Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
Deep Malware Analysis
top title background image
flash

Ia93PTYivQ.exe

Status: finished
Submission Time: 2024-07-24 13:26:16 +02:00
Malicious
Ransomware
Spreader
Trojan
Exploiter
Evader
BlackMoon, Neshta

Comments

Tags

  • exe

Details

  • Analysis ID:
    1479966
  • API (Web) ID:
    1479966
  • Original Filename:
    1284ee327c41d0da06a2838194d2376ed3d92f0dfec9dac63a52238c8125740f.exe
  • Analysis Started:
    2024-07-24 13:29:14 +02:00
  • Analysis Finished:
    2024-07-24 13:43:42 +02:00
  • MD5:
    ced8ef4a79d487315657632b9923003d
  • SHA1:
    ca58da3d229ae599a0663a0dbc587fca20d95bda
  • SHA256:
    1284ee327c41d0da06a2838194d2376ed3d92f0dfec9dac63a52238c8125740f
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 24/24
malicious
malicious

IPs

IP Country Detection
69.42.215.252
 United States
172.217.18.14
 United States
199.59.243.226
 United States
Click to see the 3 hidden entries
142.250.186.97
 United States
13.107.246.60
 United States
103.224.212.216
 Australia

Domains

Name IP Detection
freedns.afraid.org
 69.42.215.252
ww25.qq678833.f08.87yun.club
 0.0.0.0
xred.mooo.com
 0.0.0.0
Click to see the 5 hidden entries
docs.google.com
 172.217.18.14
77026.bodis.com
 199.59.243.226
drive.usercontent.google.com
 142.250.186.97
qq678833.f08.87yun.club
 103.224.212.216
s-part-0032.t-0009.t-msedge.net
 13.107.246.60

URLs

Name Detection
http://ww25.qq678833.f08.87yun.club/hm.dat?subid1=20240724-2130-12a4-8b6b-a64fd2f384965R
http://www.eyuyan.com
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16
Click to see the 97 hidden entries
https://doh.pub/dns-query?name=tencent.cdn-qq.com
http://qq678833.f08.87yun.club/hm.txt
http://my.haozhuma.com/potato.html?s=delsimvip
http://my.haozhuma.com/tg.html
http://ww25.qq678833.f08.87yun.club/hm.dat?subid1=20240724-2130-3876-8b53-07becb3e23adF
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlD
https://curl.haxx.se/docs/http-cookies.html
http://ww25.qq678833.f08.87yun.club/hm.txt?subid1=20240724-2130-466f-b519-87259b30e8fe
http://qq678833.f08.87yun.club/hm.txtx
http://ww25.qq678833.f08.87yun.club/hm.txt?subid1=20240724-2130-3789-aad4-f4454027ce89
https://m.jingxi.com/coprsearch/cosearch?coupon_batch=searchCB(
https://docs.google.com/le.com
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978d
https://api.m.jd.com/client.action?appid=newChannel&functionId=feedFlowDisplayIndex&body=
http://xred.site50.net/syn/Synaptics.rarT
https://www.baidu.comDate:/
http://xred.site50.net/syn/Synaptics.rarZ
http://dywt.com.cnservice
http://xred.site50.net/syn/SSLLibrary.dll
http://qq678833.f08.87yun.club/hm.txtQ
http://-100/sms/Merchant.phphttps://doh.pub/dns-query?name=tencent.oss-qq.com
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc6135629789
https://h5.m.jd.com/babelDiy/Zeus/3mR9DE9rpttcYppE2ytUtGGbUzs6/index.html?channel=19
https://drive.usercontent.google.com/
http://my.haozhuma.com/qq.html&type=open
http://https=deletedUTF-8GBKAdodb.StreamTypeOpenWritePositionCharsetReadTextCloseWriteTextReadda7953
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://ww25.qq678833.f08.87yun.club/hm.txt?subid1=20240724-2130-10e7-b68d-f732d86a8150
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:
http://xred.site50.net/syn/SSLLibrary.dll6
https://www.baidu.com
http://ww25.qq678833.f08.87yun.club/Y;
http://qq678833.f08.87yun.club/hm.dat
https://doh.pub/dns-query?name=tencent.oss-qq.com
http://h5.haozhuma.com/reg.html?action=?ss=CleanBlacklist
http://ww25.qq678833.f08.87yun.club/hm.dat?subid1=20240724-2130-12a4-8b6b-a64fd2f38496
http://ww25.qq678833.f08.87yun.club/hm.dat?subid1=20240724-2130-3876-8b53-07becb3e23ad
http://qq678833.f08.87yun.club/hm.dater
http://my.haozhuma.com/qq.html
http://api.haozhuma.com/sms/Merchant.phpfor
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=
http://qq678833.f08.87yun.club/hm.datW3
http://qq678833.f08.87yun.club/hm.dat_:
https://doh.pub/dns-query?name=tencent.cdn-qq.comAnswer
http://ww25.qq678833.f08.87yun.club/hm.txt?subid1=20240724-2130-3789-
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978w
http://rlbyte.com)
http://my.haozhuma.com/lanzou.html
http://qq678833.f08.87yun.club/hm.dath
http://ww25.qq678833.f08.87yun.club/hm.dat?subid1=20240724-2130-3876-8b53-07becb3e23ad11x%
http://qq678833.f08.87yun.club/hm.dat_
http://h5.haozhuma.com/reg.html?action=
http://ww25.qq678833.f08.87yun.club/hm.dat?subid1=20240724-2130-4963-a2d0-60eb4ce1cb7b
https://wq.jd.com/item/view?sku=8321142
http://qq678833.f08.87yun.club/hm.datT
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsO
http://ww25.qq678833.f08.87yun.club/b;
http://xred.site50.net/syn/SSLLibrary.dl0
http://xred.site50.net/syn/SUpdate.ini
http://qq678833.f08.87yun.club/.
http://xred.site50.net/syn/SUpdate.iniZ
http://ww25.qq678833.f08.87yun.club/hm.dat?subid1=20240724-2130-479d-bbbe-0ae47ceb67a1
http://qq678833.f08.87yun.club/
https://www.google.com
https://docs.google.com/a
https://docs.google.com/
http://c0.3.cn/stocks?&type=getstocks&skuIds=User-Agent:
https://docs.google.com/n
https://drive.usercontent.google.com/&
https://docs.google.com/v
http://api.haozhuma.com/sms/Merchant.php
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://www.eyuyan.com)DVarFileInfo$
http://c0.3.cn/stocks?&type=getstocks&skuIds=
https://docs.google.com/google.com/.com
http://ww25.qq678833.f08.87yun.club/
http://ww25.qq678833.f08.87yun.club/m;
http://api.6333600.com/sms/Merchant.php
https://wq.jd.com/deal/mshopcart/addcmdy?&reg=1&scene=2&type=0&commlist=
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
https://wq.jd.com/item/view?sku=
http://my.haozhuma.com/potato.html
http://www.goldwave.com&type=Open&type=Close
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
http://qq678833.f08.87yun.club/hm.datoft
http://qq678833.f08.87yun.club/S;
http://dywt.com.cn
http://www.goldwave.com
http://nsis.sf.net/NSIS_ErrorError
https://item.jd.com/
http://xred.site50.net/syn/Synaptics.rar
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:
http://ww25.qq678833.f08.87yun.club/hm.txt?subid1=20240724-2130-47e2-b355-4ae9cff7acfd
http://qq678833.f08.87yun.club/hm.dat(P
https://mozilla.org0/
http://xred.site50.net/syn/SUpdate.ini0
http://qq678833.f08.87yun.club/J

Dropped files

Name File Type Hashes Detection
C:\Program Files (x86)\AutoIt3\Au3Check.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\AutoIt3\Au3Info.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
Click to see the 208 hidden entries
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\AutoIt3\Uninstall.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Google\Update\Install\{EB80938B-EC00-4683-A2CC-456206E3A4E1}\117.0.5938.134_117.0.5938.132_chrome_updater.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source user\OSE.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_stub.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\Installer\setup.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\cookie_exporter.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\elevation_service.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\identity_helper.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_proxy.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_pwa_launcher.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedgewebview2.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\notification_helper.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\pwahelper.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_stub.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\Installer\setup.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\cookie_exporter.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\elevation_service.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_proxy.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_pwa_launcher.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedgewebview2.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\notification_click_helper.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\pwahelper.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Synaptics\RCX2B1B.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Synaptics\Synaptics.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\1.dat
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\3582-490\._cache_._cache_SB360.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\3582-490\._cache_HD_._cache__CACHE~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\3582-490\._cache_SB360.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\3582-490\._cache__CACHE~2.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\3582-490\._cache__CACHE~3.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\3582-490\._cache__CACHE~4.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\3582-490\_CCC23~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\RCX3898.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\RCX4413.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\RCX5B53.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\RCX6D17.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\Temp\LibHttp.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\Temp\SB360.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\Temp\haozhuma_gl_1.8 (1).exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\WYJOTWYu.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\chrome.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\._cache_._cache_SB360.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\._cache_HD_IA93PT~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
 #
C:\Users\user\Desktop\._cache_HD_Ia93PTYivQ.exe
 PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
 #
C:\Users\user\Desktop\._cache_HD__C83AE~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\._cache_SB360.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\._cache__C0510~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\._cache__C2526~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\._cache__CACHE~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\._cache__CACHE~2.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\._cache__CACHE~3.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\._cache__CCC23~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\._cache__CD249~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\HD_._cache__CACHE~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\HD_IA93PT~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\HD_Ia93PTYivQ.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Desktop\HD__C83AE~1.EXE
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\Documents\~$cache1
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Windows\HD_.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Windows\directx.sys
 ASCII text, with CRLF line terminators
 #
C:\Windows\svchost.com
 PE32 executable (GUI) Intel 80386, for MS Windows
 #