24b689b005eff7b68709078852fe6ca24be46a6cf328891267441e6ce5b3918d

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bigImgPin_0.2.0_x64_en-US.msi
Size 20.2MB
Sample261102-a6cehs1x7p
SHA256 24b689b005eff7b68709078852fe6ca24be46a6cf328891267441e6ce5b3918d
MD5 25c8c3a0c6c2be2a1fb090d43b064ff1
SHA1 11063074ff2b6a4ed054df48164cb83798cda6a0
SHA512 20b78c8a1c7b02f35b89f27ce6f51081e439bdba8d749db490abccc17e346a4384a280a642d308a2ea5d04f2202fdbfe80b0453a7d31e6bda1dc79e5786ecacc
SSDEEP 393216:qVaV811Jhs8D5d47GgjSpYEwj3/hrfpZKELMo7WHM6rlRZStu:98bzs8D47GgWcZ36HM+LZou
TLSH
T10427330FBF51EC9AE5365E7689308718B9BDFC190958481636E83A34CDF23D86BB50C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
200	bigimgpin.exe
3520	vips.exe
5820	vips.exe
3820	vips.exe
4576	vips.exe

Loads dropped DLL 64 IoCs

pid	Process
3868	MsiExec.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
3520	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe
5820	vips.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bigimgpin.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\70-no-bitmaps-except-emoji.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\11-lcdfilter-none.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\40-nonlatin.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vips.exe	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\30-metric-aliases.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\45-latin.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\48-spacing.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\45-generic.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vips-modules-8.18\vips-jxl.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\ImageMagick-7\quantization-table.xml	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\gettext\its\gschema.loc	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vipsedit.exe	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\10-no-antialias.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libopenjp2.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\10-unhinted.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\11-lcdfilter-light.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libwebp-7.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\70-no-bitmaps-and-emoji.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\liblcms2-2.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\25-unhint-nonlatin.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\ImageMagick-7\english.xml	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\README	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vipsheader.exe	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\11-lcdfilter-default.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libvips-cpp-42.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\45-generic.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\10-hinting-slight.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libsqlite3-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libaom.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libgobject-2.0-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\40-nonlatin.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libz1.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libpangocairo-1.0-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\10-sub-pixel-vrgb.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\65-khmer.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libOpenEXR-3_1.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\80-delicious.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\librsvg-2-2.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libpangoft2-1.0-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\48-spacing.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\fonts.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libopenslide-1.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\10-hinting-full.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\80-delicious.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\50-user.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vips-modules-8.18\vips-magick.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\Uninstall bigImgPin.lnk	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libcgif-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libIlmThread-3_1.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libmatio-14.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\65-nonlatin.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\README.md	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\60-generic.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\10-autohint.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\10-sub-pixel-vbgr.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\10-scale-bitmap-fonts.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\60-latin.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\49-sansserif.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\10-yes-antialias.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vips-modules-8.18\vips-poppler.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libunwind.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libniftiio.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\69-unifont.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vipsthumbnail.exe	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_595314626\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_595314626\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e5a1936.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{98902747-FEE9-44BF-927E-3B326CC1202A}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA8FD899FB82F1873.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0E9F2739356767F9.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_595314626\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{98902747-FEE9-44BF-927E-3B326CC1202A}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3E29E80E3A45C976.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22EB.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a1936.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{98902747-FEE9-44BF-927E-3B326CC1202A}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5a1938.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4EA63E30C3855456.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3268	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	bigimgpin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	bigimgpin.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bigimgpin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bigimgpin.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\ProductName = "bigImgPin"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\747209899EEFFB4429E7B323C61C02A2\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\PackageCode = "6BEEA9949BBA85941B37C350B753AE09"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\735F873BC5F18C054823F5C61F79ED35	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\735F873BC5F18C054823F5C61F79ED35\747209899EEFFB4429E7B323C61C02A2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\747209899EEFFB4429E7B323C61C02A2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\747209899EEFFB4429E7B323C61C02A2\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\747209899EEFFB4429E7B323C61C02A2\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\SourceList\PackageName = "bigImgPin_0.2.0_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\747209899EEFFB4429E7B323C61C02A2\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\Version = "131072"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\ProductIcon = "C:\\Windows\\Installer\\{98902747-FEE9-44BF-927E-3B326CC1202A}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\747209899EEFFB4429E7B323C61C02A2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	bigimgpin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	bigimgpin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	bigimgpin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	bigimgpin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576146b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	bigimgpin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	bigimgpin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4916	msiexec.exe
4916	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1652	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3268	msiexec.exe
Token: SeSecurityPrivilege	4916	msiexec.exe
Token: SeCreateTokenPrivilege	3268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3268	msiexec.exe
Token: SeLockMemoryPrivilege	3268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3268	msiexec.exe
Token: SeMachineAccountPrivilege	3268	msiexec.exe
Token: SeTcbPrivilege	3268	msiexec.exe
Token: SeSecurityPrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeLoadDriverPrivilege	3268	msiexec.exe
Token: SeSystemProfilePrivilege	3268	msiexec.exe
Token: SeSystemtimePrivilege	3268	msiexec.exe
Token: SeProfSingleProcessPrivilege	3268	msiexec.exe
Token: SeIncBasePriorityPrivilege	3268	msiexec.exe
Token: SeCreatePagefilePrivilege	3268	msiexec.exe
Token: SeCreatePermanentPrivilege	3268	msiexec.exe
Token: SeBackupPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeShutdownPrivilege	3268	msiexec.exe
Token: SeDebugPrivilege	3268	msiexec.exe
Token: SeAuditPrivilege	3268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3268	msiexec.exe
Token: SeChangeNotifyPrivilege	3268	msiexec.exe
Token: SeRemoteShutdownPrivilege	3268	msiexec.exe
Token: SeUndockPrivilege	3268	msiexec.exe
Token: SeSyncAgentPrivilege	3268	msiexec.exe
Token: SeEnableDelegationPrivilege	3268	msiexec.exe
Token: SeManageVolumePrivilege	3268	msiexec.exe
Token: SeImpersonatePrivilege	3268	msiexec.exe
Token: SeCreateGlobalPrivilege	3268	msiexec.exe
Token: SeCreateTokenPrivilege	3268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3268	msiexec.exe
Token: SeLockMemoryPrivilege	3268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3268	msiexec.exe
Token: SeMachineAccountPrivilege	3268	msiexec.exe
Token: SeTcbPrivilege	3268	msiexec.exe
Token: SeSecurityPrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeLoadDriverPrivilege	3268	msiexec.exe
Token: SeSystemProfilePrivilege	3268	msiexec.exe
Token: SeSystemtimePrivilege	3268	msiexec.exe
Token: SeProfSingleProcessPrivilege	3268	msiexec.exe
Token: SeIncBasePriorityPrivilege	3268	msiexec.exe
Token: SeCreatePagefilePrivilege	3268	msiexec.exe
Token: SeCreatePermanentPrivilege	3268	msiexec.exe
Token: SeBackupPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeShutdownPrivilege	3268	msiexec.exe
Token: SeDebugPrivilege	3268	msiexec.exe
Token: SeAuditPrivilege	3268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3268	msiexec.exe
Token: SeChangeNotifyPrivilege	3268	msiexec.exe
Token: SeRemoteShutdownPrivilege	3268	msiexec.exe
Token: SeUndockPrivilege	3268	msiexec.exe
Token: SeSyncAgentPrivilege	3268	msiexec.exe
Token: SeEnableDelegationPrivilege	3268	msiexec.exe
Token: SeManageVolumePrivilege	3268	msiexec.exe
Token: SeImpersonatePrivilege	3268	msiexec.exe
Token: SeCreateGlobalPrivilege	3268	msiexec.exe
Token: SeCreateTokenPrivilege	3268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3268	msiexec.exe
Token: SeLockMemoryPrivilege	3268	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3268	msiexec.exe
3268	msiexec.exe
200	bigimgpin.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3268	msiexec.exe
4916	msiexec.exe
3868	MsiExec.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3868	4916	msiexec.exe	90
PID 4916 wrote to memory of 2720	4916	msiexec.exe	96
PID 3268 wrote to memory of 200	3268	msiexec.exe	99
PID 200 wrote to memory of 1652	200	bigimgpin.exe	100
PID 1652 wrote to memory of 1456	1652	msedgewebview2.exe	101
PID 1652 wrote to memory of 1472	1652	msedgewebview2.exe	102
PID 1652 wrote to memory of 1472	1652	msedgewebview2.exe	102
PID 1652 wrote to memory of 1472	1652	msedgewebview2.exe	102
PID 1652 wrote to memory of 1472	1652	msedgewebview2.exe	102
PID 1652 wrote to memory of 4760	1652	msedgewebview2.exe	103
PID 1652 wrote to memory of 1540	1652	msedgewebview2.exe	104
PID 1652 wrote to memory of 1540	1652	msedgewebview2.exe	104
PID 1652 wrote to memory of 1540	1652	msedgewebview2.exe	104
PID 1652 wrote to memory of 3064	1652	msedgewebview2.exe	105
PID 1652 wrote to memory of 3064	1652	msedgewebview2.exe	105
PID 1652 wrote to memory of 3064	1652	msedgewebview2.exe	105
PID 1652 wrote to memory of 3064	1652	msedgewebview2.exe	105
PID 1652 wrote to memory of 3064	1652	msedgewebview2.exe	105
PID 200 wrote to memory of 3520	200	bigimgpin.exe	106
PID 200 wrote to memory of 5820	200	bigimgpin.exe	108
PID 200 wrote to memory of 3820	200	bigimgpin.exe	110
PID 200 wrote to memory of 4576	200	bigimgpin.exe	112
PID 1652 wrote to memory of 2176	1652	msedgewebview2.exe	116
PID 1652 wrote to memory of 2176	1652	msedgewebview2.exe	116
PID 1652 wrote to memory of 2176	1652	msedgewebview2.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\bigImgPin_0.2.0_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Program Files\bigImgPin\bigimgpin.exe
  "C:\Program Files\bigImgPin\bigimgpin.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Reads the TCP/IP host and domain name from the registry
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=bigimgpin.exe --webview-exe-version=0.2.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=200.720.7506695950702226898 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView /prefetch:4 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb35265fd8,0x7ffb35265fe4,0x7ffb35265ff0
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --webview-exe-name=bigimgpin.exe --webview-exe-version=0.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,4761155349581664903,15621017539394179331,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --webview-exe-name=bigimgpin.exe --webview-exe-version=0.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2252 --field-trial-handle=1788,i,4761155349581664903,15621017539394179331,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --webview-exe-name=bigimgpin.exe --webview-exe-version=0.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2436 --field-trial-handle=1788,i,4761155349581664903,15621017539394179331,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --webview-exe-name=bigimgpin.exe --webview-exe-version=0.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2916 --field-trial-handle=1788,i,4761155349581664903,15621017539394179331,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a /prefetch:1
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --webview-exe-name=bigimgpin.exe --webview-exe-version=0.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1532 --field-trial-handle=1788,i,4761155349581664903,15621017539394179331,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a
      4⤵
      PID:2176
- - C:\Program Files\bigImgPin\vips-win64\bin\vips.exe
    "\\?\C:\Program Files\bigImgPin\vips-win64\bin\vips.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3520
- - C:\Program Files\bigImgPin\vips-win64\bin\vips.exe
    "\\?\C:\Program Files\bigImgPin\vips-win64\bin\vips.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5820
- - C:\Program Files\bigImgPin\vips-win64\bin\vips.exe
    "\\?\C:\Program Files\bigImgPin\vips-win64\bin\vips.exe" dzsave
    3⤵
    - Executes dropped EXE
    PID:3820
- - C:\Program Files\bigImgPin\vips-win64\bin\vips.exe
    "\\?\C:\Program Files\bigImgPin\vips-win64\bin\vips.exe" dzsave
    3⤵
    - Executes dropped EXE
    PID:4576

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 549AAC279C56FB29FBAB5DFAF3424EAE C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3868
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a1937.rbs

Path C:\Config.Msi\e5a1937.rbs
Size 113KB
SHA256 8ff7f836b81edafdf886edb5384190ad23183444d8364307a747540212680e1f
MD5 dac5268cbbccb25d77f0e1499b364e57
SHA1 4606b79d67f0768652e6c5d4adbff8eaa3e217bb
SHA512 fbf0b667dacf181776ebf3408ba5011c8cdc3f81b614bb310ae7aabbb1e7a41bcac6d7a4f3626c3050d34482cd3b5e167920369e736abbc13e660680c1123af4
SSDEEP 1536:N/8ZrTy1YzD3jzs7JgQH33q6r1xr/3dFusDjp/Vm0o8TQ1vdmnZIOjw8jWNQR6+d:xf
TLSH
T1C2B34AD55710C642D1AF5B38FFB75B483B31C49CB3898227598CA33AD4973901EFAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bigimgpin.exe

Path C:\Program Files\bigImgPin\bigimgpin.exe
Size 6.5MB
SHA256 c66877013517f6bdfd22a59076962661123f5cccc6409a8f9dfb9371f191050e
MD5 f1bb3faf16dbe7656e8ccb40e28d38fa
SHA1 b61b18cfa016845d7c40f73e8320a074df72874e
SHA512 b48124505da624ac48936930935834cf66f2419332d696992d0e2fc7a0eed6c79c3b60bc501c00d9f425dd63a031c708aa68395e27bd5f79516e3e4b6668a916
SSDEEP 98304:CHzlQ6UrhLzyxxhiH6w66nFtKND0MOAFNK5kuzbLfLoFVuQOvTSn+GU:umaxxs66z+uz4NU8
TLSH
T117663943F66290FCC16AC075935A6632FA22BC8947313AEB5BE04B213E55FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libarchive-13.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libarchive-13.dll
Size 592KB
SHA256 79b39771316c892dcc7f85875e1077a3db955b4e5344fdd4b652b34995666c67
MD5 891939a655a62625da845d02d0ef6018
SHA1 56f41161890b54705dbd3bccea7d92c6523a19ce
SHA512 747f6efa08f69d0f4e4b959973aba12e4875430815ee0b944d9fcadc29e8ab07e12a9d710b656e02b6882334cf8cad158f38ed92c77231346f1c2a06d4149cd1
SSDEEP 12288:IEYp0XEOsshiUnIZcQ5lwdmdCT8dAf9MnqfFglK:IDMEuiUnObgmdCgeVMnoFMK
TLSH
T1E3D47C03F6D409B9D41AC2309347A732EA7AF0954E34F6CF17A493213E69EA07B1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcairo-2.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libcairo-2.dll
Size 574KB
SHA256 aedbc7998258b730f25ebdd4eef71d801def85545df115ebb2ce1f4d862d389b
MD5 9693e2b0eaedd011df97864f2a8e5d02
SHA1 da93bf40d32a2638992292d9f16f15df8cecabd2
SHA512 81403261326820a17a880c4b525ca15d175410e31ea09d1387d1fb8928d1c1a7bdbb4a8d2587a46e3730f1687f7dd5701b3fb25c32d0a58a67e84e97dd8ba5c7
SSDEEP 12288:YTv4tuZFXenOKEAht1dV+lY0F4WfYVKGsekSmOrvrZcpQ:Y7XjO+l/PcKnIrvrZc
TLSH
T164C46C03F18148FCD05AD1B1931AAB32F563B4461728A4DF17A04B612EB9BD0BF6FB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcfitsio.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libcfitsio.dll
Size 942KB
SHA256 5c6d9a5f17130c588fac8c9220dff5e4b0e98fac75d2176af34aa47df9dcc5f7
MD5 744acf9a90eadfdd7304fb0c9187a04b
SHA1 bd3676aaabfb97c52660a57e7b07bb4ac51449ae
SHA512 51d320314c543ef2d47758d6549b1572d6f712437bda893c1507dd2393be9d191680d8b6d378bda74cb4a80c3bb0f44f33f4b58ae6562ad4115cd7abdb839d12
SSDEEP 12288:DMFRsjy+LjkNVZEBKTW8le5cvSBd4Gi7A6iFTb+NT1+vXMSrh1mCx43KL:Y3sW4IZsvGSesxFn+32MSrh1jq3K
TLSH
T16E257C07F08201EDC429D1B1531AB333FB31745E6928B59B5F949B642BBAF40BB6E708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcgif-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libcgif-0.dll
Size 22KB
SHA256 883006a07356a2abb7a2fd421e87b826623528c77fbd1a9bd238dd40518bd7e3
MD5 fa2e4e9e8d65ad0cfe2fe6a41758a45e
SHA1 877bcfeb1d003a286bfbafb9c995e67c8474a16a
SHA512 119eb936a57fae64a24a9f4b6e71325fc0fb354709883b3bb9678e367a6701a7da3fa1163fffbfeeb2037974410f5a2cc7e6a99b1049ecb82fb2c37cb0d7919b
SSDEEP 384:GyI/+akFZNTUinVoa4pqnv/geCh03LxfuPU:Gn2amvT1nVoa4UAFYL
TLSH
T1C2A26C47E98763CCE555E13AC3439B2DF6B271160711DAEB8B6183381E31BE1963D790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libexif-12.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libexif-12.dll
Size 217KB
SHA256 f818292091d20aa70a98c2e27f11572f65b95da879bf0d0e53534d88f84fb52e
MD5 d94c88c84429520389759260572d4b39
SHA1 adaca6e43ae4c00c1c4e0c533f49a4f29635f81a
SHA512 239b37e8c1f713053571707a5d86ad3b050c6deb1483bd6030601fbaf059b46b44795729f90a532288473e9d70a21d95579b8ee573829e45e5e080778cddbe7a
SSDEEP 3072:elOOBCLn//1xOLl7oCt2kIQKLL/yS8irDVxM:elOMCL//1xOyeKLLKWD
TLSH
T10B24170777C01E73CD468276A6AB1352A3B6F4598722D39F13480128EE4FBD49FB62C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libexpat-1.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libexpat-1.dll
Size 136KB
SHA256 43d6250ecf146b58f726e9a3b7828454e2b034aca7eb4bf551b233f477654806
MD5 304e98d045b0777c0956b560dc12f67d
SHA1 5b8aa7407b02fccb936072dc7807a66df904713c
SHA512 b753ff67ca852134ff1eb2bdbb6b3c4524329e1965fbd5e2abb3b0892e86e72ea249dc122e4f131568bc42e00b19c343ffb1197fc16d45808f1a050a20e8194b
SSDEEP 1536:m4eVpV+hhOeZsaZsEt9yLzYXgPYCfACkJi33ptMIH6vNHmtMQNFfC0qFgvW5bnWs:6pjUOUXg9fAJU2IavNnkFfC0ogWU
TLSH
T11CD33B13F0C0C26FC446C534A79AD722E679FC621F11A19B1294BA3C6F77BD07A6AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libffi-8.dll
Size 30KB
SHA256 fdaa88ea3fc6cb65e17dbabf630a0853e0b0890e054e18411a1abc61fd1d1f54
MD5 287f0733b21ac0ea8ba065bb992fc51b
SHA1 763d5aaf3b076c0f7e0b67e65f0319f0afb94cd1
SHA512 bb9b755de84dd158b5fdcdeb7fda0510c7369393afae81c442d4c52a42d94e532c65597b6db06ef5dd7c24de0223ca80ed95ffab5acad209cbef329f4827b3f1
SSDEEP 768:x/nowS2j4IsmjZcwV5KukwgJQ1A48sAK:xdSGsmjyw7KfHmA
TLSH
T15DE25B0362E2467CFC96D1389713EF3AE576B4056B121AEF03F661352E706E86B39748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfftw3-3.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libfftw3-3.dll
Size 992KB
SHA256 1ec40c3213ede1e88e100a34a4df2c04b53d95d6be93558ee75151069e4ca675
MD5 574b2111b9902e648f1b53aac6cf3846
SHA1 a496099e41aeb9b98637325db09557d9c692eb87
SHA512 dd50bd584e2dc66035da6088864d8514457d694731f52a15afd5b01b4cb6dd126da88d6eb74a812041ae36ce5e1a86ac9da8b837b9a217055b6e2a8ba655790c
SSDEEP 24576:LItWe3ErIgqCMzEyqyEr53PR7MRZcvPEz0H:gWe3ErIgqCMzEyT83Kmcz0
TLSH
T13525D349F8911D3DF0993AB136B13A12E3653649476C15390B939E582F3EF02BDEB90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfontconfig-1.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libfontconfig-1.dll
Size 443KB
SHA256 c46b6e4a93975296a25a9ddc0f47998ad874eb6eb55bb319bbd2e418daf00f05
MD5 7d1a795ad571c19c5e6acc9ca60b4d48
SHA1 e366f94305ec314947b035e1b4bdd23d207e271e
SHA512 7684c8a6da92d263f7a01c3024d493a19ce7f2d1cc65b3cd3b8ea6f2ba5e0b506e501ca9f91d8712e57a382b7785f8fadec3e8670b3a4421c3c31c219f014fd1
SSDEEP 6144:zGC8KiYkFeb+bhDIdohD39IbJUDktGeQq49Lt1As3oWmUm6lDk:z58Kiveb+bhqohD3CuwYeQq4Dm6l
TLSH
T163A41807B281C4A9D40581315E47D6EDB5B2BC61CF21A69B37D0B32F3DB16D46B3AB88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgio-2.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libgio-2.0-0.dll
Size 1.1MB
SHA256 ed677f667c981a1165651b353514b32ffc72b4d00419b5446cb9681a69eda1dc
MD5 3f481146ad07256d56aa8c979e057fd7
SHA1 8657b2a6718c55fa7454c107b8e1debf457a7410
SHA512 ec4f7bde494c51370158a4f8fa40c862ae529820699c0b118a455a89eaf9a08803a226afc8cdecb1e9c1fe7cc3b153f77aa0bd558b365e6bc87e4a990da2ea56
SSDEEP 12288:dVkA1izZ7prwCsKZCoHncLPqGn2Pa60qghkwglr3akxdNk248hdpLEyYQQhTlr+G:HkA1iVl0CsAxHncLVn2SLhhi3xEEdCB
TLSH
T19D356B0392C89428C8AEC135D74B6B12BAF5B4960B30B89E067067613BB5FF517AF74D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglib-2.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libglib-2.0-0.dll
Size 1010KB
SHA256 26660b4dd0c0c8064e5cc966bd36e8648246df3972f61dcfc22e8c4e380e3446
MD5 7932d68fe55415d4fae7001681743621
SHA1 962f7da1be925efd853cfbc7ac79026868d90f64
SHA512 56d25e04facc17d4ed9d3b4c8d5ac0080f7493199e9b5491e13c72a4c0d49b447980aa9a651d8adda1c3939c8f675923ab22010bbbed85ac2fa243ec2fdf70bc
SSDEEP 24576:Al7NI1PmoMRikiXyBZtnGItxRrustv/8:u7wPrMUyBZtGSRrXtv
TLSH
T11B254903F2C27CABF785DD7186F297A2E174B8550F33609A3E5CE7212A6DA53161AF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgmodule-2.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libgmodule-2.0-0.dll
Size 19KB
SHA256 a51186a4750e82bba415b5e6c8557f5c8e0c224baecc1f968d18bb29a4f6fd45
MD5 2b44f4c4fa086efc55724da7a9621bb0
SHA1 cc0395f38737295310018dad95bd21ea5e8d0939
SHA512 570c0fc027827b26895a30c31315bdf0bff6b5b1e77a86d452cc424b2bfc20f3cc724ae36dbb408f3afb0a67a39fafa0a637faf3aca9a39ec726cad24fab3d24
SSDEEP 384:MApWfYRSd/TC8ektF3XfuWtpwFLN6mNlVeXmun:MApnR4W0fXtpwFkgm
TLSH
T147925C5156E520AEE94AD23DE533B716E9F2B4570F32A5EF8BA0406C1D30EE14B3CB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgobject-2.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libgobject-2.0-0.dll
Size 212KB
SHA256 010ab8cfb7e9a80d4ead69af7beda5207b75cd55fcc7dff78b34ce0c10f537a9
MD5 c2536d98c5183e1897171586bbd640eb
SHA1 bbeb3dec9075de70ae543a76b2f1df110ec427f9
SHA512 c739fed7b7b7dc99cc9efd44a2a35390ee68594f194de8b416ce4141eb34ef05db6201c6fb5c571df12e1cf95e5df042ae2afd1a2465e0d180e25921b86bd192
SSDEEP 3072:gZh+iY43wb2qBmXhJiRB8lfr7TAcX0hMDPbrzktdWmzXRoSQ8tUoDqNDKkH/pU1b:gL+iY43G2i8tHTP0ba8t/dZcl73EH
TLSH
T1B5244C0773884C3AEC8AC17487479B16E5B3B4591B31F1CF03A543607E7EEA56B2EA49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libimagequant.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libimagequant.dll
Size 62KB
SHA256 45e0e43e3d045deabbb135b8151b7f2e936631397be88dffa41cc373fed7f208
MD5 79cc68bd390491b61be83c1d97f9126a
SHA1 3e3bdd548135f62697621cc8e85c17de70598b4b
SHA512 5f0d36e0390ac1adbb6360bddf0eb6ed56080e0a602cca8e10aa4872701e428d9126d8ca897b0d12472a70665513bda939dabb1ef5f1911ef1252dd45335fb93
SSDEEP 768:eB2rPIDQCD+HjYpharqS+xN7y0XqMEBJpqoMYNMmp5FhK:9iyD3kPEtMS
TLSH
T102537E8F966695FDF125913243A6B617B431B05107149DFF03E083382FB1BE0AA7BE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjpeg-62.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libjpeg-62.dll
Size 582KB
SHA256 6481386d9c66783f4f08bceaaa5e866f54f118fd7e184431561da85483a31f6e
MD5 f539d86f14f8040f93fb0a3609ac37e0
SHA1 a08b4fa79e44a221ab61662b008c9659ab2ad963
SHA512 55b7b788e3b16054e50b1528654fdc4e413fbeb50f92915d23f1486da66b5ff1754fbde66833e5b7fdca3489ae71b1e2ca336de576cb0b743820e10def102e20
SSDEEP 6144:yUipfXd4nTEJ0p0FxXxEC4gL0ZR9s0EQqvX1zgysM+iHCGAY0qE5aaA:ipfXdaTEep4xX6RbSxZMK
TLSH
T1F9C46C0BF2910C9BC7C1C470EF2DE632AF06385EA7F7617971826AD23A17A547B15B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpango-1.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libpango-1.0-0.dll
Size 330KB
SHA256 26eefab38680efeb8861ce62d2fa9496e4df67ffcac732cef9a7aaecb97a06c3
MD5 d9d622b3c223265316c18bed193cfffa
SHA1 2b4382475a7e27500a555fd52151293cf0c9b94e
SHA512 dcb21e7fd8c49dc3b00b5d02774b789b32c69179a7fba824df15ba3a0b33a4abf4941d5d4a9ea709ea391d4d5dc40366406d3c70a32b6831a2c3c00e277b2b91
SSDEEP 6144:UdHNHbAADALp1PzsLBK/pv3CC8q3998+AhEV/5pwYmuBHUF4Jsu//u6Ql4lRmWoE:EwqYTBHw46u/Wxl4lRmWo1z7BI/
TLSH
T1AA747C0BE68454F9E846C03D965BE312A6B8B0794750E1EB5B9152207EB5FE03E3FB0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpangocairo-1.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libpangocairo-1.0-0.dll
Size 52KB
SHA256 5a9a06dd3f49f23b1c52dec406fe7899cb00d984f948d54dc2807d4b64a6a319
MD5 8f89508b37258c7e89bad00cf9609656
SHA1 215801b4a417736f1aef3e5f41e821b673b93cf1
SHA512 e908f899f5daa927a4ff2ba100aee3749db5a6bc2c589e19ac721a30c5dd99c6af8c3702a5185c32044eec181312f15ad5d7c1f63a41a6b125730b6bf6a4af2c
SSDEEP 768:524M6BM+QCXDqdvCsi2+ibyZWorpOW7Qfc5alX+lXFtTd4LU:U4bBMTvCsi2FbyZLO60lX+lXFtJ4L
TLSH
T136334B0B685088EDF4CAA53C927276139521BA78075591EF83D2112D6FA0FF4F5BFA83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpangoft2-1.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libpangoft2-1.0-0.dll
Size 75KB
SHA256 778f6f2b58be56ca834b0f7b7a74775255917f5e4c130e5d70bbe5f87a73e039
MD5 227fbdea2816aa2a694a63b6008640f5
SHA1 60b24d8108b8c6e72d4ecf8741d313ba814276d5
SHA512 8d4038d35c21adb55f09d790244663e7a7eeec1ea54565a6c1b5cac48b82a9a67f2e65335e984e5107422e659a8361cc9dbc30854924671d80006413011fdb88
SSDEEP 1536:1XBBlT9Dk0Ku+5d/952tgiX1SsjuAozkhH:nBj3Ku+5d/9otgiIsKAocH
TLSH
T17D733A064C8440DCE88EC53EA361A6129735B6754720A7EF0BB166246FA1BF43E7F6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpng16-16.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libpng16-16.dll
Size 178KB
SHA256 f3d4e96d35199c5e768787d4c02781f94a01d298dd2c63f41980eac0ebcd40c2
MD5 e5ff83bdbf892432450f00119071f0b7
SHA1 5091adefecfb7d211073c66eb8c46d10f18c98d3
SHA512 cc26f6bd52d5a9954db3533ad27199c8d91dce359523a4dec88f1a6d2362795f4639ef34ee6680782d120a11e69f5fc951ec0bc4f0e80f6ea6132ff8742c525b
SSDEEP 3072:V1zj0lisMWImpAfA8/3JDHS7KX86Jwc8MdDldjvpFlBbfrQrfmFo:HbsfutDYKX8vM5nxF0
TLSH
T16904BF43F19484BDC08BC2B49316E621F1BA34651338BADF0784677075A6BE47B3BB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

librsvg-2-2.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\librsvg-2-2.dll
Size 2.5MB
SHA256 31d7fd83819751232c5e71693b50e9f15f8136b928763d8b438506840892ab84
MD5 e4c189d226aec7456c9aca1cdfeba473
SHA1 12f6f70ccb4ed7002db00c36c7cfb7f71e616902
SHA512 7d4e7c6912da940bce51b90e610cd8e5f7d432dd47add66f9c667c707060c16d32306a45f7c2ef1c90491011c741a8f9898a8744e1722cfcd40d40184afdd35f
SSDEEP 49152:kIss+Xc0yK/Gi/azMLxEDpgA/X1bytv1xHo0nqSXwvg4i:NHHzM+jqnqSXw
TLSH
T15AC56E03FFA281E8C4DDC1B8876B5632A732BC8D4621739B27D41B213E57B915B8E359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtiff-6.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libtiff-6.dll
Size 409KB
SHA256 8d24f437fc308cd5b18b21a38cbb0f153bd0404a3563b77f8eebf4b892baad50
MD5 a30f7d14be71bbdd86c3cc4b7aa4d895
SHA1 3cc4f880b87d3f9adbda3db4d2335cb892c73679
SHA512 088144fa3d8eaaa6657288fe2019043585d2f688f33dad8042305a730bacbb000c60647fc2e81d97b2bfed55387bf959af39449858ee3b264003f7c278fe0fb0
SSDEEP 6144:JAjL5uAeQjBmNEHPIyzUlPqIbgN/GJNA:J2eQVmNEvIyzUmNEA
TLSH
T166949306DEC049ABC875817556E78221F273F48A7F02E75BA74871303E527D02A9B6FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libuhdr.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libuhdr.dll
Size 301KB
SHA256 e36a1ca2143ee3c4569857997a5f26a1654ac3691d609f0edf30e791a5b91968
MD5 1da42af116e0e406243ba1a6a20595f5
SHA1 a2406461ab39070b6692fcd417e37405f785e8f3
SHA512 4569e648e701f05372288071b8d2b2fd21f4a4bcc2e39552a214f1e8ac512626420f03e8220cfcaa1752c22eb515179b68ef181aa14812dce93604201f67bdc0
SSDEEP 6144:fzqbuu+12pxml4s+fF2PqEhdo6vAKXMVGjcVYOv:fzqbuuu6xmEjEbo6o5v
TLSH
T1D7646B07E35690EDD4A9C17A5387A226FF71B8858720F9DB17A083252FE1FE0673A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libvips-42.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libvips-42.dll
Size 2.6MB
SHA256 e4f34196452e87e2b151af285b17aef82266bada19ae9c78657d0cf2a377efb5
MD5 77d8c5c93d2807e9f4f84e485d0df9f7
SHA1 a382a1cc9cef54f216acb0c3b6c7e1897edf0ae4
SHA512 fbc867ab5bf8e821a89085b1af2fa46cc03c7b4d64b4486bf5906332460f66ce976a7b771e2f10bcc6e0bdcf9416d72812a4d618af58f83c5fb396b656cac781
SSDEEP 49152:q8XlvenV0n8PymOu90eVxxN1MF9ZrqynSlx83MSV02klJ0QXAVmC1LD/X8zsSQwj:LvenV0n8PymOu90eVxxN1MF9ZrqynSwt
TLSH
T145C59D5BE69250ECCD2BD271835A3222B15031994B347CEB0661C6353E76FE02B7BF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebp-7.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libwebp-7.dll
Size 373KB
SHA256 fdebbdf151bd1c3df5c5a18b9b24979fa48e5b3f40cdbb76cbab7b4cdd933813
MD5 4d1d803a253c3af7134b102626d9d537
SHA1 4e5b91736787223df810c57b3a4e66b2e533bb8e
SHA512 2b64092ca309d5454618318bb3c159f7fc5844187e314d9214e051e939e02ad44d7e093b14346e631f92c1537043902349d7a116ea2d7cdf2043fc4b796ca185
SSDEEP 6144:Q4sird3QQH4XuvcPtTf8IIjfQBGGPj8o+jzLTm3Yele+GV4W:z3LHcKhjfQAZo+jzLTq/
TLSH
T17D847C0FE146244DD84BC9748A2E6322F61D3D1E8798B19E13977E30BA767C09B1BF09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebpdemux-2.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libwebpdemux-2.dll
Size 18KB
SHA256 8a9080009642a7e9654b7dcdbeb8fa83c2cf5650f92b52a107ea1871d5a9ef6c
MD5 874ce20262b27d689fb498e465c86b68
SHA1 f99a0d11826452a9323cd4dbd790cf329be9e774
SHA512 9d7e1b53e4cd2ebb4b4b32fdcdbaedb5b8ea6ca429c5adf7de076d127af9d1633834f60d1497372a9f2e379d6af4aab49e50870dc529970a76f246de7e27db2c
SSDEEP 384:1DNOAqEU6nt/1gGtUE8mtbnM6u1P5WJ34za:1ZOApt1Ny6u3WD
TLSH
T100826D83BFAA206FE846C0379113AB39D9B2B05017254DEB1391DD7D4E747D0AE3C999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebpmux-3.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libwebpmux-3.dll
Size 34KB
SHA256 cb2f2e90ca17807e8d2b323cc4e9e8f3ae6d8cf48d926fcda56ecabaea36c22a
MD5 bce778326bb40915431a9f7d3d16ec30
SHA1 38010a528efb0badd0ee6e8ce4f31e4ef0b24020
SHA512 08a9dc01d254486cd9daf65f6738b157a9b19d4b30368d2c6854db69df7baf95fbe9f15552b8360e997e0543a19e3f0b2fd02b45dfa445a46b35bd0e811a549c
SSDEEP 768:+ta4PFZBuUBU0Soce4RsY6Pjb3rHeQU1Z7QlOFzI:+lFZBugSocTiYGjb3rHluZ84FzI
TLSH
T1AFF24A03A79140BCE869C076836ADB69EA71B8451B10D5EF179143193E72FF0AB3F1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libz1.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libz1.dll
Size 197KB
SHA256 4aacea95976b8e5b9a937ab0d298f3e458ab732355b89bd1657af63e5bdc7fc0
MD5 41e059364c5262ab2e952b487bcb1d44
SHA1 1664cd6b3897cb138d7b5f065d8ee583ea9ff344
SHA512 757e9d5c1bb32d6610718f143dab9b9cc1907b951c92c340afde5f9a6649bb7fb83af8b0001341cbc14f88327ff63649e43ee4a40cbd3cbebeec9a9e1d4166f5
SSDEEP 3072:eSi7KjiR4trb0AFjDX3aSEOz0yroYDawa5ewz0N2Ku76kOknBTEOblzRh2HoQA:eSGOfrztJEOz0yNatlKYBTteoQ
TLSH
T10314AE4BF5A248ECC477C271C6DA9762F52578644700ADEB4340CE712A67FE06638FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vips.exe

Path C:\Program Files\bigImgPin\vips-win64\bin\vips.exe
Size 21KB
SHA256 7781e4d7118de8598bfcbaec88840ccffef00c802084a0f6a711d683a5d847c9
MD5 f4f94a1462a7121c4e2dfb4beb9a659b
SHA1 dd6bb45e6934676ccc1cec3f6e53b97ad223cd54
SHA512 5a681dfd4c0c4e8ad6db509de90ef38bc798ee858d0a80c4ac8b8319f1f2b2d177186bafa52e2bf891b8e0364c0257d0507dd382d42dea3f0fe9de052858bc20
SSDEEP 384:DaLEqFwbTSEN0xjDusXEcSw7qzyARNlx1TWu:ygTSM6jDAct7qzyIW
TLSH
T125A21925154166EEFC9F823AC0517625F2B0FA962B31B1EF4392A3252F70BF55FB4482
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bigImgPin.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bigImgPin\bigImgPin.lnk
Size 1KB
SHA256 52a448dc0b9f725d3e58445849444a835390d59f0b021df9c6b647a46d2ad741
MD5 a66c6a440eeb3f14c1fcd65c48e6c5b7
SHA1 6c20dc28956d2baac47c1fc3a2d7c8356ce1aab5
SHA512 7a476f7326aef90b9fe313a6ad6ad93fad8db71cb85c96c058a63e361126f019269ab8250528204ffec568ff203e9c335c4efcf63982b02bc481bf04d2cc75bf
TLSH
T11041D22816E4176EF3F6C73B68A15A309632FC0173164F2A45C5438D0DA9140F5B5F3B
MD5 SHA1 SHA512 TLSH

Submit Download

~igImgPin.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bigImgPin\~igImgPin.tmp
Size 2KB
SHA256 1c0fea54a113a6804de6c703d3767df54deba0e12f909faed09cce13a2b7875e
MD5 da6b0cf9f8015df19a8c6d63b9e9663e
SHA1 cbef70b6009f26814989fdd5aa8d36f4b5030299
SHA512 5a0c910fd91f94a3853e9439bfd6c3783d876b2b9917059f0ee537ee2fec95eb8fffc66ef630be34ff591b82920826ddffa2c9efbc3be9687283862d0cacbd17
TLSH
T1B341F32816E4176EF3F687376C515A319632FC02B3164F6A45C4438D0CA8140B5B4F3B
MD5 SHA1 SHA512 TLSH

Submit Download

MSIBD0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIBD0D.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

190afe73-f0fa-4b3b-a4ff-a20da74d676e.tmp

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\190afe73-f0fa-4b3b-a4ff-a20da74d676e.tmp
Size 3KB
SHA256 f7f83539360240610a8eefb3a23bae19567a22d9a046ffe910505bab91bfab9a
MD5 00b39376ec5ec29fad0afc661e2c7179
SHA1 47194fe7b3a7b7648eac515fca145d4290ba20d2
SHA512 c5a771673ebbbedf5c91978507798fa260d4875577a28a6a6e16337e2a4609e01d8fad9c77b4976c7efac32d25d1b932fb9c61355747110de56c1021cbfcd1ff
TLSH
T1CA6186726975BA379EF28A0579863F1BABA55127E4853F94C6FC0F1C01D72982381C37
MD5 SHA1 SHA512 TLSH

Submit Download

377d2a49-c36d-486e-9752-8da18cd8db8a.tmp

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\377d2a49-c36d-486e-9752-8da18cd8db8a.tmp
Size 2KB
SHA256 5e714c2983b4b4d9def1179f7b8f792cf0b6a9f9d4dea771b2503b258731fc59
MD5 08ee72e6b22dc2b46ca050609e5a3cb2
SHA1 a0297e759a4e1ee0c173321e7e15e17e87d5b868
SHA512 491c151876f9d616120d7be3fe166a883c97dd422cffab5dd7c40f8fde9a1231ae7004db0f301111a7f9d2274f1747e3b99c8b0e4203889b7860a79875b069a4
TLSH
T1B251C7736855BB37DAF20A45798A3F27CF7541A2A5413F4096EC0B1C01D715C2386C3B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bb7132d4d2eb3f4b7d574c7b141f73530ddb9a6a31cdf1617d2c60dac37a191f
MD5 4013eb46e2f5491f8fcca4bcb757edb6
SHA1 23fd752dbe2451844cf61bea89df4eb5e085c1c4
SHA512 d593258be2c0ba3fc4e280d74eab3277c5a5ead081fb6e05428d573203e6e5cfb433e717906b50195f2d47e72f38fc72b30fd4533282f1e4ca2f213e8599c9b2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 140a493e198351d41e5c2e313d368691ccf4169c2a6b1ac7438d1a0516bee9e7
MD5 88a29853b8fc2f4c00b1c057fca9b8fa
SHA1 696cc6e51e0dd08d266bf19f5a045f86ee7aa075
SHA512 59e9f8019f4a5edf60d2f4a592c8717347f685050beb3e0c047f0e4d256527f1a2b09f87c9cb6162ccc32070cbea88a8b7c29d25a1ce8bdb26191adf2e25b349
TLSH
T1DAD0121A32214635C41135B3010379081400C65F40068101642CC51E1B844902E13841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 4e7b2afa0b94970d6b6757f44dc57f71b88beb34f163fcbd8025b4c8884b136d
MD5 0a8a1e844966406b069bd171e36a4807
SHA1 95639dca959855475d7356e1b14b1e14bf700188
SHA512 94a9987fdf79cb504188b211b154eb69ed54f2163883fd690c8a4ca1863a9c8d271d33171e69a23bed8b5691e7714e3f1bf1f152cd356701df33e1b7477d25a9
TLSH
T187A0025C66600676C680077214C392C4B3395D30CB733B4141A051B4C8593504627211
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 fc1f874bd27683b0ffc198017a203a4d55b82fad185583a0c36f7c82f8bca91e
MD5 2e1c4c2323094a9afa6d7c8362761a0a
SHA1 9b2a7aeaa928c9abce9c0d6d8a94e9942f33ef53
SHA512 1a8c1b606b52d0e8c00b9153d8db5d09bf4cfc48954dd9320cede1599cc85cf1710c6d629f1620d6c4c3ff8aa7064500b69767ec585713d5bf8101b4a7c7d5f0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

31b363cf-9eeb-4c77-ac9f-f65d44c6c8f8.tmp

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Network\31b363cf-9eeb-4c77-ac9f-f65d44c6c8f8.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ed06f815-b936-449b-a99d-021bb2ad4ad9.tmp

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\ed06f815-b936-449b-a99d-021bb2ad4ad9.tmp
Size 6KB
SHA256 61d40757fe44884ac8bb4c44213e998dd74852eafa3a21a20833ede013dcfe5c
MD5 9bb523652a66cd9a50114e1d821f8799
SHA1 9a5da2dba10767b7611765def3d0e94fb470b567
SHA512 40f7a56cd49a76ef157f85500719b472c3f50830c307f369bee0c17af22ddaf61fc6736bfd0f1e05c498d7e3dc400edf84c4433096650d24863e9e27a7d4d861
SSDEEP 96:st3/dyYM7vb9hk1o5h16Z0cs7/x+6MhmuecJjDI1ejeYK+gPcI+28XM1C7K:stPMt76oncsV+FdjDIQjstcrG6K
TLSH
T104D196019E28797B4CCAE119BA39BF06E3F5607264D52E48E7F88A2C04D66CD7307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Local State
Size 1KB
SHA256 7cc0cff6129409b7601fccc9c019ad526171b4839b77de549691887c934da24b
MD5 61cbdc340508770c42e8432859358077
SHA1 365235ef6ee59903f51c4c363fafdc030dfd8ed9
SHA512 f00dee7097baed5d73651c9fc89dcb18dfc8bcbd9cdbf4c4bc2c323cfc734919cadfcc856c1fb5b5addf1c25664d10f9847233cb78519d35f4539fc1f1ece3d9
TLSH
T1462195F2D5A92F33BDA6164632867F0B5F30027791406E4052ED4B2C01E708CA29EC3A
MD5 SHA1 SHA512 TLSH

Submit Download

ab40728b-e363-49c4-be6c-37a5a7a03bb3.tmp

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\ab40728b-e363-49c4-be6c-37a5a7a03bb3.tmp
Size 15KB
SHA256 a141586e65844d921bf0a2d45cc89b4bfd13a16ba57a185da0de1fd85d2b84ef
MD5 379db2724aeace04e6d171ab35a4a8d3
SHA1 55cdc611f588bea23e6abfc8fbf4dc3d3a0cf4f8
SHA512 d6d180d6c12d201e355812ca973c877beb74411222317f956b5f6043791b1a6ecf4800e71bd7c00ab0ed4434a3e101312966ea0642aebf36c79b0a30e984d95e
SSDEEP 384:X+OBqImmJvGBLx3NaFMJF5NBS40hz4g6ry:mcvGtlNEl2e
TLSH
T1C272AE76286A6E373CF7890A7A8D374BCB745293C0D53BD4D9FC8F0E016A1842392D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a1938.msi

Path C:\Windows\Installer\e5a1938.msi
Size 20.2MB
SHA256 24b689b005eff7b68709078852fe6ca24be46a6cf328891267441e6ce5b3918d
MD5 25c8c3a0c6c2be2a1fb090d43b064ff1
SHA1 11063074ff2b6a4ed054df48164cb83798cda6a0
SHA512 20b78c8a1c7b02f35b89f27ce6f51081e439bdba8d749db490abccc17e346a4384a280a642d308a2ea5d04f2202fdbfe80b0453a7d31e6bda1dc79e5786ecacc
SSDEEP 393216:qVaV811Jhs8D5d47GgjSpYEwj3/hrfpZKELMo7WHM6rlRZStu:98bzs8D47GgWcZ36HM+LZou
TLSH
T10427330FBF51EC9AE5365E7689308718B9BDFC190958481636E83A34CDF23D86BB50C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1652_595314626\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1472-476-0x0000026BE0000000-0x0000026BE037C000-memory.dmp

Download

memory/1472-223-0x00007FFB57D60000-0x00007FFB57D61000-memory.dmp

Download

memory/2176-535-0x00007FFB579D0000-0x00007FFB579D1000-memory.dmp

Download

memory/2176-534-0x00007FFB58B30000-0x00007FFB58B31000-memory.dmp

Download

memory/3064-249-0x00007FFB57D60000-0x00007FFB57D61000-memory.dmp

Download

memory/3064-477-0x00000249EE9B0000-0x00000249EED2C000-memory.dmp

Download

memory/3520-413-0x00007FFB328D0000-0x00007FFB329CC000-memory.dmp

Download

memory/3520-414-0x00007FFB321E0000-0x00007FFB3235D000-memory.dmp

Download

memory/3520-412-0x00007FFB32360000-0x00007FFB3264A000-memory.dmp

Download

memory/3520-411-0x00007FFB3ADA0000-0x00007FFB3ADF1000-memory.dmp

Download

memory/3820-429-0x00007FFB32470000-0x00007FFB3256C000-memory.dmp

Download

memory/3820-430-0x00007FFB32280000-0x00007FFB323FD000-memory.dmp

Download

memory/3820-428-0x00007FFB32570000-0x00007FFB3285A000-memory.dmp

Download

memory/3820-427-0x00007FFB39370000-0x00007FFB393C1000-memory.dmp

Download

memory/4576-441-0x00007FFB32470000-0x00007FFB3256C000-memory.dmp

Download

memory/4576-440-0x00007FFB32570000-0x00007FFB3285A000-memory.dmp

Download

memory/4576-442-0x00007FFB32280000-0x00007FFB323FD000-memory.dmp

Download

memory/4576-439-0x00007FFB39370000-0x00007FFB393C1000-memory.dmp

Download

memory/5820-418-0x00007FFB321E0000-0x00007FFB3235D000-memory.dmp

Download

memory/5820-417-0x00007FFB328D0000-0x00007FFB329CC000-memory.dmp

Download

memory/5820-416-0x00007FFB32360000-0x00007FFB3264A000-memory.dmp

Download

memory/5820-415-0x00007FFB3ADA0000-0x00007FFB3ADF1000-memory.dmp

Download