult.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notificationCenter.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\index.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeComRegisterShellARM64.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Mail\wabmig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files\Windows Media Player\wmpshare.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Program Files (x86)\Windows Mail\wabmig.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\r\DeviceEnroller.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\f\wevtutil.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.1266_none_e6ebbe2a02425392\autopilotwhitegloveresult-main.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_87b4b95ab967b582\f\fontdrvhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\msinfo32.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.746_none_e7acb2599054dc72\r\WSCollect.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.964_none_5c42846f47acb1a6\smss.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.19041.1_none_6e229ee8c467f101\telnet.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_10.0.19041.1_none_25aa820b9acb3357\EdmGen.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.19041.1_none_af96916428136673\mobsync.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\404-9.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\f\adamsync.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.19041.1_none_7fd47726c3f6f6dd\SystemPropertiesDataExecutionPrevention.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1202_none_a27aa61d221bdc5c\r\wordpad.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.746_none_099c40ad55bc5d6c\r\AuthHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.746_none_3ed4d566b640ef5b\r\WmsUserAgent.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\f\msra.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-format_31bf3856ad364e35_10.0.19041.1_none_e6ce9a885db7db4f\format.com C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\invalidcert.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.1288_none_1d22271c8cc35d4b\IESettingSync.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.1_none_37ab35f7e4b21a45\PrintBrmEngine.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.746_none_eb2cdd2a40f60c45\MsSpellCheckingHost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1202_none_a391067a6b9b433c_appidtel.exe_b664fbc5 C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.19041.1_none_ed965939376efbbf\MigRegDB.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\ssprerror-main.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\404-7.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1_none_8119ed75508e4ffe\wevtutil.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_aa284d65c7bee591\upnpcont.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\r\default.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\tlserror.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\tpmvscmgrsvr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\sihost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\r\mstsc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\startfresh.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\gpupdate.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\tpmvscmgr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\wsmprovhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_93b4a0a1641d085c_svchost.exe_4dd0f0bc C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.1_none_bc34aea0c10c4a99\setupugc.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\iissetup.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\pdferrordisabledforregion.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\403-6.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\f\conhost.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_72c6a00123f43c47\r\quickassist.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\http_gen.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\invalidcert.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\winload.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.1_none_7c69077ba55f962b\WSReset.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1_none_20dbe0239a0c22b4\vds.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.746_none_22a6ac8933ff6d5e\colorcpl.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\diskperf.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\f\user.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\common-listview-template.html C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\BlockSite.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\forbidframingedge.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\dmcertinst.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.19041.1_none_705ce89b3c18ecc5\verifiergui.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.19041.1_none_dd2098e5f9122dff\findstr.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1_none_b42ad8618bda36bd\TpmTool.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_6331d348ae4a8fa9\TiWorker.exe C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\repost.htm C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde_fontdrvhost.exe_94bdc76d C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-06-07_bdcd058b43314148b4c7e3422b3634e0_icedid_xiaobaminer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: 33 N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-07_bdcd058b43314148b4c7e3422b3634e0_icedid_xiaobaminer.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-07_bdcd058b43314148b4c7e3422b3634e0_icedid_xiaobaminer.exe"

C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
BE 2.17.196.137:443 www.bing.com tcp
US 8.8.8.8:53 137.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/3092-0-0x0000000000400000-0x000000000044D000-memory.dmp

C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe

MD5 bdcd058b43314148b4c7e3422b3634e0
SHA1 37eac5e92783c929f8a278c305261f11bc6ffd0a
SHA256 eefc7401fcea87a29018df2ad0f172b7cbb420dd9a5398854cad8380a3b8601a
SHA512 375a0c1b0dd0d2b27cde1c7c427d01659491ca56518395d33c5e30f499bc6ad61b59531142ba92ae678406565410c0753f988aa58a732163f9936c34bf4c65c8

C:\vcredist2010_x86.log.html

MD5 f8a7112bbde0758ba3c66d46a2e2881f
SHA1 be29d81c9aae9feb73002c40099a5cc09fd5f54a
SHA256 bd148bd94cd9be343d9bc1dc8d131fba21e526a1157672c233b3948bc7d8dec3
SHA512 b92ebd8cbe911eb73429bd2114a710d9b16396b1026fb9dc1256e14aac357a8958e072251fe0ba6f1787d8405f98c85920a586fb11a8ff75e723120c98aefd04