File name:

ICBC_TDR_UShield2_Install(2).exe

Full analysis: https://app.any.run/tasks/35b10575-bbf1-4919-a73a-3c5fdea41784
Verdict: Malicious activity
Analysis date: December 14, 2023, 10:49:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
qrcode
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

288054FE43530B9EAB16F787E13CA262

SHA1:

4F66A9B41AD8E5DEB737B4583F05273F6916B7D2

SHA256:

F36CFA9854CFF33A7DE38F64187166B2DE8C723FCA9C65AB317F0CCEDBCB2712

SSDEEP:

98304:guC+oMlWZ/A1vIt2ix2GWKXHP2JVzcIFYG6dYdXq4oJIB7yZJ8brGl9wrwAF32am:pSLP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)

    • Drops the executable file immediately after the start

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)

    • Registers / Runs the DLL via REGSVR32.EXE

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)

    • Changes the autorun value in the registry

      • D4Ser_ICBC.exe (PID: 3856)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)

    • The process creates files with name similar to system file names

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)

    • Reads the Internet Settings

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)
      • D4Svr_ICBC.exe (PID: 3964)
      • iexplore.exe (PID: 2984)

    • Executes as Windows Service

      • D4Ser_ICBC.exe (PID: 3856)

    • Application launched itself

      • D4Ser_ICBC.exe (PID: 3856)
      • iexplore.exe (PID: 2984)

    • Uses REG/REGEDIT.EXE to modify registry

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)

    • Changes internet zones settings

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)
      • D4Svr_ICBC.exe (PID: 3964)
      • iexplore.exe (PID: 2984)

    • Reads settings of System Certificates

      • D4Svr_ICBC.exe (PID: 3208)
      • iexplore.exe (PID: 2984)

    • Starts application with an unusual extension

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2984)

    • Reads security settings of Internet Explorer

      • iexplore.exe (PID: 2984)

    • Adds/modifies Windows certificates

      • iexplore.exe (PID: 2984)

  • INFO

    • Checks supported languages

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)
      • D4Ser_ICBC.exe (PID: 2336)
      • D4Ser_ICBC.exe (PID: 3856)
      • D4Ser_ICBC.exe (PID: 2860)
      • D4Svr_ICBC.exe (PID: 3208)
      • D4Svr_ICBC.exe (PID: 3964)
      • ns6C58.tmp (PID: 644)
      • D4Tool_ICBC.exe (PID: 3436)
      • iexplore.exe (PID: 2984)
      • wmpnscfg.exe (PID: 3736)

    • Reads the computer name

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)
      • D4Ser_ICBC.exe (PID: 2336)
      • D4Ser_ICBC.exe (PID: 3856)
      • D4Ser_ICBC.exe (PID: 2860)
      • D4Svr_ICBC.exe (PID: 3964)
      • D4Svr_ICBC.exe (PID: 3208)
      • iexplore.exe (PID: 2984)
      • wmpnscfg.exe (PID: 3736)

    • Create files in a temporary directory

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)
      • iexplore.exe (PID: 2984)

    • Creates files in the program directory

      • ICBC_TDR_UShield2_Install(2).exe (PID: 2600)
      • D4Svr_ICBC.exe (PID: 3208)

    • Reads the machine GUID from the registry

      • D4Svr_ICBC.exe (PID: 3964)
      • D4Tool_ICBC.exe (PID: 3436)
      • iexplore.exe (PID: 2984)

    • Process checks are UAC notifies on

      • iexplore.exe (PID: 2984)

    • Process checks computer location settings

      • iexplore.exe (PID: 2984)

    • Checks proxy server information

      • iexplore.exe (PID: 2984)

    • Creates files or folders in the user directory

      • iexplore.exe (PID: 2984)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 14:19:31+02:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x354b
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.128
ProductVersionNumber: 2.0.0.128
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Tendyron
FileDescription: Tendyron 193D4 for Industrial and Commercial Bank of China
FileVersion: 2.0.0.128
LegalCopyright: Copyright(C) 2025 Tendyron
ProductName: Tendyron 193D4 for Industrial and Commercial Bank of China
ProductVersion: 2.0.0.128
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
15
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start icbc_tdr_ushield2_install(2).exe regsvr32.exe no specs regsvr32.exe no specs d4ser_icbc.exe no specs d4ser_icbc.exe d4ser_icbc.exe no specs regedit.exe no specs d4svr_icbc.exe no specs d4svr_icbc.exe no specs ns6c58.tmp no specs d4tool_icbc.exe no specs iexplore.exe iexplore.exe wmpnscfg.exe no specs icbc_tdr_ushield2_install(2).exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Users\admin\AppData\Local\Temp\nsz6C7.tmp\ns6C58.tmp" C:\Program Files\ICBCEbankTools\Tendyron/res/config_ws_tdr.batC:\Users\admin\AppData\Local\Temp\nsz6C7.tmp\ns6C58.tmp—ICBC_TDR_UShield2_Install(2).exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225501
Modules
Images
c:\users\admin\appdata\local\temp\nsz6c7.tmp\ns6c58.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1988C:\Windows\system32\regsvr32.exe /s "C:\Windows\Downloaded Program Files\icbc_tdrusbkey.dll"C:\Windows\System32\regsvr32.exe—ICBC_TDR_UShield2_Install(2).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2300C:\Windows\system32\regsvr32.exe /s "C:\Windows\Downloaded Program Files\icbcgm_tdrusbkey.dll"C:\Windows\System32\regsvr32.exe—ICBC_TDR_UShield2_Install(2).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2336C:\Windows\system32/D4Ser_ICBC.exe -i -sC:\Windows\System32\D4Ser_ICBC.exe—ICBC_TDR_UShield2_Install(2).exe
User:
admin
Company:
Tendyron Corporation
Integrity Level:
HIGH
Description:
中国工商银行U盾服务软件
Exit code:
0
Version:
1, 0, 0, 2
Modules
Images
c:\windows\system32\d4ser_icbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2600"C:\Users\admin\AppData\Local\Temp\ICBC_TDR_UShield2_Install(2).exe" C:\Users\admin\AppData\Local\Temp\ICBC_TDR_UShield2_Install(2).exe
explorer.exe
User:
admin
Company:
Tendyron
Integrity Level:
HIGH
Description:
Tendyron 193D4 for Industrial and Commercial Bank of China
Exit code:
0
Version:
2.0.0.128
Modules
Images
c:\users\admin\appdata\local\temp\icbc_tdr_ushield2_install(2).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2860C:\Windows\system32\D4Ser_ICBC.exe -mC:\Windows\System32\D4Ser_ICBC.exe—D4Ser_ICBC.exe
User:
SYSTEM
Company:
Tendyron Corporation
Integrity Level:
SYSTEM
Description:
中国工商银行U盾服务软件
Exit code:
0
Version:
1, 0, 0, 2
Modules
Images
c:\windows\system32\d4ser_icbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2984 http://www.icbc.com.cn/C:\Program Files\Internet Explorer\iexplore.exe
D4Tool_ICBC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3208C:\Windows\system32\D4Svr_ICBC.exe installRootC:\Windows\System32\D4Svr_ICBC.exe—ICBC_TDR_UShield2_Install(2).exe
User:
admin
Company:
Tendyron Corporation
Integrity Level:
HIGH
Description:
中国工商银行证书注册程序
Exit code:
1
Version:
2, 5, 1, 10
Modules
Images
c:\windows\system32\d4svr_icbc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3264"C:\Users\admin\AppData\Local\Temp\ICBC_TDR_UShield2_Install(2).exe" C:\Users\admin\AppData\Local\Temp\ICBC_TDR_UShield2_Install(2).exe—explorer.exe
User:
admin
Company:
Tendyron
Integrity Level:
MEDIUM
Description:
Tendyron 193D4 for Industrial and Commercial Bank of China
Exit code:
3221226540
Version:
2.0.0.128
Modules
Images
c:\users\admin\appdata\local\temp\icbc_tdr_ushield2_install(2).exe
c:\windows\system32\ntdll.dll
3288"C:\Program Files\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
30 464
Read events
30 283
Write events
181
Delete events
0

Modification events

(PID) Process:(2600) ICBC_TDR_UShield2_Install(2).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2600) ICBC_TDR_UShield2_Install(2).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2600) ICBC_TDR_UShield2_Install(2).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2600) ICBC_TDR_UShield2_Install(2).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2600) ICBC_TDR_UShield2_Install(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Tendyron\193D4_ICBC
Operation:writeName:USBKeyVersion
Value:
1.0.0.20
(PID) Process:(2600) ICBC_TDR_UShield2_Install(2).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Tendyron\193D4_ICBC
Operation:writeName:GMUSBKeyVersion
Value:
1.0.0.18
(PID) Process:(2600) ICBC_TDR_UShield2_Install(2).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Operation:writeName:2500
Value:
0
(PID) Process:(2600) ICBC_TDR_UShield2_Install(2).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
Operation:writeName:2500
Value:
3
(PID) Process:(3964) D4Svr_ICBC.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
Operation:writeName:2201
Value:
3
(PID) Process:(3964) D4Svr_ICBC.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
20
Suspicious files
59
Text files
225
Unknown types
1

Dropped files

PID
Process
Filename
Type
2600ICBC_TDR_UShield2_Install(2).exeC:\Users\admin\AppData\Local\Temp\nsz6C7.tmp\System.dllexecutable
MD5:959EA64598B9A3E494C00E8FA793BE7E
SHA256:03CD57AB00236C753E7DDEEE8EE1C10839ACE7C426769982365531042E1F6F8B
2600ICBC_TDR_UShield2_Install(2).exeC:\Users\admin\AppData\Local\Temp\ICBC_TDR_LOGO.bmpimage
MD5:2A86FF2C8874BE3A41BFF4BDC1AEBDA9
SHA256:A87507783431D112068EA846D368AC6F55B12C1CA12ACC1F37AB0B98598DC63C
2600ICBC_TDR_UShield2_Install(2).exeC:\Users\admin\AppData\Local\Temp\nsz6C7.tmp\LangDLL.dllexecutable
MD5:410A586735F45164C86BDA363AD8446F
SHA256:B15B1FC88D1B56088B2D3738D76772A91FA186A316A3E0A154358820D0FB9005
2600ICBC_TDR_UShield2_Install(2).exeC:\Users\admin\AppData\Local\Temp\nsz6C7.tmp\Splash.dllexecutable
MD5:0E2B7B4D19A6C9F62D04820AE502C167
SHA256:8992098E5709AD7D68A8E021B20489338507A48523D8DDA6F5244ADC33A404A4
2600ICBC_TDR_UShield2_Install(2).exeC:\Users\admin\AppData\Local\Temp\nsz6C7.tmp\Plugin_gsyh.dllexecutable
MD5:742F42337AD1E4CDB097EAE6D5A21C0C
SHA256:4D9DE3EBF01A1362BD318255C46DC11E02155E24BCB1149E18F76DE1726FC59A
2600ICBC_TDR_UShield2_Install(2).exeC:\Users\admin\AppData\Local\Temp\nsz6C7.tmp\UserInfo.dllexecutable
MD5:D16E06C5DE8FB8213A0464568ED9852F
SHA256:728472BA312AE8AF7F30D758AB473E0772477A68FCD1D2D547DAFE6D8800D531
2600ICBC_TDR_UShield2_Install(2).exeC:\Users\admin\AppData\Local\Temp\nsz6C7.tmp\ioSpecial.initext
MD5:6F98FCDA445825382121E480A64AE24C
SHA256:689A67B30946CBE12DCE92D17207EC0488E850A806BE608E6FB174F853F86B57
2600ICBC_TDR_UShield2_Install(2).exeC:\Users\admin\AppData\Local\Temp\nsz6C7.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
2600ICBC_TDR_UShield2_Install(2).exeC:\Program Files\ICBCEbankTools\ICBCEbankPlugin\icbc_TDR_usbkey_edge.jsontext
MD5:DBFC6F71713AC53FD149835A717577D6
SHA256:4E641BF6618BA90F098C72DB05474E3F73108CB91D62274BFC17C80E1A01E321
2600ICBC_TDR_UShield2_Install(2).exeC:\Program Files\ICBCEbankTools\Tendyron\unInstall.exeexecutable
MD5:4BDE6C0AFEAC84EBD1D24BA6CC14DFC9
SHA256:3795052CD94D671E91C961D53617CBD03F998FCCF745984E1808807879A00925
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
57
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3288
iexplore.exe
GET
302
43.152.44.239:80
http://www.icbc.com.cn/
unknown
—
—
unknown
3288
iexplore.exe
GET
200
163.181.92.236:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQoKCsJAnleSoD2J3SoeC9qbEFAqgQUFl5oZ7yWIGLuNkzUZMPpoijWY8ICEASy2xU%2Bq1l7B%2F%2BTDVjs%2FQA%3D
unknown
binary
471 b
unknown
3288
iexplore.exe
GET
200
163.181.92.236:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQoKCsJAnleSoD2J3SoeC9qbEFAqgQUFl5oZ7yWIGLuNkzUZMPpoijWY8ICEA2e0lx%2BX9agdMkyYWpNvHU%3D
unknown
binary
471 b
unknown
2984
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
314 b
unknown
3288
iexplore.exe
GET
200
43.152.44.239:80
http://v.icbc.com.cn/userfiles/Resources/ICBC/licai/information3.png
unknown
image
441 b
unknown
3288
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D
unknown
binary
1.47 Kb
unknown
3288
iexplore.exe
GET
200
163.181.56.214:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMO%2FVnZnwG%2FBa1LlDnjADjVWaMsQQURUHjk1RwuOmlt5a8JrFYdUKXPvMCEAhYv1QpDxO33fbPE7HPhKo%3D
unknown
binary
471 b
unknown
3288
iexplore.exe
GET
200
163.181.56.214:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfVfx8VW73kz4Q3jhf3m5Q%3D
unknown
binary
471 b
unknown
3288
iexplore.exe
GET
200
163.181.56.214:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMO%2FVnZnwG%2FBa1LlDnjADjVWaMsQQURUHjk1RwuOmlt5a8JrFYdUKXPvMCEAMY4pjz9EgEG7eFCGRmrtI%3D
unknown
binary
471 b
unknown
3288
iexplore.exe
GET
200
163.181.92.236:80
http://ocsp.digicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQoKCsJAnleSoD2J3SoeC9qbEFAqgQUFl5oZ7yWIGLuNkzUZMPpoijWY8ICEAHX0qy9NcsNJjcJj0vVbFA%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3288
iexplore.exe
43.152.44.239:80
www.icbc.com.cn
ACE
DE
unknown
3288
iexplore.exe
43.152.44.239:443
www.icbc.com.cn
ACE
DE
unknown
3288
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3288
iexplore.exe
163.181.92.236:80
ocsp.digicert.cn
Zhejiang Taobao Network Co.,Ltd
DE
unknown
3288
iexplore.exe
60.247.99.191:443
act.icbc.com.cn
China Networks Inter-Exchange
CN
unknown
2984
iexplore.exe
104.126.37.137:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
www.icbc.com.cn
  • 43.152.44.239
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.cn
  • 163.181.92.236
  • 163.181.92.237
  • 163.181.92.234
  • 163.181.92.233
  • 163.181.92.235
  • 163.181.92.231
  • 163.181.92.238
  • 163.181.92.232
whitelisted
v.icbc.com.cn
  • 43.152.44.239
unknown
act.icbc.com.cn
  • 60.247.99.191
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.137
  • 104.126.37.130
  • 104.126.37.144
  • 104.126.37.131
  • 104.126.37.128
  • 104.126.37.153
  • 104.126.37.139
  • 104.126.37.146
  • 104.126.37.154
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
hit.icbc.com.cn
  • 220.196.77.32
unknown
papi.icbc.com.cn
  • 58.33.221.114
unknown

Threats

No threats detected
Process
Message
ICBC_TDR_UShield2_Install(2).exe
process name
ICBC_TDR_UShield2_Install(2).exe
OK
ICBC_TDR_UShield2_Install(2).exe
Installation prompt for ICBC U-Shield program (Tiandi Rong)
ICBC_TDR_UShield2_Install(2).exe
The following programs may affect software installation. Do you want to forcibly close them
ICBC_TDR_UShield2_Install(2).exe
process ID
ICBC_TDR_UShield2_Install(2).exe
CALCEL
ICBC_TDR_UShield2_Install(2).exe
D4Token_ICBC.dll
ICBC_TDR_UShield2_Install(2).exe
GetDllOwnerProcName::param
ICBC_TDR_UShield2_Install(2).exe
The following programs may affect software installation. Do you want to forcibly close them
ICBC_TDR_UShield2_Install(2).exe
In GetDllOwnerNameList
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ICBC_TDR_UShield2_Install(2).exe