File name:

360hb4.0.276.0__weiruan__.exe

Full analysis: https://app.any.run/tasks/d7637d88-d725-4796-8bb4-b8163c97ce33
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: August 26, 2024, 07:24:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
xor-url
generic
stealer
qrcode
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7D56EAEF1FA70AF9DD0B10F298D9AD3A

SHA1:

CF5B60F53926411BCE9F6B4D53CB23F8981AC08A

SHA256:

08D6B1EA34A3F3CB8E8DEF63CAB00A5C20E545026C6692B12334E69F7538B406

SSDEEP:

98304:t0R/qWahEIkGfjTt0Pf3VnIkFMMwOkDOUBvc9/20zpEGal2G/XVMmoNygrs31DNi:oOvkm+IfUQaUhRtVHsd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 360huabaosetup.exe (PID: 6956)

    • XORed URL has been found (YARA)

      • setup.exe (PID: 608)

    • Steals credentials from Web Browsers

      • 360huabao.exe (PID: 6276)

    • Actions looks like stealing of personal data

      • 360secore.exe (PID: 2360)
      • 360huabao.exe (PID: 6276)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 360hb4.0.276.0__weiruan__.exe (PID: 6908)
      • 360huabaosetup.exe (PID: 6956)
      • setup.exe (PID: 608)
      • 360huabao.exe (PID: 6276)
      • 360secore.exe (PID: 2360)
      • 360huabao.exe (PID: 6252)
      • 360huabaosetup.exe (PID: 3352)

    • Drops the executable file immediately after the start

      • 360hb4.0.276.0__weiruan__.exe (PID: 6908)
      • 360huabaosetup.exe (PID: 6956)
      • 360se15.0.1376.0.exe (PID: 2228)
      • setup.exe (PID: 608)
      • 360huabao.exe (PID: 6276)

    • Executable content was dropped or overwritten

      • 360hb4.0.276.0__weiruan__.exe (PID: 6908)
      • 360huabaosetup.exe (PID: 6956)
      • setup.exe (PID: 608)
      • 360se15.0.1376.0.exe (PID: 2228)
      • 360huabao.exe (PID: 6276)

    • Reads the date of Windows installation

      • 360hb4.0.276.0__weiruan__.exe (PID: 6908)
      • 360huabaosetup.exe (PID: 6956)
      • 360huabao.exe (PID: 6276)
      • 360huabao.exe (PID: 6252)

    • Checks Windows Trust Settings

      • 360huabaosetup.exe (PID: 6956)
      • setup.exe (PID: 608)

    • The process verifies whether the antivirus software is installed

      • 360huabaosetup.exe (PID: 6956)
      • setup.exe (PID: 608)
      • 360huabao.exe (PID: 6276)
      • 360secore.exe (PID: 2360)
      • 360huabaosetup.exe (PID: 3352)

    • Searches for installed software

      • 360huabaosetup.exe (PID: 6956)
      • setup.exe (PID: 608)

    • The process creates files with name similar to system file names

      • setup.exe (PID: 608)

    • Process drops legitimate windows executable

      • setup.exe (PID: 608)

    • The process drops C-runtime libraries

      • setup.exe (PID: 608)

    • Creates a software uninstall entry

      • 360huabaosetup.exe (PID: 6956)

    • Application launched itself

      • 360huabao.exe (PID: 6276)

  • INFO

    • Create files in a temporary directory

      • 360hb4.0.276.0__weiruan__.exe (PID: 6908)
      • 360huabaosetup.exe (PID: 6956)
      • 360se15.0.1376.0.exe (PID: 2228)
      • setup.exe (PID: 608)
      • 360huabao.exe (PID: 6276)
      • 360secore.exe (PID: 2360)
      • 360huabao.exe (PID: 6252)

    • Process checks computer location settings

      • 360hb4.0.276.0__weiruan__.exe (PID: 6908)
      • 360huabaosetup.exe (PID: 6956)
      • 360huabao.exe (PID: 6276)
      • 360huabao.exe (PID: 2368)
      • 360huabao.exe (PID: 5720)
      • 360huabao.exe (PID: 6252)

    • Reads Environment values

      • 360huabaosetup.exe (PID: 6956)
      • 360huabao.exe (PID: 6276)
      • 360huabao.exe (PID: 6252)
      • 360huabao.exe (PID: 448)
      • 360huabao.exe (PID: 2368)
      • 360huabao.exe (PID: 5720)
      • 360huabao.exe (PID: 740)
      • 360huabao.exe (PID: 6112)
      • 360huabao.exe (PID: 6772)
      • 360huabaosetup.exe (PID: 3352)

    • Checks supported languages

      • 360huabaosetup.exe (PID: 6956)
      • 360hb4.0.276.0__weiruan__.exe (PID: 6908)
      • 360se15.0.1376.0.exe (PID: 2228)
      • setup.exe (PID: 608)
      • 360huabao.exe (PID: 6276)
      • 360huabao.exe (PID: 448)
      • 360huabao.exe (PID: 740)
      • 360huabao.exe (PID: 6112)
      • 360huabao.exe (PID: 2368)
      • 360huabao.exe (PID: 6252)
      • 360huabao.exe (PID: 5720)
      • 360secore.exe (PID: 2360)
      • 360huabao.exe (PID: 6772)
      • 360huabaosetup.exe (PID: 3352)

    • Checks proxy server information

      • 360huabaosetup.exe (PID: 6956)
      • 360huabao.exe (PID: 6276)
      • setup.exe (PID: 608)
      • 360huabao.exe (PID: 6252)
      • 360secore.exe (PID: 2360)
      • 360huabaosetup.exe (PID: 3352)

    • Reads the computer name

      • 360hb4.0.276.0__weiruan__.exe (PID: 6908)
      • 360huabaosetup.exe (PID: 6956)
      • 360se15.0.1376.0.exe (PID: 2228)
      • setup.exe (PID: 608)
      • 360huabao.exe (PID: 6276)
      • 360huabao.exe (PID: 6252)
      • 360huabao.exe (PID: 740)
      • 360huabao.exe (PID: 6772)
      • 360secore.exe (PID: 2360)
      • 360huabaosetup.exe (PID: 3352)

    • Reads the machine GUID from the registry

      • 360huabaosetup.exe (PID: 6956)
      • setup.exe (PID: 608)
      • 360huabao.exe (PID: 6276)
      • 360secore.exe (PID: 2360)

    • Creates files or folders in the user directory

      • 360huabaosetup.exe (PID: 6956)
      • setup.exe (PID: 608)
      • 360huabao.exe (PID: 6276)
      • 360huabao.exe (PID: 740)
      • 360secore.exe (PID: 2360)
      • 360huabao.exe (PID: 6252)
      • 360huabaosetup.exe (PID: 3352)

    • Reads the software policy settings

      • 360huabaosetup.exe (PID: 6956)
      • setup.exe (PID: 608)

    • Dropped object may contain TOR URL's

      • setup.exe (PID: 608)

    • Reads CPU info

      • 360huabao.exe (PID: 6276)
      • 360huabao.exe (PID: 6252)

    • Disables trace logs

      • 360secore.exe (PID: 2360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(608) setup.exe
Decrypted-URLs (29)http://9.qq.com/
http://bbs.66163.com/
http://bbs.runsky.com/
http://dnf.jdbbx.com/
http://dtws2.cbg.163.com/
http://font.chinaz.com/
http://font.knowsky.com/
http://ic.qq.com/
http://ie.sogou.com/
http://kizi.com/
http://love.163.com/
http://pinsta.me/
http://tu.5678.cn/
http://u.gamefy.cn/
http://v.2345.com/
http://www.0745tuan.com/
http://www.0790tg.com/
http://www.1212wan.com/
http://www.128uu.com/
http://www.176web.net/
http://www.1919.cn/
http://www.51y5.net/
http://www.59.cn/
http://www.773buy.com/
http://www.bxxx.cn/
http://www.ccc333.com/
http://www.cdqcp.com/
http://www.cr173.com/
http://www.efunds.com.cn/
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:21 09:02:22+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 97280
InitializedDataSize: 8558592
UninitializedDataSize: -
EntryPoint: 0x8544
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 4.0.276.0
ProductVersionNumber: 4.0.276.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileDescription: 360壁纸 服务组件
FileVersion: 4.0.276.0
LegalCopyright: Copyright (C) 2021
ProductName: 360壁纸 服务组件
ProductVersion: 4.0.276.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
14
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 360hb4.0.276.0__weiruan__.exe 360huabaosetup.exe 360se15.0.1376.0.exe #XOR-URL setup.exe 360huabao.exe 360huabao.exe 360huabao.exe no specs 360huabao.exe 360huabao.exe no specs 360huabao.exe no specs 360huabao.exe no specs 360secore.exe 360huabao.exe no specs 360huabaosetup.exe

Process information

PID
CMD
Path
Indicators
Parent process
448"C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\admin\AppData\Roaming\360huabao\\user_data\\chromeshellmain" --main-ver=15.0.1376.0 --mainprocess-ver=15.0.1376.0 --gpu-preferences=WAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=3012 --field-trial-handle=3016,i,9101743369081115162,9090783325944113689,262144 --disable-features=HardwareMediaKeyHandling /prefetch:2C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe—360huabao.exe
User:
admin
Integrity Level:
MEDIUM
Description:
360壁纸
Version:
4.0.276.0
Modules
Images
c:\users\admin\appdata\roaming\360huabao\360huabao.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
608"C:\Users\admin\AppData\Local\Temp\CR_D260E.tmp\setup.exe" --exe-path="C:\Users\admin\AppData\Local\Temp\360se15.0.1376.0.exe" --secore-install --secore-forsdk --silent-installC:\Users\admin\AppData\Local\Temp\CR_D260E.tmp\setup.exe
360se15.0.1376.0.exe
User:
admin
Company:
360.cn
Integrity Level:
MEDIUM
Description:
360安全浏览器
Exit code:
0
Version:
15.0.1376.0
Modules
Images
c:\users\admin\appdata\local\temp\cr_d260e.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
xor-url
(PID) Process(608) setup.exe
Decrypted-URLs (29)http://9.qq.com/
http://bbs.66163.com/
http://bbs.runsky.com/
http://dnf.jdbbx.com/
http://dtws2.cbg.163.com/
http://font.chinaz.com/
http://font.knowsky.com/
http://ic.qq.com/
http://ie.sogou.com/
http://kizi.com/
http://love.163.com/
http://pinsta.me/
http://tu.5678.cn/
http://u.gamefy.cn/
http://v.2345.com/
http://www.0745tuan.com/
http://www.0790tg.com/
http://www.1212wan.com/
http://www.128uu.com/
http://www.176web.net/
http://www.1919.cn/
http://www.51y5.net/
http://www.59.cn/
http://www.773buy.com/
http://www.bxxx.cn/
http://www.ccc333.com/
http://www.cdqcp.com/
http://www.cr173.com/
http://www.efunds.com.cn/
740"C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\admin\AppData\Roaming\360huabao\\user_data\\chromeshellmain" --main-ver=15.0.1376.0 --mainprocess-ver=15.0.1376.0 --mojo-platform-channel-handle=3088 --field-trial-handle=3016,i,9101743369081115162,9090783325944113689,262144 --disable-features=HardwareMediaKeyHandling /prefetch:8C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe
360huabao.exe
User:
admin
Integrity Level:
MEDIUM
Description:
360壁纸
Version:
4.0.276.0
Modules
Images
c:\users\admin\appdata\roaming\360huabao\360huabao.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2228C:\Users\admin\AppData\Local\Temp\360se15.0.1376.0.exe --secore-install --secore-forsdk --silent-installC:\Users\admin\AppData\Local\Temp\360se15.0.1376.0.exe
360huabaosetup.exe
User:
admin
Company:
360.cn
Integrity Level:
MEDIUM
Description:
360安全浏览器
Exit code:
0
Version:
15.0.1376.0
Modules
Images
c:\users\admin\appdata\local\temp\360se15.0.1376.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2360"C:\Users\admin\AppData\Roaming\360se6\Application\360secore.exe" --type=seupdate -360seautoupdate --v3Wnd=0 --v3seProcId=6276 --secore-update /prefetch:8 --flag=0C:\Users\admin\AppData\Roaming\360se6\Application\360secore.exe
360huabao.exe
User:
admin
Company:
360.cn
Integrity Level:
MEDIUM
Description:
360网页内核
Exit code:
3221225547
Version:
15.0.1376.0
Modules
Images
c:\users\admin\appdata\roaming\360se6\application\360secore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\winmm.dll
2368"C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\360huabao\\user_data\\chromeshellmain" --main-ver=15.0.1376.0 --mainprocess-ver=15.0.1376.0 --first-renderer-process --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3672 --field-trial-handle=3016,i,9101743369081115162,9090783325944113689,262144 --disable-features=HardwareMediaKeyHandling /prefetch:1C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe—360huabao.exe
User:
admin
Integrity Level:
MEDIUM
Description:
360壁纸
Version:
4.0.276.0
Modules
Images
c:\users\admin\appdata\roaming\360huabao\360huabao.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3352"C:\Users\admin\AppData\Roaming\360huabao\4.0.276.0\360huabaosetup.exe" --updateC:\Users\admin\AppData\Roaming\360huabao\4.0.276.0\360huabaosetup.exe
360huabao.exe
User:
admin
Integrity Level:
MEDIUM
Description:
360壁纸 服务组件
Exit code:
0
Version:
4.0.276.0
Modules
Images
c:\users\admin\appdata\roaming\360huabao\4.0.276.0\360huabaosetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5720"C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\360huabao\\user_data\\chromeshellmain" --main-ver=15.0.1376.0 --mainprocess-ver=15.0.1376.0 --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4492 --field-trial-handle=3016,i,9101743369081115162,9090783325944113689,262144 --disable-features=HardwareMediaKeyHandling /prefetch:1C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe—360huabao.exe
User:
admin
Integrity Level:
MEDIUM
Description:
360壁纸
Version:
4.0.276.0
Modules
Images
c:\users\admin\appdata\roaming\360huabao\360huabao.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6112"C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\admin\AppData\Roaming\360huabao\\user_data\\chromeshellmain" --main-ver=15.0.1376.0 --mainprocess-ver=15.0.1376.0 --mojo-platform-channel-handle=3140 --field-trial-handle=3016,i,9101743369081115162,9090783325944113689,262144 --disable-features=HardwareMediaKeyHandling /prefetch:8C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe—360huabao.exe
User:
admin
Integrity Level:
MEDIUM
Description:
360壁纸
Version:
4.0.276.0
Modules
Images
c:\users\admin\appdata\roaming\360huabao\360huabao.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6252"C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe" /hb:1C:\Users\admin\AppData\Roaming\360huabao\360huabao.exe
360huabao.exe
User:
admin
Integrity Level:
MEDIUM
Description:
360壁纸
Version:
4.0.276.0
Modules
Images
c:\users\admin\appdata\roaming\360huabao\360huabao.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
23 679
Read events
23 336
Write events
334
Delete events
9

Modification events

(PID) Process:(6908) 360hb4.0.276.0__weiruan__.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6908) 360hb4.0.276.0__weiruan__.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6908) 360hb4.0.276.0__weiruan__.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6908) 360hb4.0.276.0__weiruan__.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6956) 360huabaosetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6956) 360huabaosetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6956) 360huabaosetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6956) 360huabaosetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6956) 360huabaosetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6956) 360huabaosetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
75
Suspicious files
165
Text files
108
Unknown types
10

Dropped files

PID
Process
Filename
Type
6908360hb4.0.276.0__weiruan__.exeC:\Users\admin\AppData\Local\Temp\360hb_tmp\4.0.276.0\360huabaosetup.exeexecutable
MD5:FD3162B9C1BD31C14851D3BAF1055A90
SHA256:7FAE64292D2C11B04A990140AB7B12F5A37EB74998C16A174EC13339783893B8
6956360huabaosetup.exeC:\Users\admin\AppData\Roaming\360huabao\360base.dllexecutable
MD5:A73CF0457DF35FAB74EF3393D2766667
SHA256:DF411EBC1B4A652A3822DE0CEBD5A48151ABB3DD99C8C3D15F858401B27243FD
6908360hb4.0.276.0__weiruan__.exeC:\Users\admin\AppData\Local\Temp\360hb_tmp\4.0.276.0\360Huabao_chat.zipcompressed
MD5:E57B9B3CBAC00D1241E9AF739BAF9304
SHA256:FCD7B6EFB04A381C8C5C1A0B4CCD3E0247ACA6B118EFAAAC496A86BADEC1F175
6908360hb4.0.276.0__weiruan__.exeC:\Users\admin\AppData\Local\Temp\360hb_tmp\4.0.276.0\360huabao_uninstall.zipcompressed
MD5:7B646D769438C52F67508E510B4A7712
SHA256:391ABDBAA83A13B2BF7C77CEEE2FD4375EEA2C44ECDE0921FACBFA91C6F9788F
6908360hb4.0.276.0__weiruan__.exeC:\Users\admin\AppData\Local\Temp\360hb_tmp\4.0.276.0\360Huabao_shell.zipcompressed
MD5:F398923F7C7D4C13568082224707DF8C
SHA256:BD9EC733C3371A7FCACC1E831EBF017B736E6FC5625845F611B61F77E2E353A8
6908360hb4.0.276.0__weiruan__.exeC:\Users\admin\AppData\Local\Temp\360hb_tmp\4.0.276.0\components.zipcompressed
MD5:450BFF49F7B215ED0CA758610557AD93
SHA256:D22EA1A3DE4FA7318308A0F6540E8BCC20FB3EEE42FC58978B430B712BA0BDF8
6908360hb4.0.276.0__weiruan__.exeC:\Users\admin\AppData\Local\Temp\360hb_tmp\4.0.276.0\baseutil.dllexecutable
MD5:297F8E05D26092FEB32FBE3D7CC8A0A0
SHA256:A737E962E77C3F08B25621B959E4C3AFD4E401504FDF53C17EBF6704829A69E9
6908360hb4.0.276.0__weiruan__.exeC:\Users\admin\AppData\Local\Temp\360hb_tmp\4.0.276.0\wallpaper_video.zipcompressed
MD5:DFB429F2B1B44010C452D3923B5A453A
SHA256:A60E3FEEEDBD7C4E9353151660C6BCE24FA086496284B13A71C5E404A3742BBD
6908360hb4.0.276.0__weiruan__.exeC:\Users\admin\AppData\Local\Temp\360hb_tmp\4.0.276.0\HuabaoUtil.dllexecutable
MD5:6047A8CA8F66EA228136213DDAB14E24
SHA256:096C3C1E3C903DB3AD57982532C8AD36933A0AE8739003BE72091150930FCB77
6908360hb4.0.276.0__weiruan__.exeC:\Users\admin\AppData\Local\Temp\360hb_tmp\4.0.276.0\DropDown.zipcompressed
MD5:FFA06C924951313E1B7B93D29783EB8E
SHA256:094C9DD0CF7CF9A351BAE653384122D457A9764456FD8ABCF3F2105A8BED06E5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
163
DNS requests
106
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6956
360huabaosetup.exe
GET
200
171.8.167.90:80
http://s.360.cn/360huabao/inst.htm?ver=4.0.276.0&pid=weiruan&type=install&mid=c3375a2e510ecaee01a0a4820a727e6e&m2=&ccsrc=&ss=0&os=4&w64=1&sf=0&wb=0&im=1&ach=0_0_0
unknown
—
—
whitelisted
6956
360huabaosetup.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
6956
360huabaosetup.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQDVbiRslO1jq7FG78GWtk%2Bw
unknown
—
—
whitelisted
6320
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2384
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6320
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
608
setup.exe
GET
200
39.156.85.231:80
http://seapp.stat.360safe.com/q.html?name=setup6&sever=15.0.1376.0&appver=15.0.1376.0&mid=c3375a2e510ecaee01a0a4820a727e6e&c=0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_0_301_704_0_0_0&pid=360secore&pid2=&m2=eeeeeeee77e256d0cc4755a6dd1f6ad7651f60d32b83&opid=&ss=0&os=4&w64=1&sf=0
unknown
—
—
whitelisted
6956
360huabaosetup.exe
GET
200
101.198.193.5:80
http://ocsp.crlocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRgH%2FPN%2F2KBN5Fec0GB96MNB1kxHgQUmZst9ovwo9uJ1J775XQvaNKQT%2BQCEDvQ%2FI8195ke41yg%2BhNl1%2Fo%3D
unknown
—
—
unknown
608
setup.exe
GET
200
39.156.85.201:80
http://seupdate.360safe.com/inst.htm?ver=15.0.1376.0&pid=360secore&type=install&mid=c3375a2e510ecaee01a0a4820a727e6e&m2=eeeeeeee77e256d0cc4755a6dd1f6ad7651f60d32b83&pid2=&opid=&ss=0&os=4&w64=1&sf=0&sm=0
unknown
—
—
whitelisted
6276
360huabao.exe
POST
200
180.163.251.24:80
http://cloud.browser.360.cn/hp/sea
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5500
RUXIMICS.exe
52.137.106.217:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
52.137.106.217:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1492
svchost.exe
52.137.106.217:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6956
360huabaosetup.exe
180.163.246.72:443
dd.browser.360.cn
China Telecom Group
CN
unknown
1492
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6956
360huabaosetup.exe
171.8.167.90:80
s.360.cn
Luoyang, Henan Province, P.R.China.
CN
unknown
6956
360huabaosetup.exe
61.168.167.221:443
sedl.360safe.com
CHINA UNICOM China169 Backbone
CN
unknown
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
dd.browser.360.cn
  • 180.163.246.72
  • 101.198.2.228
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
s.360.cn
  • 171.8.167.90
  • 171.8.167.89
  • 101.198.2.147
  • 171.13.14.66
whitelisted
sedl.360safe.com
  • 61.168.167.221
  • 36.99.118.136
  • 120.226.35.19
  • 113.56.145.157
  • 123.6.52.227
  • 1.194.173.167
  • 36.158.188.228
  • 123.53.183.217
  • 111.6.38.225
  • 113.219.164.152
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.crlocsp.cn
  • 101.198.193.5
unknown
login.live.com
  • 40.126.32.140
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.22
  • 40.126.32.133
  • 40.126.32.74
  • 40.126.32.136
  • 20.190.160.14
whitelisted

Threats

No threats detected
Process
Message
360huabao.exe
C:\Windows\web\wallpaper\Windows\img0.jpg
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
360hb4.0.276.0__weiruan__.exe