6ee78b18ddb57ebb710f371d9c01b743fc7fb080527360a56d9981c56cdffffb

Analysis

max time kernel
82s
max time network
78s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com].rar
Size

132.8MB
MD5

d797b7c39ac75189a3c91ee9f9018c05
SHA1

8f038be7ab3560d371448b4b88406ad01a2be38e
SHA256

6ee78b18ddb57ebb710f371d9c01b743fc7fb080527360a56d9981c56cdffffb
SHA512

9b3c43b28218ff01835c2ff515b4537f29d10bcd0a038ba85e3f57493b811a96e43e306b49e50ec80254f925ab100c915abb9507a1b829cf37f381e0993ddf3e
SSDEEP

3145728:gacSDhTHOPKpYT7C/CBExbffVB55yTPdlDTrxs0ngF:rHFTcmYwfv7yT/DTrxsY8

Score

7^/10

discovery link pdf

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

paperscanpro4.exePaperScan.Launcher.exePaperScan.ListDS32.exePaperScan64.exe

pid process

2856 paperscanpro4.exe
1144 PaperScan.Launcher.exe
2608 PaperScan.ListDS32.exe
992 PaperScan64.exe

pid	process
2856	paperscanpro4.exe
1144	PaperScan.Launcher.exe
2608	PaperScan.ListDS32.exe
992	PaperScan64.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exe

pid	process
1588	MsiExec.exe
1588	MsiExec.exe
1588	MsiExec.exe
1020	MsiExec.exe
1020	MsiExec.exe
1020	MsiExec.exe
1020	MsiExec.exe
1020	MsiExec.exe
1020	MsiExec.exe
1020	MsiExec.exe
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
2352	MsiExec.exe
2352	MsiExec.exe
2352	MsiExec.exe
2352	MsiExec.exe
2812	MsiExec.exe
2352	MsiExec.exe
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184
1184

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exepaperscanpro4.exe

description	ioc	process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	paperscanpro4.exe
File opened (read-only)	\??\S:	paperscanpro4.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	paperscanpro4.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	paperscanpro4.exe
File opened (read-only)	\??\X:	paperscanpro4.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	paperscanpro4.exe
File opened (read-only)	\??\K:	paperscanpro4.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	paperscanpro4.exe
File opened (read-only)	\??\U:	paperscanpro4.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	paperscanpro4.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	paperscanpro4.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	paperscanpro4.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	paperscanpro4.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	paperscanpro4.exe
File opened (read-only)	\??\T:	paperscanpro4.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	paperscanpro4.exe
File opened (read-only)	\??\M:	paperscanpro4.exe
File opened (read-only)	\??\Z:	paperscanpro4.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	paperscanpro4.exe
File opened (read-only)	\??\W:	paperscanpro4.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 1 IoCs

Processes:

msiexec.exe

description ioc process

File created C:\Windows\SysWOW64\TWAINDSM.dll msiexec.exe

description	ioc	process
File created	C:\Windows\SysWOW64\TWAINDSM.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.RichEdit.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.exe	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.TreeMap.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.XtraCharts.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.XtraReports.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.XtraTreeList.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\GdPicture.NET.14.Imaging.Rendering.Skia.64.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\GdPicture.NET.14.image.gdimgplug.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\GdPicture.NET.14.barcode.2d.reader.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Charts.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Dashboard.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.DataAccess.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Utils.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.XtraBars.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\GdPicture.NET.14.filters.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\GdPicture.NET.14.machine.vision.64.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.XtraPrinting.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\ocr\spa.traineddata	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Data.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.ListDS32.exe	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\BouncyCastle.Crypto.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\GdPicture.NET.14.Imaging.ML.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Xpo.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.XtraScheduler.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\GdPicture.NET.14.twain.client.64.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\ocr\fra.traineddata	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.BonusSkins.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Printing.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\Aquaforest.SharePoint.XmlSerializers.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.Launcher.exe	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Pdf.v21.2.Drawing.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\Microsoft.IdentityModel.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\ocr\por.traineddata	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Office.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Pdf.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Sparkline.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.XtraScheduler.v21.2.Core.Desktop.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\Aquaforest.SharePoint.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.Launcher.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.PivotGrid.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\SharePointPnP.IdentityModel.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\GdPicture.NET.14.twain.client.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\Microsoft.SharePoint.Client.Runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan64.exe	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\ocr\deu.traineddata	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\GdPicture.NET.14.Imaging.ML.64.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\GdPicture.NET.14.Imaging.Rendering.Skia.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\Aquaforest.SharePoint.VMRuntime.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\ocr\digits.gdpictureml	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\ocr\sp1.traineddata	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Data.Desktop.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.XtraGauges.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.XtraTreeMap.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\Orpalis.Globals.Localization.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\TWAIN\64-bit\TWAINDSM.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\ocr\eng.traineddata	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.CodeParser.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.DataVisualization.v21.2.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.Images.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.XtraLayout.v21.2.dll	msiexec.exe
File created	C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\DevExpress.XtraNavBar.v21.2.dll	msiexec.exe

Drops file in Windows directory 21 IoCs

Processes:

DrvInst.exemsiexec.exePaperScan64.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f769212.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI92C0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{DCA57FF1-BCCC-4D1F-9483-E15284FF14CA}\PSicon_1.exe	msiexec.exe
File created	C:\Windows\Installer\{DCA57FF1-BCCC-4D1F-9483-E15284FF14CA}\PSicon.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI935D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA78B.tmp	msiexec.exe
File created	C:\Windows\Installer\{DCA57FF1-BCCC-4D1F-9483-E15284FF14CA}\PSicon_1.exe	msiexec.exe
File created	C:\Windows\Installer\f769213.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA77B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{DCA57FF1-BCCC-4D1F-9483-E15284FF14CA}\PSicon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF6B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f769212.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9DE.tmp	msiexec.exe
File created	C:\Windows\Installer\f769215.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f769213.ipi	msiexec.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	PaperScan64.exe

HTTP links in PDF interactive object 2 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

Processes:

resource	yara_rule
\Users\Admin\Desktop\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\Crack\PaperScan64.exe	pdf_with_link_action
C:\Users\Admin\AppData\Roaming\ORPALIS\PaperScan 4 Professional Edition 4.0.9\install\4FF14CA\PaperScan.exe	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C31AA951-001E-11EF-9EA5-C6F68EB94A83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 50 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\jbig2 = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\pdf = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\ppt = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\tiff = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\PackageCode = "3BDF8E52192268D4F82D21B5C106C877"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\Version = "67108873"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\xls = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\ProductIcon = "C:\\Windows\\Installer\\{DCA57FF1-BCCC-4D1F-9483-E15284FF14CA}\\PSicon_1.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DA7884EF5835A7C45B44BEB0D89F420F\1FF75ACDCCCBF1D449381E2548FF41AC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\doc = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\FileTypeAssociations = "AIOtherFiles"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\ORPALIS\\PaperScan 4 Professional Edition 4.0.9\\install\\4FF14CA\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\html = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\png = "\x06FileTypeAssociations"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DA7884EF5835A7C45B44BEB0D89F420F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\AIOtherFiles	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\gif = "\x06FileTypeAssociations"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\ORPALIS\\PaperScan 4 Professional Edition 4.0.9\\install\\4FF14CA\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\odt = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\ico = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\jpeg = "\x06FileTypeAssociations"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\bmp = "\x06FileTypeAssociations"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\SourceList\PackageName = "PaperScanPro-4.0.9.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\txt = "\x06FileTypeAssociations"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\htm = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\rtf = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\ProductName = "PaperScan 4 Professional Edition"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\jpg = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\pptx = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\tif = "\x06FileTypeAssociations"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\jb2 = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\jp2 = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\svg = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\xlsx = "\x06FileTypeAssociations"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1FF75ACDCCCBF1D449381E2548FF41AC\docx = "\x06FileTypeAssociations"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1FF75ACDCCCBF1D449381E2548FF41AC\SourceList	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

PaperScan64.exepaperscanpro4.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee419000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	PaperScan64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	paperscanpro4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	paperscanpro4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	paperscanpro4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	paperscanpro4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	PaperScan64.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msiexec.exePaperScan.Launcher.exePaperScan.ListDS32.exePaperScan64.exe

pid	process
1428	msiexec.exe
1428	msiexec.exe
1144	PaperScan.Launcher.exe
1144	PaperScan.Launcher.exe
1144	PaperScan.Launcher.exe
2608	PaperScan.ListDS32.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exePaperScan64.exe

pid process

2536 7zFM.exe
992 PaperScan64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exemsiexec.exepaperscanpro4.exe

description	pid	process
Token: SeRestorePrivilege	2536	7zFM.exe
Token: 35	2536	7zFM.exe
Token: SeSecurityPrivilege	2536	7zFM.exe
Token: SeRestorePrivilege	1428	msiexec.exe
Token: SeTakeOwnershipPrivilege	1428	msiexec.exe
Token: SeSecurityPrivilege	1428	msiexec.exe
Token: SeCreateTokenPrivilege	2856	paperscanpro4.exe
Token: SeAssignPrimaryTokenPrivilege	2856	paperscanpro4.exe
Token: SeLockMemoryPrivilege	2856	paperscanpro4.exe
Token: SeIncreaseQuotaPrivilege	2856	paperscanpro4.exe
Token: SeMachineAccountPrivilege	2856	paperscanpro4.exe
Token: SeTcbPrivilege	2856	paperscanpro4.exe
Token: SeSecurityPrivilege	2856	paperscanpro4.exe
Token: SeTakeOwnershipPrivilege	2856	paperscanpro4.exe
Token: SeLoadDriverPrivilege	2856	paperscanpro4.exe
Token: SeSystemProfilePrivilege	2856	paperscanpro4.exe
Token: SeSystemtimePrivilege	2856	paperscanpro4.exe
Token: SeProfSingleProcessPrivilege	2856	paperscanpro4.exe
Token: SeIncBasePriorityPrivilege	2856	paperscanpro4.exe
Token: SeCreatePagefilePrivilege	2856	paperscanpro4.exe
Token: SeCreatePermanentPrivilege	2856	paperscanpro4.exe
Token: SeBackupPrivilege	2856	paperscanpro4.exe
Token: SeRestorePrivilege	2856	paperscanpro4.exe
Token: SeShutdownPrivilege	2856	paperscanpro4.exe
Token: SeDebugPrivilege	2856	paperscanpro4.exe
Token: SeAuditPrivilege	2856	paperscanpro4.exe
Token: SeSystemEnvironmentPrivilege	2856	paperscanpro4.exe
Token: SeChangeNotifyPrivilege	2856	paperscanpro4.exe
Token: SeRemoteShutdownPrivilege	2856	paperscanpro4.exe
Token: SeUndockPrivilege	2856	paperscanpro4.exe
Token: SeSyncAgentPrivilege	2856	paperscanpro4.exe
Token: SeEnableDelegationPrivilege	2856	paperscanpro4.exe
Token: SeManageVolumePrivilege	2856	paperscanpro4.exe
Token: SeImpersonatePrivilege	2856	paperscanpro4.exe
Token: SeCreateGlobalPrivilege	2856	paperscanpro4.exe
Token: SeCreateTokenPrivilege	2856	paperscanpro4.exe
Token: SeAssignPrimaryTokenPrivilege	2856	paperscanpro4.exe
Token: SeLockMemoryPrivilege	2856	paperscanpro4.exe
Token: SeIncreaseQuotaPrivilege	2856	paperscanpro4.exe
Token: SeMachineAccountPrivilege	2856	paperscanpro4.exe
Token: SeTcbPrivilege	2856	paperscanpro4.exe
Token: SeSecurityPrivilege	2856	paperscanpro4.exe
Token: SeTakeOwnershipPrivilege	2856	paperscanpro4.exe
Token: SeLoadDriverPrivilege	2856	paperscanpro4.exe
Token: SeSystemProfilePrivilege	2856	paperscanpro4.exe
Token: SeSystemtimePrivilege	2856	paperscanpro4.exe
Token: SeProfSingleProcessPrivilege	2856	paperscanpro4.exe
Token: SeIncBasePriorityPrivilege	2856	paperscanpro4.exe
Token: SeCreatePagefilePrivilege	2856	paperscanpro4.exe
Token: SeCreatePermanentPrivilege	2856	paperscanpro4.exe
Token: SeBackupPrivilege	2856	paperscanpro4.exe
Token: SeRestorePrivilege	2856	paperscanpro4.exe
Token: SeShutdownPrivilege	2856	paperscanpro4.exe
Token: SeDebugPrivilege	2856	paperscanpro4.exe
Token: SeAuditPrivilege	2856	paperscanpro4.exe
Token: SeSystemEnvironmentPrivilege	2856	paperscanpro4.exe
Token: SeChangeNotifyPrivilege	2856	paperscanpro4.exe
Token: SeRemoteShutdownPrivilege	2856	paperscanpro4.exe
Token: SeUndockPrivilege	2856	paperscanpro4.exe
Token: SeSyncAgentPrivilege	2856	paperscanpro4.exe
Token: SeEnableDelegationPrivilege	2856	paperscanpro4.exe
Token: SeManageVolumePrivilege	2856	paperscanpro4.exe
Token: SeImpersonatePrivilege	2856	paperscanpro4.exe
Token: SeCreateGlobalPrivilege	2856	paperscanpro4.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

7zFM.exepaperscanpro4.exemsiexec.exeiexplore.exePaperScan64.exe

pid	process
2536	7zFM.exe
2536	7zFM.exe
2536	7zFM.exe
2856	paperscanpro4.exe
2040	msiexec.exe
2040	msiexec.exe
2348	iexplore.exe
2348	iexplore.exe
2348	iexplore.exe
2040	msiexec.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

iexplore.exePaperScan64.exe

pid process

2348 iexplore.exe
992 PaperScan64.exe
992 PaperScan64.exe
992 PaperScan64.exe
992 PaperScan64.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

iexplore.exeIEXPLORE.EXEPaperScan64.exe

pid	process
2348	iexplore.exe
2348	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2348	iexplore.exe
2348	iexplore.exe
2348	iexplore.exe
2348	iexplore.exe
2348	iexplore.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe
992	PaperScan64.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

cmd.exemsiexec.exepaperscanpro4.exeMsiExec.exeiexplore.exePaperScan.Launcher.exe

description	pid	process	target process
PID 2700 wrote to memory of 2536	2700	cmd.exe	7zFM.exe
PID 2700 wrote to memory of 2536	2700	cmd.exe	7zFM.exe
PID 2700 wrote to memory of 2536	2700	cmd.exe	7zFM.exe
PID 1428 wrote to memory of 1588	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1588	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1588	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1588	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1588	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1588	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1588	1428	msiexec.exe	MsiExec.exe
PID 2856 wrote to memory of 2040	2856	paperscanpro4.exe	msiexec.exe
PID 2856 wrote to memory of 2040	2856	paperscanpro4.exe	msiexec.exe
PID 2856 wrote to memory of 2040	2856	paperscanpro4.exe	msiexec.exe
PID 2856 wrote to memory of 2040	2856	paperscanpro4.exe	msiexec.exe
PID 2856 wrote to memory of 2040	2856	paperscanpro4.exe	msiexec.exe
PID 2856 wrote to memory of 2040	2856	paperscanpro4.exe	msiexec.exe
PID 2856 wrote to memory of 2040	2856	paperscanpro4.exe	msiexec.exe
PID 1428 wrote to memory of 1020	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1020	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1020	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1020	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1020	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1020	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 1020	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2352	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2352	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2352	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2352	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2352	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2352	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2352	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2812	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2812	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2812	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2812	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2812	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2812	1428	msiexec.exe	MsiExec.exe
PID 1428 wrote to memory of 2812	1428	msiexec.exe	MsiExec.exe
PID 2352 wrote to memory of 2348	2352	MsiExec.exe	iexplore.exe
PID 2352 wrote to memory of 2348	2352	MsiExec.exe	iexplore.exe
PID 2352 wrote to memory of 2348	2352	MsiExec.exe	iexplore.exe
PID 2352 wrote to memory of 2348	2352	MsiExec.exe	iexplore.exe
PID 2348 wrote to memory of 2552	2348	iexplore.exe	IEXPLORE.EXE
PID 2348 wrote to memory of 2552	2348	iexplore.exe	IEXPLORE.EXE
PID 2348 wrote to memory of 2552	2348	iexplore.exe	IEXPLORE.EXE
PID 2348 wrote to memory of 2552	2348	iexplore.exe	IEXPLORE.EXE
PID 1144 wrote to memory of 2608	1144	PaperScan.Launcher.exe	PaperScan.ListDS32.exe
PID 1144 wrote to memory of 2608	1144	PaperScan.Launcher.exe	PaperScan.ListDS32.exe
PID 1144 wrote to memory of 2608	1144	PaperScan.Launcher.exe	PaperScan.ListDS32.exe
PID 1144 wrote to memory of 2608	1144	PaperScan.Launcher.exe	PaperScan.ListDS32.exe
PID 1144 wrote to memory of 992	1144	PaperScan.Launcher.exe	PaperScan64.exe
PID 1144 wrote to memory of 992	1144	PaperScan.Launcher.exe	PaperScan64.exe
PID 1144 wrote to memory of 992	1144	PaperScan.Launcher.exe	PaperScan64.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com].rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com].rar"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2536

C:\Users\Admin\Desktop\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\paperscanpro4.exe
"C:\Users\Admin\Desktop\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\paperscanpro4.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\ORPALIS\PaperScan 4 Professional Edition 4.0.9\install\4FF14CA\PaperScanPro-4.0.9.msi" AI_SETUPEXEPATH="C:\Users\Admin\Desktop\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\paperscanpro4.exe" SETUPEXEDIR="C:\Users\Admin\Desktop\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1713472323 " AI_FOUND_PREREQS=".NET Framework 4.7.2 (web installer)"
2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:2040

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E9BADC7DF85ED0F371328546565FF171 C
2⤵
- Loads dropped DLL
PID:1588

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B18AD086ADC0B22754B2FB18CF853DAA C
2⤵
- Loads dropped DLL
PID:1020

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 331B89690E27C3C4472495DDFCF56C4D
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.orpalis.com/installation/thank-you-for-installing-paperscan-pro.php
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1CDFCA5C2FC1DE2E052791906E69E481 M Global\MSI0000
2⤵
- Loads dropped DLL
PID:2812

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2900

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000057C" "00000000000003A0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1944

C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.Launcher.exe
"C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1144

C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.ListDS32.exe
"PaperScan.ListDS32.exe" C:\Users\Admin\AppData\Local\Temp\tmp1299.tmp
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2608

C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan64.exe
"C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan64.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f769214.rbs
Filesize
974KB

MD5
ced30ef05d2de8f875652c05a7d67025

SHA1
830097c23eae8b17bd0a481a2a77735c725edc9e

SHA256
87ca5a7a24899be03af4a5aaf31e1d071d47c0431cb3c8835926bb4e9a68773f

SHA512
6c4788eb9f08bed8725fc79b28e2b135b39348e03fc0888f52c419c19e48078202cdb6d56db09f9a9f54387ee478f2b68c4abeee3de4d6f972bb5a647097825d

Download Submit
C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.Launcher.exe
Filesize
226KB

MD5
da561f44e405d74027797185e4600878

SHA1
58904d39c1d66baecc467c255d0ed30165751b65

SHA256
008350d55afdffaabfde80037d74dc5d1967cde85d0e6970fba5378a2440606e

SHA512
db9360b652342c09552e371e68251f96d5ea33f1fb2fe79e2d773a4fb93a1b7ccca807041a684b40ce2100925866cfb3f4e1148ded63b748897884d970295a9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize
471B

MD5
eeece5e919a33d267b92b22e8c2e08e3

SHA1
5ab76b001333e3999c3d1c7dd928c9940bfed114

SHA256
1e3ca69a2e6ee930e91c55183acc8001f0390f56870660482a67b6d928c827af

SHA512
4052591db3f8243da47915192caf029ab08534bb9bdd0ba90de344fd81db284c8d5c3e8e2100320b52bf5fb4c8cfa0b14be3cef1fcdfb693ef8865b7bd77fc9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A360CD1C7D600F0FA52FD1B49B3E1637
Filesize
727B

MD5
eee4c7065430328a936943b8a4cc64c1

SHA1
8d965baa8203acf507dc01147ccf011ad65fadf3

SHA256
d6c086aaba2ac573829148dbceff5a0c290b74ea7722c07dff03d412b62853da

SHA512
6569255a29a42256ef099b2ee98cb1481803ea9d1669daf0cf4e00569b5cc8fe70c4eadb183dc43bfa1304d562a97e8286d97ee2f9d4c67d65dba4cbe2a9ae0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize
727B

MD5
cc6848d9ac77e31dfeadf8c1ab347bd7

SHA1
6bbab79a405666cb63f2e321330e10f4fabca6b4

SHA256
1bfe4a31c943532b6f000d26e721022f250f5555ef2f0bf12605c35ec606a338

SHA512
74214efdbe65e264e9b63506b4d74fd520d7322f03153a6f50dbf4236b36848fdd5b1b42431c600e8c75e4119c912b10a9a0d213043aa7102177ac95134d5966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize
400B

MD5
c63a3bb1117626bfb77c672a441ae665

SHA1
9ffea9f88e0e70cbafc2bea6caddb06bb5fe51ba

SHA256
5267cf363fe48afdc382a473360ffea2b4a589aa2c81dacbeb1a29b8dca369d4

SHA512
b3ae2992ba2d81a58bc2df6d2e45edd427b776356bf6d12eb3c3cc38c48be5b6aed3ce65199802d438c4e7709942d5e6b52443ef3f9d065bda3be3a675c145d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A360CD1C7D600F0FA52FD1B49B3E1637
Filesize
408B

MD5
b1bc4750a26ff027e8eff5d81cae7318

SHA1
240a45ec767553b65460df911782b84263e695a6

SHA256
9bda404dcf13f2749aec5be50733af3df01752f9ebd5321f29a7090c811cac2f

SHA512
47fcb11b860933d75f6e5346b5e8141908769c074f4b69d5e344b134534b9a19401aba4a01cc98b3637d91f3502979d726b04632d1b3149d5b2c94607fb6b2fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
22592e5487ed5c1e0bcbdd8df6aa17a3

SHA1
50267dfc43ea62d3b4c7f6307c91c71ceabb3027

SHA256
f72439dba27011b733efcddaa7dc340b0de92e260b99d55f616610bc513e1514

SHA512
42da89ed6e16b7c1a76b6da1a4d14a5ae0d716f71cfea2c7ecd5731bc8da4ac83b38d3abad1c2339a2743c8327a79133b51609eb919d6be5bab7478d9a6b9ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
2a37d38862eb423c0d8a602ea869b2dc

SHA1
a3f1c47226dc5c34477451a79edd8def52f68af0

SHA256
ad3cfc2e5b512d3c538597d5271a75eea1d36c4b48266656ef33265298b80f22

SHA512
18ff1861fc2d0d2a08d1af101db92292ade5c739a6568774ba5d3faae5601eead14a5e3a184d25e738f5c69b29ca366e75417e88ca5bf8a8ffa8557af104d4cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize
412B

MD5
13d5adfabe8e1c9faf91c73786f77dac

SHA1
ea0c1117fdc6870568c93b44cff4ee27b8cb3d39

SHA256
e28d02c7fd33bb84a058a14c8f2fe8aa1677a0b772970cad9df3207dd7298823

SHA512
3ec1b44b1a877cf70b1a7f871e0e4b301d8756b6057c2f2ba9570eebbea616088e823339cf4eed003459325c3b068b0785516c109ee7b7294286ced4ca5be9ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2856\welcome.jpg
Filesize
14KB

MD5
a19eb2269d8449012cf8cf3693e9698a

SHA1
7be34d8186407ede94e068874417ddaf3bf3012e

SHA256
478f1e9f4cbcbc6062e3a609362a60e8c78e38507e60ba5a6b9db7d219e66a14

SHA512
86d71a7087d8597b06d822dab99d9cad5208fff612fa20c95db2ee712be61003d40a494dfe6c3836627592a9963d5729bc5ce4d7b4bbeb24fa6b613bf0d6631e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab59F4.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5C1B.tmp
Filesize
1.1MB

MD5
afc6287898cc2f4e11e7ecca5ba67979

SHA1
00417961dd06817ad989aff7d6832f854a4e81b8

SHA256
65449b7ef921a26b22c2f5ba6bb8d22ced0a337313587c805bb165808346c402

SHA512
11bf538fd8c9330d6554e06e65b094aac27c657a0450ee6dd0891fb35644505d65e968395902b1d115f64d8c9a30f3d81e3db301705d82c084f7b028b8bd616c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B20.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB6E8.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\ORPALIS\PaperScan 4 Professional Edition 4.0.9\install\4FF14CA\GdPicture.NET.14.Imaging.Rendering.Skia.dll
Filesize
3.9MB

MD5
5d4fde4c707c1a2dd7e3c05a52f297fe

SHA1
a5a1da3bc4ae26338c327e985f9434afb55cbbb2

SHA256
db0f654c478f575534f1e94ecda41f53611024b4191517f28f8793478f0cf382

SHA512
e0df43f49c28a8a607ba1b3c13bcec95a368c4fce1e15f6ebb902b1ec49d83a537acc66f170f74fd6c6114a5c72fbd4bcb67c4e35a1b42dce4f9a6783f3d7952

Download Submit
C:\Users\Admin\AppData\Roaming\ORPALIS\PaperScan 4 Professional Edition 4.0.9\install\4FF14CA\GdPicture.NET.14.dll
Filesize
34.3MB

MD5
eb67c95518bfadbac8fd0a246380f92a

SHA1
619d5f83953577a35bd66c73ff9f4c0f49177e8b

SHA256
2f849f1686a825f454fcc66a793b8d12c00d5c786215a63a69ba66889a3bf79f

SHA512
2ce122a8ca5e10d9ce03fce0cd949dacac4f7c85d0647753627e47ed00bf0035d11f941ea5f10b8744afe29fa37dac9395dbb4d61889ef7098fab39f107eac08

Download Submit
C:\Users\Admin\AppData\Roaming\ORPALIS\PaperScan 4 Professional Edition 4.0.9\install\4FF14CA\GdPicture.NET.14.filters.dll
Filesize
1.5MB

MD5
144831edb0592e611527872a5abae5b2

SHA1
17d5a5a09b1c7be14ba1828f132e37453c54ed10

SHA256
d01d274aa064cb61d0ef707eb5a9a197d58117b6c6248a5dca0c5d18576f471e

SHA512
e8cf3e4a1a5f4749e450ae0b0780c0201d09367a57b42f186e22ba5ecd67dd52b7a008fd4cd4324904ddc452e2f499558e7b7f4c24a4cebeeb5ce2031ae5ebf3

Download Submit
C:\Users\Admin\AppData\Roaming\ORPALIS\PaperScan 4 Professional Edition 4.0.9\install\4FF14CA\GdPicture.NET.14.image.gdimgplug.dll
Filesize
13.7MB

MD5
cc9e341b51458c734f55e42a2dd9a504

SHA1
b8a46495187d9efe48bb936086e74e214486d668

SHA256
e25fb88568d774dada22f50c62a5a0372cc744c519fb0b58fe4ef18fd8e4e480

SHA512
bf8f31ddf3e286cffe96f52dcd8c7c2acc0c8708e6f5e70fa535c8eb0abe111a568e20fb957bf93426bad7d40b404b8679a1591ce30b8cf6583ba2952afaec94

Download Submit
C:\Users\Admin\AppData\Roaming\ORPALIS\PaperScan 4 Professional Edition 4.0.9\install\4FF14CA\GdPicture.NET.14.twain.client.dll
Filesize
196KB

MD5
96c3d670b8428a5e122daee0661e393c

SHA1
d4ea2ae807f154ba59351ca602525a00313c8553

SHA256
4db27638b60a044a046a68b7f0604496e3a6a732acaa33273461e2daf22f504f

SHA512
da7d2a82b6b73b7623529e1014bee50a68bbb59c30cfba2e4af6b4b98d03a376545193af45ce5ce007b3c8538cf9237b10fcdb304fb5262a81f8c31a458460f3

Download Submit
C:\Users\Admin\AppData\Roaming\ORPALIS\PaperScan 4 Professional Edition 4.0.9\install\4FF14CA\PaperScan.exe
Filesize
10.0MB

MD5
4b68c037cc603b7f9c8683d71db0306f

SHA1
323d734e483bc8ef28599c018a1f737f7030da4b

SHA256
6961b960b5eb6f96adbf6d21c1b2c466f5f5fd017bf92399aa93175c69eb8b55

SHA512
47d8a07f191b7b2d930307232c71869134a09c07ac5f1ce8d33a23c185393bd578a62a42af462466c0f03932ab35be421c2aa04976ce748d4797d5eb66074e9c

Download Submit
C:\Users\Admin\AppData\Roaming\ORPALIS\PaperScan 4 Professional Edition 4.0.9\install\4FF14CA\PaperScanPro-4.0.9.msi
Filesize
3.7MB

MD5
91feee7a5212ab8244ab5915a443d92d

SHA1
243c5f38314a4fb8c8412868bb131853929d95bf

SHA256
a59241ac480779e9e3d09cb5952ee2bf26daf9277714751442f257c0d1ca1a80

SHA512
e4367b4e922c443c652767b45ad4bf82fefded07b78c2a891f382b2d3ad3a49aa834e8a35816e87d52cf3dc805e403aa346810d71acd2820f17b3c65baf4fe49

Download Submit
C:\Users\Admin\Desktop\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\paperscanpro4.exe
Filesize
124.9MB

MD5
d964449be90f3d1eabcd4bd4e0f1687b

SHA1
1f58c435655108220a656066933ce05de5a18f64

SHA256
93ec1818f17060773929f735d16343edeb9fab83b35d01f6ae4473c979d33443

SHA512
7a223efd9be3ac244065e387078bfc90704c2bf5665b14a8d9b1a90755f3f56759df88b36e1f9ca85b849728a9eddf48e9e15adf8a2044131a269de25b49dde4

Download Submit
C:\Windows\Installer\MSIA78B.tmp
Filesize
923KB

MD5
89e5a0ebcdd5c5c5814462e71b9323e3

SHA1
d9e42e5c33ef6427df4cb966795d94492ae9fe2a

SHA256
18476652e953d5d87067f0e2c84918ff3bae5cda8101d8f395b0c47cfc6c8b22

SHA512
3dafc2a64a8e5e15030fca32d23f7059a41f371b086ec953815a5c51c122d06630d9ed5b0ce8085580e147181127879aa0e4ff37575a87a110ecd3d92911cdcf

Download Submit
C:\Windows\SysWOW64\TWAINDSM.dll
Filesize
169KB

MD5
b3d8bbe5cbf99ecb80e5bedc878c1ce1

SHA1
8b07b48a97bf711109a6546225fce3471a9d9598

SHA256
16539e1e876ffb67d516611afb780cf6d993c4742efc8443f1b925f12ecaa6ae

SHA512
59b02e868dec40eaf0daeff663e3b753fd4786a532f4dface440f956172c2cac9b60bf4f51d2f4e11b5b83135cf7baa209a26b09ef1dda71e214829003d6cf75

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5B9E.tmp
Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI5CC8.tmp
Filesize
709KB

MD5
130a4e28b3349aff8a444f6fcebbac91

SHA1
fee5efe0a1b9aea337e607f417bb091c3017537b

SHA256
750bf3e65d692ff255620c5b8d7c951d93d3deb65586ebb5a3e3b7ba2de10e39

SHA512
1564306e22db0000a78076e6811f0e4f9ca31c7fea95e1070a6ce422c408863810a2f55376b8db1aec2512e23d926d5d61ac280d4babc31c52dd645440ef510a

Download Submit
\Users\Admin\Desktop\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\Crack\PaperScan64.exe
Filesize
9.4MB

MD5
f844081c212986712286ba7e7acc3d62

SHA1
da92a97e8de3ba0769200165d1e6742297391bea

SHA256
26106e3622caefcb06b7b0409637ed01959612b459aa9e369b0be9b76e362c91

SHA512
c6456c4db37428a383d5c0875f44bcfd28d87ec7299b3e02843790a93b51780aeb539a01cbf301fdebd643c11fe1b304736c863fc037a6865c7f14d0eb6a4e4e

Download Submit
memory/992-581-0x00000000090B0000-0x000000000A272000-memory.dmp

Filesize
17.8MB

Download
memory/992-590-0x00000000007F0000-0x0000000000870000-memory.dmp

Filesize
512KB

Download
memory/992-611-0x000007FEF4A80000-0x000007FEF546C000-memory.dmp

Filesize
9.9MB

Download
memory/992-601-0x000007FEF1F20000-0x000007FEF1F6C000-memory.dmp

Filesize
304KB

Download
memory/992-600-0x000000000F990000-0x000000000F9D1000-memory.dmp

Filesize
260KB

Download
memory/992-597-0x0000000007370000-0x0000000007378000-memory.dmp

Filesize
32KB

Download
memory/992-596-0x000000000F590000-0x000000000F640000-memory.dmp

Filesize
704KB

Download
memory/992-595-0x0000000006850000-0x0000000006858000-memory.dmp

Filesize
32KB

Download
memory/992-594-0x0000000006210000-0x0000000006218000-memory.dmp

Filesize
32KB

Download
memory/992-593-0x0000000006200000-0x0000000006208000-memory.dmp

Filesize
32KB

Download
memory/992-592-0x00000000061F0000-0x00000000061F8000-memory.dmp

Filesize
32KB

Download
memory/992-591-0x00000000061E0000-0x00000000061EA000-memory.dmp

Filesize
40KB

Download
memory/992-589-0x00000000023F0000-0x0000000002429000-memory.dmp

Filesize
228KB

Download
memory/992-587-0x00000000021C0000-0x00000000021C8000-memory.dmp

Filesize
32KB

Download
memory/992-588-0x00000000007F0000-0x0000000000870000-memory.dmp

Filesize
512KB

Download
memory/992-586-0x00000000021A0000-0x00000000021BA000-memory.dmp

Filesize
104KB

Download
memory/992-585-0x0000000006030000-0x00000000060DE000-memory.dmp

Filesize
696KB

Download
memory/992-584-0x000000000CE70000-0x000000000E406000-memory.dmp

Filesize
21.6MB

Download
memory/992-583-0x000000000AC10000-0x000000000CE66000-memory.dmp

Filesize
34.3MB

Download
memory/992-582-0x000000000A480000-0x000000000AC08000-memory.dmp

Filesize
7.5MB

Download
memory/992-580-0x00000000007F0000-0x0000000000870000-memory.dmp

Filesize
512KB

Download
memory/992-579-0x0000000008280000-0x00000000087A0000-memory.dmp

Filesize
5.1MB

Download
memory/992-578-0x0000000006C60000-0x00000000072DC000-memory.dmp

Filesize
6.5MB

Download
memory/992-576-0x000000003F050000-0x000000003F9BC000-memory.dmp

Filesize
9.4MB

Download
memory/992-577-0x000007FEF4A80000-0x000007FEF546C000-memory.dmp

Filesize
9.9MB

Download
memory/1144-548-0x000000001E090000-0x000000001F252000-memory.dmp

Filesize
17.8MB

Download
memory/1144-566-0x000000001A900000-0x000000001A939000-memory.dmp

Filesize
228KB

Download
memory/1144-602-0x000007FEF4A80000-0x000007FEF546C000-memory.dmp

Filesize
9.9MB

Download
memory/1144-545-0x000007FEF4A80000-0x000007FEF546C000-memory.dmp

Filesize
9.9MB

Download
memory/1144-546-0x000000001AE50000-0x000000001D0A6000-memory.dmp

Filesize
34.3MB

Download
memory/1144-547-0x000000001D900000-0x000000001E088000-memory.dmp

Filesize
7.5MB

Download
memory/1144-544-0x0000000001210000-0x000000000124C000-memory.dmp

Filesize
240KB

Download
memory/1144-549-0x000000001F260000-0x000000001F780000-memory.dmp

Filesize
5.1MB

Download
memory/1144-560-0x000000001FE70000-0x000000001FEF0000-memory.dmp

Filesize
512KB

Download
memory/1144-565-0x0000000000B30000-0x0000000000B38000-memory.dmp

Filesize
32KB

Download
memory/1144-564-0x0000000000B60000-0x0000000000B7A000-memory.dmp

Filesize
104KB

Download
memory/1144-563-0x000000001FE70000-0x000000001FEF0000-memory.dmp

Filesize
512KB

Download
memory/1144-550-0x000000001A850000-0x000000001A900000-memory.dmp

Filesize
704KB

Download
memory/1144-562-0x000000001FE70000-0x000000001FEF0000-memory.dmp

Filesize
512KB

Download
memory/1144-561-0x000000001FB80000-0x000000001FC2E000-memory.dmp

Filesize
696KB

Download
memory/2608-568-0x000000006FE60000-0x000000007054E000-memory.dmp

Filesize
6.9MB

Download
memory/2608-567-0x00000000008C0000-0x00000000008C8000-memory.dmp

Filesize
32KB

Download
memory/2608-575-0x000000006FE60000-0x000000007054E000-memory.dmp

Filesize
6.9MB

Download
memory/2608-569-0x0000000004780000-0x00000000069D6000-memory.dmp

Filesize
34.3MB

Download
memory/2608-570-0x0000000000690000-0x00000000006AA000-memory.dmp

Filesize
104KB

Download
memory/2608-571-0x0000000000890000-0x0000000000898000-memory.dmp

Filesize
32KB

Download
memory/2608-572-0x00000000020D0000-0x00000000020FB000-memory.dmp

Filesize
172KB

Download
memory/2856-420-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2856-34-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download