Malware Analysis Report

2024-10-23 20:58

Sample ID 240408-2tqj6aeb82
Target e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118
SHA256 043826693f7236e5353ed0f60818002fbf8122af64cb48e030fc6ce2071a48d2
Tags
expiro backdoor discovery evasion trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

043826693f7236e5353ed0f60818002fbf8122af64cb48e030fc6ce2071a48d2

Threat Level: Known bad

The file e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

expiro backdoor discovery evasion trojan

Expiro, m0yv

Expiro payload

Disables taskbar notifications via registry modification

Windows security modification

Executes dropped EXE

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

System policy modification

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-08 22:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-08 22:52

Reported

2024-04-08 22:55

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe"

Signatures

Expiro, m0yv

backdoor expiro

Expiro payload

backdoor
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables taskbar notifications via registry modification

evasion

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-566096764-1992588923-1249862864-1000\EnableNotifications = "0" C:\Windows\System32\alg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-566096764-1992588923-1249862864-1000 C:\Windows\System32\alg.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\X: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\Q: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\P: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\M: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\Y: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\alg.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system32\Agentservice.exe C:\Windows\System32\alg.exe N/A
File created \??\c:\windows\system32\perceptionsimulation\pojhkemi.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\svchost.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\imaeboap.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\vds.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\jgjpdggg.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\Appvclient.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\spectrum.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\syswow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\vds.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\efhmpjok.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\fxssvc.exe C:\Windows\System32\alg.exe N/A
File created \??\c:\windows\system32\kngknkej.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\gdfdlmcf.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\Agentservice.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\mlkihndn.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\hbkanhje.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\tieringengineservice.exe C:\Windows\System32\alg.exe N/A
File created \??\c:\windows\system32\ninebccc.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\sgrmbroker.exe C:\Windows\System32\alg.exe N/A
File created \??\c:\windows\system32\openssh\kmmghebk.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\syswow64\hnhlkege.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\wbem\lfopiidd.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\kkhkbpib.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\diagsvcs\cpoebmkc.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\snmptrap.exe C:\Windows\System32\alg.exe N/A
File created \??\c:\windows\system32\aibnbgoh.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\Appvclient.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\wbengine.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\tieringengineservice.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Windows\System32\WindowsPowerShell\v1.0\hjhfpnge.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\kjaijale.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\syswow64\perfhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\vssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\fjnmincp.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\msdtc.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe C:\Windows\System32\alg.exe N/A
File created \??\c:\windows\system32\cabbcjne.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe C:\Windows\System32\alg.exe N/A
File created \??\c:\windows\system32\gqkmfmhi.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\habphocb.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\odbidhbe.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\svchost.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\lsass.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\sensordataservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system32\sgrmbroker.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\system32\jkkpiegl.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\miqfjfol.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\pgildlkb.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\giblbqag.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\kjkookie.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\olemadei.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\kgacdccg.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Internet Explorer\dendjgfp.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\onbaidqf.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\program files (x86)\mozilla maintenance service\kehmpmoj.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\occlljkq.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Internet Explorer\elidehmc.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\dakeokhg.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\program files\windows media player\fblqmnnj.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\jfjkgccl.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\kihlpche.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\lhbjhkab.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cedpmnkl.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\pijgofaf.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\ldcnmoao.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\iilmmhmc.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\cobmhpje.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\dddilmae.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\jkgaipki.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\dotnet\ddnfppgh.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\obkakffi.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\7-Zip\gkooamha.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\lgamkbac.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hhfjjgab.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\pppjqpbi.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jipjcfed.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\7-Zip\lncjookl.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\7-Zip\jgpijieg.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\hlepeenn.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\servicing\trustedinstaller.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\servicing\trustedinstaller.exe C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created \??\c:\windows\servicing\fonbiibp.tmp C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
File created C:\Windows\Logs\CBS\CBS.log C:\Windows\servicing\TrustedInstaller.exe N/A
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\servicing\TrustedInstaller.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\alg.exe N/A

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\System32\alg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" C:\Windows\System32\alg.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e89d42e8739f1d730eadced6f6a5f428_JaffaCakes118.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 40.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 8.179.89.13.in-addr.arpa udp

Files

memory/3316-2-0x00007FF669C50000-0x00007FF669DD0000-memory.dmp

C:\Users\Admin\AppData\Local\njnerobm\cmd.exe

MD5 8e73f8c5914fb90b6358c55da605bb0b
SHA1 485f66375097870b4a077747a1626730e458d084
SHA256 2f996b67134970af84424c5d5232c7ac5c6f6bbffcb193cb74c54028d9098937
SHA512 f9a368adb0234275b01c6606d87089e80c423c0f6d0638271ed6fbaca1f476e21d1e922675f6b76f6f69ddf563c39cb421b14464109745aa899ed1ac09731a5b

C:\Windows\System32\alg.exe

MD5 c654a86aa42cc938576e84e24dd4a7c1
SHA1 bffc2b75df7e6a4cc46a97b73f59f6a30c0b83ec
SHA256 f77cea6b151d07b7585330841e839bf295723f2a92bc08edd7d7999e7672b872
SHA512 b5c1a21de9b9e01869e9a6538b3a003342689e7d14d0ac339bc7db731c731b0c74137473811cdc5654c0c0c8a15cbb93b2d57371e1788d432e6de009f9a0f937

memory/4460-17-0x00007FF6FE2E0000-0x00007FF6FE417000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 4ff0ec1515b2a7483c4ddd9cd2d3475d
SHA1 6b775c6dd8bf2ab515f12826cbd2e747883e1cce
SHA256 af2d3f0f16931b7869e318ad28a8d52e2c1272fdff979cd4722c8049a2d159a7
SHA512 f4aedd2d0f6010e68f6e77e76f9296de708f619c87d44e79ca80e1db13f733639fb7b2d183d901328f22982cc16fadca490766a3617c75f81c839666d3b90f66

memory/1016-29-0x00007FF688FE0000-0x00007FF689116000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 8128096927e000880feb8d0def15d90f
SHA1 83ea888843047b054249d598dedd5f55806757fa
SHA256 3fb8ebd3177f0c93cd2ec9d2c3220245624398cb3cf1e0f1c7db552e24b503f9
SHA512 3c37ccb7c093aacb3f2b03a9c10b841f936be4b6486a69ceb16bbd6a3ba5ee0c033a534ac4477ca8c4f454c3487e4aa6d5e7ccb574d9317f46c38db28b6ea304

memory/4132-36-0x00007FF630180000-0x00007FF630342000-memory.dmp

memory/4132-37-0x00007FF630180000-0x00007FF630342000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 847c628a6e6248357aa09f49f44fc89d
SHA1 3e75da29d7f0c99a1b47b6909b7995b038b444e7
SHA256 d0d856e57da27af4728b28989b106e030af89b626566a5a0a349e6addb4aa6aa
SHA512 5d388a2fcbfc2e37dc8dbcaf23ab665a2179729f259c5c4b4a0b409ca09043c668eac79c5483766052ed5c0c7f61490ebef803e29ac01412e65385e631d09927

memory/2688-44-0x00007FF7FA1E0000-0x00007FF7FA4A4000-memory.dmp

memory/4460-45-0x00007FF6FE2E0000-0x00007FF6FE417000-memory.dmp

\??\c:\windows\system32\Appvclient.exe

MD5 640c7911c6f6cd3db36df95a799df47e
SHA1 3a05c75f1fcb9fe7cf601acfafbad8ef06046589
SHA256 9886e3944f7b7023089359a57c5017f285100c651732ec96a07e2367a903846a
SHA512 9dc464b46422df66caa0b1ffee7f9c147ccabcf97b02c1bdab3551671a0dc93518cc6caf6ea91ba46217856bc1224172dc0db22443b1807a5d90e644e0893240

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 4848e631d64d6b7221b0ad943a0d7d43
SHA1 65e4fcd3faf271bbe79e772c96cdfadeb566a460
SHA256 277ddaa7b3553ab2679d7062004c71369aa869c8805ec974b5edcc7db7b309c5
SHA512 cf8db368e9ed48a397d07097fa5812867fe74a44bee779706e597a44cc48b7776a277a17b7beb028b06d17888e4388c89a3994f4cde8377fec392088cd369aa3

memory/3884-53-0x00007FF727690000-0x00007FF727948000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\pncpniqk.tmp

MD5 7526a04e010960447b3b1c72797a27c3
SHA1 2d3963e93d012123b7f509088a583cd37c420d9b
SHA256 5d1563567190d7832a005a85d7a32b4cd6059cd3e0bf20b1a93932d2e20c7dc4
SHA512 7d80f8318c720320583b785f173d4b0f785163635b58e9db41a9ce97da9699488c0e78816702f0c63f91129e165c11bc95b48e2e6c5fa9db270441e7ca89b37e

memory/3316-128-0x00007FF669C50000-0x00007FF669DD0000-memory.dmp

memory/4460-144-0x00007FF6FE2E0000-0x00007FF6FE417000-memory.dmp

C:\Windows\servicing\TrustedInstaller.exe

MD5 805418acd5280e97074bdadca4d95195
SHA1 a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6
SHA256 73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01
SHA512 630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de

memory/1016-156-0x00007FF688FE0000-0x00007FF689116000-memory.dmp

C:\odt\office2016setup.exe

MD5 5666979c0474db4d7c717c2475e6fc18
SHA1 d3f416c0cffddd90967b3070933880608fddb32f
SHA256 f37bdebbd172f32a68fac8e35ad8568ef89efbabde2b1134fe96147aa50cbe23
SHA512 e1fe810383d77f158e222206de26671412cbc4017e21cf6f1a71381c3edb8578a9cf339b65b640a67b6544697fa88da3c21f5c40299ce1d49effb6e07435a0b5

memory/2688-183-0x00007FF7FA1E0000-0x00007FF7FA4A4000-memory.dmp

memory/3884-189-0x00007FF727690000-0x00007FF727948000-memory.dmp

C:\Program Files\7-Zip\7z.exe

MD5 ce81ca056996a29ad8febbd594b7f7b5
SHA1 2cbf1a17fa9c2de2df2d1d30ef27fb913d61890f
SHA256 7bf308b3ca2e95780c57cd639d00a1eb608d2697b0b3c2e016270f39821b6b2f
SHA512 ddb79f4b70dc61415e63d39a754dc45d8a0cfa02a3a9085177d57c5d2f0349d5f95a614b29d8ea6d1b22e5537550336f6b05b7fc2d3de777c1d9eea732fe0de6

C:\Program Files\7-Zip\7zFM.exe

MD5 dde10ba2de20fdb3e91603b19c543191
SHA1 58323cb4a50a3a1168c95c05f9b775bdec6d14ee
SHA256 4561ceafc9e2f3bd8aead97974e5784191206bf31306e00ff8b40c7755af7cb1
SHA512 9ffdb76713996b9839b0cbfb0944a45f282ff90d205862909fa8579887171de5048654746036e4d021c528a2c2ef02ce4b8fd87215401578ae1996715be24524

C:\Program Files\7-Zip\7zG.exe

MD5 ae7e5bb4d2853ee1878708d2a5084b43
SHA1 73cc8239a15c51dfc1bea0d8e58c1b0dd9906a87
SHA256 a463f6b1f9a48634361bb5ed7ed93e3eece3baed3c2e3294020c3de124ffeb9b
SHA512 2d9e419be329f919d2aea33b205a3071397682a62d2881cdcd7d902ea5a5ff58cd9bf8ab2a23bd0e2af25a45a77475315c277ae3fa8c920d2c00f27e09c85bde

C:\Program Files\7-Zip\Uninstall.exe

MD5 b1da4c5c5a8f7bdda5336a6ad5fd5324
SHA1 d435a534f2fc6f014d7b6ec7dad250bb703e60c0
SHA256 afc3211139431020cf10c67995952de4f7d53ce138faa8f8a7c68b754255ddac
SHA512 e5658fea190541db0a20907ed711064984a38323d2682c11a47c1abc8afbca8f0cab556bb17c328538fcb1672da8f33e35a401cde9ee7f9fa18c0139f437efd8

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 5a4cea8f93c69adfc66a30d37c22a9bb
SHA1 a93915c469b82bf3cda6bda76dfb23cc7d4391e4
SHA256 1f9720ad6ddf475c20bb30030ba1eeff9efb2b18b1a66c1dd145fa3f412e21f0
SHA512 4adcfb88db97378301414c30b77fc4ef36ae49d9af5532a6a14adc39a82fc4d83374e263d71f95fdfab6f9153028bb07ae8378a7e7b443731e8be5efb75170dd

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 e50db9ec1cbb2cf54a661383df11b0aa
SHA1 4f8e1aae350ab7264bc81c4d38bf068ee0593c5c
SHA256 17384052938d5e762099e675f99618eb58e17882b3d02aa75b01a30f1b2e8f4f
SHA512 dbb8f35e7b9cf674a50e93ced1e339d54dfc9aa7f62f1dca179dde5436a5497cad887c59766c4b40cb1650e4b3c11e1f15192302db3d74518a32f49988b6e06c

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 9913f304a129a450ed75c30385844ce3
SHA1 57c6c42b70398d01107332cd5673b73982157644
SHA256 ea292f183c05d765ce9f69b415102041967852d4e7d8988414cc75788334ab14
SHA512 38b85f65dd4bf8c40b26a0625512b7a397511bfbd344ff73826399a5066ada714b05b14780ffcdea82d44fd1c8270f52cd4729da083eba524f8553834f5ad53d

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 f886c74390adb0e6bf0506d0ae79681a
SHA1 4382379398fc2f4b17be7bcec5b3fe2681cbc2d4
SHA256 a5a5fad1dbd53bd456e8695ae8fe9269c0cfdd71b1bb7435704a21910cca9b71
SHA512 6058612ba83c9905df5d53ca9bbb149d969dd607755434a86634c2a1dc64645da39fdae82f302d83f02f1cc914d97ed5c4f02e11c4389da4d9ae43acf18a7033

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 2cd53ed01e9ab7024c4df5c8a6e3dae3
SHA1 015528ea57d4632c1a72ca691aa7502abbe7837a
SHA256 53ac22cf76f2a23caaad05e2f910f6462891e45f7f5537682c97c6013551f052
SHA512 1ec87c1d96efa3f58bba7e18e6cfd31a75dbabd89294fbc5abce82b0d491a4158916eabb2ebd45253f3c14ee487bddb55130fcf3c6795d9824750f762e3257f1