Key value queried: HKEY_LOCAL _MACHINE\S OFTWARE\Cl asses\WOW6 432Node\CL SID\\InProcS erver32įound GUI installer (many successful clicks)ĭirectory created: C:\Program Files\Kle ver\Nothin gs\temp.00 0ĭirectory created: C:\Program Files\Kle verĭirectory created: C:\Program Files\Kle ver\Nothin gsĭirectory created: C:\Program Files\Kle ver\Nothin gs\PumpKIN. ExactScan Pro is a popular, easy-to-use macOS scanning software that utilizes built-in drivers for over 200 document scanners, including devices from. Uses an in-process (OLE) Automation server Process created: C:\Users\u ser\Deskto p\pumpkin- 2.7.3.exe 'C:\Users\ user\Deskt op\pumpkin -2.7.3.exe ' /load Process created: C:\Users\u ser\Deskto p\pumpkin- 2.7.3.exe 'C:\Users\ user\Deskt op\pumpkin -2.7.3.exe ' /install Process created: C:\Users\u ser\Deskto p\pumpkin- 2.7.3.exe 'C:\Users\ user\Deskt op\pumpkin -2.7.3.exe ' -install Sample requires command line parameters (based on API chain)Įvasive API call chain: GetCommand Line,Decis ionNodes,E xitProcess Key opened: HKEY_CURRE NT_USER\So ftware\Pol icies\Micr osoft\Wind ows\Safer\ CodeIdenti fiers text IMAGE _SCN_MEM_E XECUTE, IM AGE_SCN_CN T_CODE, IM AGE_SCN_ME M_READ text section and no other executable section 3.exeĬontains functionality to instantiate COM classesĬode function: 0_2_004016 E0 CoCreat eInstance, MultiByteT oWideChar,Ĭontains functionality to load and extract PE file embedded resourcesĬode function: 0_2_00401B E0 GetTemp PathA,GetT empFileNam eA,FindRes ourceA,Siz eofResourc e,LoadReso urce,LockR esource,Cr eateFileA, WriteFile, CloseHandl e,VerInsta llFileA,De leteFileA, DeleteFile A,CloseHan dle,Ĭreates files inside the program directoryįile created: C:\Program Files\Kle ver\Nothin gs\temp.00 0įile created: C:\Users\u ser\AppDat a\Roaming\ Microsoft\ Windows\St art Menu\P rograms\Kl ever Groupįile created: C:\Users\u ser\AppDat a\Local\Te mp\KGI4663. Sample file is different than original file name gathered from version info
Static PE information: Resource n ame: RT_IC ON type: G LS_BINARY_ LSB_FIRST
#Tg pro 2.7.3 archive#
Static PE information: Resource n ame: RT_RC DATA type: MS Compre ss archive data PE file contains executable resources (Code or Archives) Source: C:\Users\u ser\Deskto p\pumpkin- 2.7.3.exe
0 kommentar(er)
