42cb138a9da77a959da18c66e0625e0de3f9f5a5c8e5e28aa4c7ece67b88247f

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bigImgPin_0.1.1_x64_en-US.msi
Size 20.1MB
Sample261102-a6lcesdg92
SHA256 42cb138a9da77a959da18c66e0625e0de3f9f5a5c8e5e28aa4c7ece67b88247f
MD5 253841eaa92fd5f14dce283fb189ac42
SHA1 81332371dd42de2c9bc62b8b0746f5a4487ccc15
SHA512 1fe1683502c3f589b6a6083001c696eb620cd6f98e5a3d945bd2725c413cbbb4b0428a9d1fa995253fa787bb634c16080c48fcec698f329c1cac69bd6fadd115
SSDEEP 393216:+e17h21xhNFABOjHWbo9EO6wWaFlnKbkNLohlkujS8W:97hYhNigjHUO6wWwl7ShSu28W
TLSH
T19627338BBE81E5C6D42A4E3018708B68E9747C5448A804573AA473BDFDFB6CD677E1C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3316	bigimgpin.exe
4840	vips.exe
1408	vips.exe
5012	vips.exe
4856	vips.exe

Loads dropped DLL 64 IoCs

pid	Process
2856	MsiExec.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
4840	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
1408	vips.exe
4840	vips.exe
1408	vips.exe
4840	vips.exe
1408	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
4840	vips.exe
1408	vips.exe
4840	vips.exe
1408	vips.exe
4840	vips.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bigimgpin.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\49-sansserif.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\ImageMagick-7\francais.xml	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libjxl_threads.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\45-generic.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\40-nonlatin.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\70-no-bitmaps-except-emoji.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\69-unifont.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libexif-12.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libfreetype-6.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libvips-cpp-42.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vipsheader.exe	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libIlmThread-3_1.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libtiff-6.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\65-nonlatin.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\90-synthetic.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libarchive-13.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\LICENSE	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\35-lang-normalize.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libMagickCore-7.Q16HDRI-10.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libpangocairo-1.0-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\README.md	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libjxl_cms.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\bigimgpin.exe	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libraw_r-25.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\60-generic.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libpixman-1-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libpangoft2-1.0-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\liblcms2-2.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\40-nonlatin.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\10-sub-pixel-none.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libsqlite3-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vips-modules-8.18\vips-poppler.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libcairo-2.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libgmodule-2.0-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\10-scale-bitmap-fonts.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vipsthumbnail.exe	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libmatio-14.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\ImageMagick-7\type-urw-base35-type1.xml	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\51-local.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\48-spacing.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vips.exe	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\48-guessfamily.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libfribidi-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libharfbuzz-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\80-delicious.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vips-modules-8.18\vips-jxl.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libsharpyuv-0.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\10-unhinted.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\ImageMagick-7\policy.xml	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\51-local.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\45-latin.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\60-generic.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libwebpdemux-2.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\25-unhint-nonlatin.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\70-no-bitmaps-except-emoji.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\ImageMagick-7\quantization-table.xml	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\fonts\conf.d\65-fonts-persian.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libffi-8.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libimagequant.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\Uninstall bigImgPin.lnk	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\etc\ImageMagick-7\colors.xml	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\share\fontconfig\conf.avail\10-sub-pixel-rgb.conf	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\libdicom-1.dll	msiexec.exe
File created	C:\Program Files\bigImgPin\vips-win64\bin\vipsedit.exe	msiexec.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\Part-RU	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e59dfc7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF985932926420BD9E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6EB.tmp	msiexec.exe
File created	C:\Windows\Installer\{7F8277D8-BDA5-4C62-8ADF-4395427263BE}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{7F8277D8-BDA5-4C62-8ADF-4395427263BE}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\Installer\e59dfc7.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7F8277D8-BDA5-4C62-8ADF-4395427263BE}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6B607C9E38C2DB6C.TMP	msiexec.exe
File created	C:\Windows\Installer\e59dfc9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB7C797E16CD70353.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA7AF9F3F29837D39.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\Part-NL	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
6036	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	bigimgpin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	bigimgpin.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bigimgpin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bigimgpin.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c1fdf03c8ae10a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380120c1fdf00000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410120c1fdf0000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e320c1fdf000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e620c1fdf000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\735F873BC5F18C054823F5C61F79ED35\8D7728F75ADB26C4A8FD3459242736EB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\PackageCode = "A501BA4E3B2C25F48810E3621AB0045B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\Version = "65537"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\SourceList\PackageName = "bigImgPin_0.1.1_x64_en-US.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8D7728F75ADB26C4A8FD3459242736EB\MainProgram	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8D7728F75ADB26C4A8FD3459242736EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8D7728F75ADB26C4A8FD3459242736EB\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8D7728F75ADB26C4A8FD3459242736EB\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\ProductIcon = "C:\\Windows\\Installer\\{7F8277D8-BDA5-4C62-8ADF-4395427263BE}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\735F873BC5F18C054823F5C61F79ED35	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8D7728F75ADB26C4A8FD3459242736EB\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8D7728F75ADB26C4A8FD3459242736EB\ProductName = "bigImgPin"	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	bigimgpin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	bigimgpin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	bigimgpin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576146b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	bigimgpin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	bigimgpin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	bigimgpin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3348	msiexec.exe
3348	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4144	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6036	msiexec.exe
Token: SeSecurityPrivilege	3348	msiexec.exe
Token: SeCreateTokenPrivilege	6036	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6036	msiexec.exe
Token: SeLockMemoryPrivilege	6036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6036	msiexec.exe
Token: SeMachineAccountPrivilege	6036	msiexec.exe
Token: SeTcbPrivilege	6036	msiexec.exe
Token: SeSecurityPrivilege	6036	msiexec.exe
Token: SeTakeOwnershipPrivilege	6036	msiexec.exe
Token: SeLoadDriverPrivilege	6036	msiexec.exe
Token: SeSystemProfilePrivilege	6036	msiexec.exe
Token: SeSystemtimePrivilege	6036	msiexec.exe
Token: SeProfSingleProcessPrivilege	6036	msiexec.exe
Token: SeIncBasePriorityPrivilege	6036	msiexec.exe
Token: SeCreatePagefilePrivilege	6036	msiexec.exe
Token: SeCreatePermanentPrivilege	6036	msiexec.exe
Token: SeBackupPrivilege	6036	msiexec.exe
Token: SeRestorePrivilege	6036	msiexec.exe
Token: SeShutdownPrivilege	6036	msiexec.exe
Token: SeDebugPrivilege	6036	msiexec.exe
Token: SeAuditPrivilege	6036	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6036	msiexec.exe
Token: SeChangeNotifyPrivilege	6036	msiexec.exe
Token: SeRemoteShutdownPrivilege	6036	msiexec.exe
Token: SeUndockPrivilege	6036	msiexec.exe
Token: SeSyncAgentPrivilege	6036	msiexec.exe
Token: SeEnableDelegationPrivilege	6036	msiexec.exe
Token: SeManageVolumePrivilege	6036	msiexec.exe
Token: SeImpersonatePrivilege	6036	msiexec.exe
Token: SeCreateGlobalPrivilege	6036	msiexec.exe
Token: SeCreateTokenPrivilege	6036	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6036	msiexec.exe
Token: SeLockMemoryPrivilege	6036	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6036	msiexec.exe
Token: SeMachineAccountPrivilege	6036	msiexec.exe
Token: SeTcbPrivilege	6036	msiexec.exe
Token: SeSecurityPrivilege	6036	msiexec.exe
Token: SeTakeOwnershipPrivilege	6036	msiexec.exe
Token: SeLoadDriverPrivilege	6036	msiexec.exe
Token: SeSystemProfilePrivilege	6036	msiexec.exe
Token: SeSystemtimePrivilege	6036	msiexec.exe
Token: SeProfSingleProcessPrivilege	6036	msiexec.exe
Token: SeIncBasePriorityPrivilege	6036	msiexec.exe
Token: SeCreatePagefilePrivilege	6036	msiexec.exe
Token: SeCreatePermanentPrivilege	6036	msiexec.exe
Token: SeBackupPrivilege	6036	msiexec.exe
Token: SeRestorePrivilege	6036	msiexec.exe
Token: SeShutdownPrivilege	6036	msiexec.exe
Token: SeDebugPrivilege	6036	msiexec.exe
Token: SeAuditPrivilege	6036	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6036	msiexec.exe
Token: SeChangeNotifyPrivilege	6036	msiexec.exe
Token: SeRemoteShutdownPrivilege	6036	msiexec.exe
Token: SeUndockPrivilege	6036	msiexec.exe
Token: SeSyncAgentPrivilege	6036	msiexec.exe
Token: SeEnableDelegationPrivilege	6036	msiexec.exe
Token: SeManageVolumePrivilege	6036	msiexec.exe
Token: SeImpersonatePrivilege	6036	msiexec.exe
Token: SeCreateGlobalPrivilege	6036	msiexec.exe
Token: SeCreateTokenPrivilege	6036	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6036	msiexec.exe
Token: SeLockMemoryPrivilege	6036	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
6036	msiexec.exe
6036	msiexec.exe
3316	bigimgpin.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6036	msiexec.exe
3348	msiexec.exe
2856	MsiExec.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 2856	3348	msiexec.exe	90
PID 3348 wrote to memory of 1612	3348	msiexec.exe	96
PID 6036 wrote to memory of 3316	6036	msiexec.exe	99
PID 3316 wrote to memory of 4144	3316	bigimgpin.exe	100
PID 4144 wrote to memory of 5404	4144	msedgewebview2.exe	101
PID 4144 wrote to memory of 1048	4144	msedgewebview2.exe	102
PID 4144 wrote to memory of 1048	4144	msedgewebview2.exe	102
PID 4144 wrote to memory of 1048	4144	msedgewebview2.exe	102
PID 4144 wrote to memory of 1048	4144	msedgewebview2.exe	102
PID 4144 wrote to memory of 612	4144	msedgewebview2.exe	103
PID 4144 wrote to memory of 988	4144	msedgewebview2.exe	104
PID 4144 wrote to memory of 988	4144	msedgewebview2.exe	104
PID 4144 wrote to memory of 988	4144	msedgewebview2.exe	104
PID 4144 wrote to memory of 3332	4144	msedgewebview2.exe	105
PID 4144 wrote to memory of 3332	4144	msedgewebview2.exe	105
PID 4144 wrote to memory of 3332	4144	msedgewebview2.exe	105
PID 4144 wrote to memory of 3332	4144	msedgewebview2.exe	105
PID 4144 wrote to memory of 3332	4144	msedgewebview2.exe	105
PID 3316 wrote to memory of 4840	3316	bigimgpin.exe	106
PID 3316 wrote to memory of 1408	3316	bigimgpin.exe	108
PID 3316 wrote to memory of 5012	3316	bigimgpin.exe	110
PID 3316 wrote to memory of 4856	3316	bigimgpin.exe	111
PID 4144 wrote to memory of 2972	4144	msedgewebview2.exe	116
PID 4144 wrote to memory of 2972	4144	msedgewebview2.exe	116
PID 4144 wrote to memory of 2972	4144	msedgewebview2.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\bigImgPin_0.1.1_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Program Files\bigImgPin\bigimgpin.exe
  "C:\Program Files\bigImgPin\bigimgpin.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Reads the TCP/IP host and domain name from the registry
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=bigimgpin.exe --webview-exe-version=0.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3316.3396.1071122418201968653 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView /prefetch:4 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9976a5fd8,0x7ff9976a5fe4,0x7ff9976a5ff0
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --webview-exe-name=bigimgpin.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1784,i,12934565400331649353,13446002686605264810,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --webview-exe-name=bigimgpin.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2224 --field-trial-handle=1784,i,12934565400331649353,13446002686605264810,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a
      4⤵
      PID:612
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --webview-exe-name=bigimgpin.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1784,i,12934565400331649353,13446002686605264810,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --webview-exe-name=bigimgpin.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3340 --field-trial-handle=1784,i,12934565400331649353,13446002686605264810,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a /prefetch:1
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView" --webview-exe-name=bigimgpin.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=1784,i,12934565400331649353,13446002686605264810,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:1435d262f5502ab1b3a930a670f0d6bfd7a3e73a
      4⤵
      PID:2972
- - C:\Program Files\bigImgPin\vips-win64\bin\vips.exe
    "\\?\C:\Program Files\bigImgPin\vips-win64\bin\vips.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4840
- - C:\Program Files\bigImgPin\vips-win64\bin\vips.exe
    "\\?\C:\Program Files\bigImgPin\vips-win64\bin\vips.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1408
- - C:\Program Files\bigImgPin\vips-win64\bin\vips.exe
    "\\?\C:\Program Files\bigImgPin\vips-win64\bin\vips.exe" dzsave
    3⤵
    - Executes dropped EXE
    PID:5012
- - C:\Program Files\bigImgPin\vips-win64\bin\vips.exe
    "\\?\C:\Program Files\bigImgPin\vips-win64\bin\vips.exe" dzsave
    3⤵
    - Executes dropped EXE
    PID:4856

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9B5089D706C0298C11C08D6F400B8CA6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2856
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59dfc8.rbs

Path C:\Config.Msi\e59dfc8.rbs
Size 113KB
SHA256 36946814c87ad678f017924b66fc5d6d8f9fec5ad726b1df64336b401eeb63a5
MD5 3f5e9f361e9781df8de6b0849c1cd4a0
SHA1 bca782b798fd89f1a06f1df17e3e513d60adb2ea
SHA512 2257d988e032a7e0cdbc41525861c052b63d77308410f8a06ec644b1cc2acf4985faf2de96336ae409ca8fe75a357aeefb48ff20aa1ce777705dbe38d9f0b1b2
SSDEEP 1536:pYztoH0qbGW/6euDzgHP00nEmnn8isYXLBswwNNYGVbV893C8MJqjTwXLfOQ0C5n:bQJ
TLSH
T150B33AC15700CA42D1AB5B78FFB75B453B71C49DB389422B1A8C633985E73901FFAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bigimgpin.exe

Path C:\Program Files\bigImgPin\bigimgpin.exe
Size 6.3MB
SHA256 3464fc299a7fba0a9e300bb99e8e15d3e2dcc065a67a43fd8831f7da463a5b8d
MD5 c56d2d5a76fe86f609b674d1aed11f16
SHA1 0cb82098f16ea1110b964021c323dec90a738b67
SHA512 400e767a12157fa78b19bc4c3ee80c659e4137fed603f9a4f0f794fb04a0d23d181b7d618e5cd7207b15429cd87e9a978d4957bb02555100d771f2bfaf32dcd3
SSDEEP 98304:k5jYe62vCW23ps1t/6+ng2KIEmhKM46QS90HmFDSrfpu0Ryif9qhLn+k:KOXpsBnggMHPFubif9A
TLSH
T1DE663943F66290FCC16AC175931A6232FA62BC8947313AEB5BE04B213E55FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libarchive-13.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libarchive-13.dll
Size 592KB
SHA256 79b39771316c892dcc7f85875e1077a3db955b4e5344fdd4b652b34995666c67
MD5 891939a655a62625da845d02d0ef6018
SHA1 56f41161890b54705dbd3bccea7d92c6523a19ce
SHA512 747f6efa08f69d0f4e4b959973aba12e4875430815ee0b944d9fcadc29e8ab07e12a9d710b656e02b6882334cf8cad158f38ed92c77231346f1c2a06d4149cd1
SSDEEP 12288:IEYp0XEOsshiUnIZcQ5lwdmdCT8dAf9MnqfFglK:IDMEuiUnObgmdCgeVMnoFMK
TLSH
T1E3D47C03F6D409B9D41AC2309347A732EA7AF0954E34F6CF17A493213E69EA07B1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcairo-2.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libcairo-2.dll
Size 574KB
SHA256 aedbc7998258b730f25ebdd4eef71d801def85545df115ebb2ce1f4d862d389b
MD5 9693e2b0eaedd011df97864f2a8e5d02
SHA1 da93bf40d32a2638992292d9f16f15df8cecabd2
SHA512 81403261326820a17a880c4b525ca15d175410e31ea09d1387d1fb8928d1c1a7bdbb4a8d2587a46e3730f1687f7dd5701b3fb25c32d0a58a67e84e97dd8ba5c7
SSDEEP 12288:YTv4tuZFXenOKEAht1dV+lY0F4WfYVKGsekSmOrvrZcpQ:Y7XjO+l/PcKnIrvrZc
TLSH
T164C46C03F18148FCD05AD1B1931AAB32F563B4461728A4DF17A04B612EB9BD0BF6FB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcfitsio.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libcfitsio.dll
Size 942KB
SHA256 5c6d9a5f17130c588fac8c9220dff5e4b0e98fac75d2176af34aa47df9dcc5f7
MD5 744acf9a90eadfdd7304fb0c9187a04b
SHA1 bd3676aaabfb97c52660a57e7b07bb4ac51449ae
SHA512 51d320314c543ef2d47758d6549b1572d6f712437bda893c1507dd2393be9d191680d8b6d378bda74cb4a80c3bb0f44f33f4b58ae6562ad4115cd7abdb839d12
SSDEEP 12288:DMFRsjy+LjkNVZEBKTW8le5cvSBd4Gi7A6iFTb+NT1+vXMSrh1mCx43KL:Y3sW4IZsvGSesxFn+32MSrh1jq3K
TLSH
T16E257C07F08201EDC429D1B1531AB333FB31745E6928B59B5F949B642BBAF40BB6E708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcgif-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libcgif-0.dll
Size 22KB
SHA256 883006a07356a2abb7a2fd421e87b826623528c77fbd1a9bd238dd40518bd7e3
MD5 fa2e4e9e8d65ad0cfe2fe6a41758a45e
SHA1 877bcfeb1d003a286bfbafb9c995e67c8474a16a
SHA512 119eb936a57fae64a24a9f4b6e71325fc0fb354709883b3bb9678e367a6701a7da3fa1163fffbfeeb2037974410f5a2cc7e6a99b1049ecb82fb2c37cb0d7919b
SSDEEP 384:GyI/+akFZNTUinVoa4pqnv/geCh03LxfuPU:Gn2amvT1nVoa4UAFYL
TLSH
T1C2A26C47E98763CCE555E13AC3439B2DF6B271160711DAEB8B6183381E31BE1963D790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libexif-12.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libexif-12.dll
Size 217KB
SHA256 f818292091d20aa70a98c2e27f11572f65b95da879bf0d0e53534d88f84fb52e
MD5 d94c88c84429520389759260572d4b39
SHA1 adaca6e43ae4c00c1c4e0c533f49a4f29635f81a
SHA512 239b37e8c1f713053571707a5d86ad3b050c6deb1483bd6030601fbaf059b46b44795729f90a532288473e9d70a21d95579b8ee573829e45e5e080778cddbe7a
SSDEEP 3072:elOOBCLn//1xOLl7oCt2kIQKLL/yS8irDVxM:elOMCL//1xOyeKLLKWD
TLSH
T10B24170777C01E73CD468276A6AB1352A3B6F4598722D39F13480128EE4FBD49FB62C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libexpat-1.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libexpat-1.dll
Size 136KB
SHA256 43d6250ecf146b58f726e9a3b7828454e2b034aca7eb4bf551b233f477654806
MD5 304e98d045b0777c0956b560dc12f67d
SHA1 5b8aa7407b02fccb936072dc7807a66df904713c
SHA512 b753ff67ca852134ff1eb2bdbb6b3c4524329e1965fbd5e2abb3b0892e86e72ea249dc122e4f131568bc42e00b19c343ffb1197fc16d45808f1a050a20e8194b
SSDEEP 1536:m4eVpV+hhOeZsaZsEt9yLzYXgPYCfACkJi33ptMIH6vNHmtMQNFfC0qFgvW5bnWs:6pjUOUXg9fAJU2IavNnkFfC0ogWU
TLSH
T11CD33B13F0C0C26FC446C534A79AD722E679FC621F11A19B1294BA3C6F77BD07A6AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libffi-8.dll
Size 30KB
SHA256 fdaa88ea3fc6cb65e17dbabf630a0853e0b0890e054e18411a1abc61fd1d1f54
MD5 287f0733b21ac0ea8ba065bb992fc51b
SHA1 763d5aaf3b076c0f7e0b67e65f0319f0afb94cd1
SHA512 bb9b755de84dd158b5fdcdeb7fda0510c7369393afae81c442d4c52a42d94e532c65597b6db06ef5dd7c24de0223ca80ed95ffab5acad209cbef329f4827b3f1
SSDEEP 768:x/nowS2j4IsmjZcwV5KukwgJQ1A48sAK:xdSGsmjyw7KfHmA
TLSH
T15DE25B0362E2467CFC96D1389713EF3AE576B4056B121AEF03F661352E706E86B39748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfftw3-3.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libfftw3-3.dll
Size 992KB
SHA256 1ec40c3213ede1e88e100a34a4df2c04b53d95d6be93558ee75151069e4ca675
MD5 574b2111b9902e648f1b53aac6cf3846
SHA1 a496099e41aeb9b98637325db09557d9c692eb87
SHA512 dd50bd584e2dc66035da6088864d8514457d694731f52a15afd5b01b4cb6dd126da88d6eb74a812041ae36ce5e1a86ac9da8b837b9a217055b6e2a8ba655790c
SSDEEP 24576:LItWe3ErIgqCMzEyqyEr53PR7MRZcvPEz0H:gWe3ErIgqCMzEyT83Kmcz0
TLSH
T13525D349F8911D3DF0993AB136B13A12E3653649476C15390B939E582F3EF02BDEB90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libfontconfig-1.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libfontconfig-1.dll
Size 443KB
SHA256 c46b6e4a93975296a25a9ddc0f47998ad874eb6eb55bb319bbd2e418daf00f05
MD5 7d1a795ad571c19c5e6acc9ca60b4d48
SHA1 e366f94305ec314947b035e1b4bdd23d207e271e
SHA512 7684c8a6da92d263f7a01c3024d493a19ce7f2d1cc65b3cd3b8ea6f2ba5e0b506e501ca9f91d8712e57a382b7785f8fadec3e8670b3a4421c3c31c219f014fd1
SSDEEP 6144:zGC8KiYkFeb+bhDIdohD39IbJUDktGeQq49Lt1As3oWmUm6lDk:z58Kiveb+bhqohD3CuwYeQq4Dm6l
TLSH
T163A41807B281C4A9D40581315E47D6EDB5B2BC61CF21A69B37D0B32F3DB16D46B3AB88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgio-2.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libgio-2.0-0.dll
Size 1.1MB
SHA256 ed677f667c981a1165651b353514b32ffc72b4d00419b5446cb9681a69eda1dc
MD5 3f481146ad07256d56aa8c979e057fd7
SHA1 8657b2a6718c55fa7454c107b8e1debf457a7410
SHA512 ec4f7bde494c51370158a4f8fa40c862ae529820699c0b118a455a89eaf9a08803a226afc8cdecb1e9c1fe7cc3b153f77aa0bd558b365e6bc87e4a990da2ea56
SSDEEP 12288:dVkA1izZ7prwCsKZCoHncLPqGn2Pa60qghkwglr3akxdNk248hdpLEyYQQhTlr+G:HkA1iVl0CsAxHncLVn2SLhhi3xEEdCB
TLSH
T19D356B0392C89428C8AEC135D74B6B12BAF5B4960B30B89E067067613BB5FF517AF74D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglib-2.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libglib-2.0-0.dll
Size 1010KB
SHA256 26660b4dd0c0c8064e5cc966bd36e8648246df3972f61dcfc22e8c4e380e3446
MD5 7932d68fe55415d4fae7001681743621
SHA1 962f7da1be925efd853cfbc7ac79026868d90f64
SHA512 56d25e04facc17d4ed9d3b4c8d5ac0080f7493199e9b5491e13c72a4c0d49b447980aa9a651d8adda1c3939c8f675923ab22010bbbed85ac2fa243ec2fdf70bc
SSDEEP 24576:Al7NI1PmoMRikiXyBZtnGItxRrustv/8:u7wPrMUyBZtGSRrXtv
TLSH
T11B254903F2C27CABF785DD7186F297A2E174B8550F33609A3E5CE7212A6DA53161AF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgmodule-2.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libgmodule-2.0-0.dll
Size 19KB
SHA256 a51186a4750e82bba415b5e6c8557f5c8e0c224baecc1f968d18bb29a4f6fd45
MD5 2b44f4c4fa086efc55724da7a9621bb0
SHA1 cc0395f38737295310018dad95bd21ea5e8d0939
SHA512 570c0fc027827b26895a30c31315bdf0bff6b5b1e77a86d452cc424b2bfc20f3cc724ae36dbb408f3afb0a67a39fafa0a637faf3aca9a39ec726cad24fab3d24
SSDEEP 384:MApWfYRSd/TC8ektF3XfuWtpwFLN6mNlVeXmun:MApnR4W0fXtpwFkgm
TLSH
T147925C5156E520AEE94AD23DE533B716E9F2B4570F32A5EF8BA0406C1D30EE14B3CB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgobject-2.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libgobject-2.0-0.dll
Size 212KB
SHA256 010ab8cfb7e9a80d4ead69af7beda5207b75cd55fcc7dff78b34ce0c10f537a9
MD5 c2536d98c5183e1897171586bbd640eb
SHA1 bbeb3dec9075de70ae543a76b2f1df110ec427f9
SHA512 c739fed7b7b7dc99cc9efd44a2a35390ee68594f194de8b416ce4141eb34ef05db6201c6fb5c571df12e1cf95e5df042ae2afd1a2465e0d180e25921b86bd192
SSDEEP 3072:gZh+iY43wb2qBmXhJiRB8lfr7TAcX0hMDPbrzktdWmzXRoSQ8tUoDqNDKkH/pU1b:gL+iY43G2i8tHTP0ba8t/dZcl73EH
TLSH
T1B5244C0773884C3AEC8AC17487479B16E5B3B4591B31F1CF03A543607E7EEA56B2EA49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libimagequant.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libimagequant.dll
Size 62KB
SHA256 45e0e43e3d045deabbb135b8151b7f2e936631397be88dffa41cc373fed7f208
MD5 79cc68bd390491b61be83c1d97f9126a
SHA1 3e3bdd548135f62697621cc8e85c17de70598b4b
SHA512 5f0d36e0390ac1adbb6360bddf0eb6ed56080e0a602cca8e10aa4872701e428d9126d8ca897b0d12472a70665513bda939dabb1ef5f1911ef1252dd45335fb93
SSDEEP 768:eB2rPIDQCD+HjYpharqS+xN7y0XqMEBJpqoMYNMmp5FhK:9iyD3kPEtMS
TLSH
T102537E8F966695FDF125913243A6B617B431B05107149DFF03E083382FB1BE0AA7BE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjpeg-62.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libjpeg-62.dll
Size 582KB
SHA256 6481386d9c66783f4f08bceaaa5e866f54f118fd7e184431561da85483a31f6e
MD5 f539d86f14f8040f93fb0a3609ac37e0
SHA1 a08b4fa79e44a221ab61662b008c9659ab2ad963
SHA512 55b7b788e3b16054e50b1528654fdc4e413fbeb50f92915d23f1486da66b5ff1754fbde66833e5b7fdca3489ae71b1e2ca336de576cb0b743820e10def102e20
SSDEEP 6144:yUipfXd4nTEJ0p0FxXxEC4gL0ZR9s0EQqvX1zgysM+iHCGAY0qE5aaA:ipfXdaTEep4xX6RbSxZMK
TLSH
T1F9C46C0BF2910C9BC7C1C470EF2DE632AF06385EA7F7617971826AD23A17A547B15B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libmatio-14.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libmatio-14.dll
Size 311KB
SHA256 6711f4ed33a8d255ef7f0c953d5743aa3b30308488a8918add9cd7150d924672
MD5 cd8e4a7671fb170cdc2c7fd851a88eb3
SHA1 4f0d0a32c3e8fde3ed8fd77eed47e32aeb32730b
SHA512 7d4f1ded333734a53ae3d4bed18408c7629d00b6448bf7c71570e148f18a4d13b8d0a35126af39589d465c406267fbd657b9a7a2c71417eebe482e874c5ce40b
SSDEEP 6144:DBhuNn4C8h80Pn4grCiAcHdvbfkLKHDF5qfaY51fdTh47XKtcoqesuqeoiNf:DBw94/h80Pn4grCiA+dvbfk2HDfqfaYL
TLSH
T1DD645A4774C9C8BCC498D176454A6733F46B748A87347CEF2BA46E242AA6F50262F7CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpango-1.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libpango-1.0-0.dll
Size 330KB
SHA256 26eefab38680efeb8861ce62d2fa9496e4df67ffcac732cef9a7aaecb97a06c3
MD5 d9d622b3c223265316c18bed193cfffa
SHA1 2b4382475a7e27500a555fd52151293cf0c9b94e
SHA512 dcb21e7fd8c49dc3b00b5d02774b789b32c69179a7fba824df15ba3a0b33a4abf4941d5d4a9ea709ea391d4d5dc40366406d3c70a32b6831a2c3c00e277b2b91
SSDEEP 6144:UdHNHbAADALp1PzsLBK/pv3CC8q3998+AhEV/5pwYmuBHUF4Jsu//u6Ql4lRmWoE:EwqYTBHw46u/Wxl4lRmWo1z7BI/
TLSH
T1AA747C0BE68454F9E846C03D965BE312A6B8B0794750E1EB5B9152207EB5FE03E3FB0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpangocairo-1.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libpangocairo-1.0-0.dll
Size 52KB
SHA256 5a9a06dd3f49f23b1c52dec406fe7899cb00d984f948d54dc2807d4b64a6a319
MD5 8f89508b37258c7e89bad00cf9609656
SHA1 215801b4a417736f1aef3e5f41e821b673b93cf1
SHA512 e908f899f5daa927a4ff2ba100aee3749db5a6bc2c589e19ac721a30c5dd99c6af8c3702a5185c32044eec181312f15ad5d7c1f63a41a6b125730b6bf6a4af2c
SSDEEP 768:524M6BM+QCXDqdvCsi2+ibyZWorpOW7Qfc5alX+lXFtTd4LU:U4bBMTvCsi2FbyZLO60lX+lXFtJ4L
TLSH
T136334B0B685088EDF4CAA53C927276139521BA78075591EF83D2112D6FA0FF4F5BFA83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpangoft2-1.0-0.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libpangoft2-1.0-0.dll
Size 75KB
SHA256 778f6f2b58be56ca834b0f7b7a74775255917f5e4c130e5d70bbe5f87a73e039
MD5 227fbdea2816aa2a694a63b6008640f5
SHA1 60b24d8108b8c6e72d4ecf8741d313ba814276d5
SHA512 8d4038d35c21adb55f09d790244663e7a7eeec1ea54565a6c1b5cac48b82a9a67f2e65335e984e5107422e659a8361cc9dbc30854924671d80006413011fdb88
SSDEEP 1536:1XBBlT9Dk0Ku+5d/952tgiX1SsjuAozkhH:nBj3Ku+5d/9otgiIsKAocH
TLSH
T17D733A064C8440DCE88EC53EA361A6129735B6754720A7EF0BB166246FA1BF43E7F6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpng16-16.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libpng16-16.dll
Size 178KB
SHA256 f3d4e96d35199c5e768787d4c02781f94a01d298dd2c63f41980eac0ebcd40c2
MD5 e5ff83bdbf892432450f00119071f0b7
SHA1 5091adefecfb7d211073c66eb8c46d10f18c98d3
SHA512 cc26f6bd52d5a9954db3533ad27199c8d91dce359523a4dec88f1a6d2362795f4639ef34ee6680782d120a11e69f5fc951ec0bc4f0e80f6ea6132ff8742c525b
SSDEEP 3072:V1zj0lisMWImpAfA8/3JDHS7KX86Jwc8MdDldjvpFlBbfrQrfmFo:HbsfutDYKX8vM5nxF0
TLSH
T16904BF43F19484BDC08BC2B49316E621F1BA34651338BADF0784677075A6BE47B3BB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

librsvg-2-2.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\librsvg-2-2.dll
Size 2.5MB
SHA256 31d7fd83819751232c5e71693b50e9f15f8136b928763d8b438506840892ab84
MD5 e4c189d226aec7456c9aca1cdfeba473
SHA1 12f6f70ccb4ed7002db00c36c7cfb7f71e616902
SHA512 7d4e7c6912da940bce51b90e610cd8e5f7d432dd47add66f9c667c707060c16d32306a45f7c2ef1c90491011c741a8f9898a8744e1722cfcd40d40184afdd35f
SSDEEP 49152:kIss+Xc0yK/Gi/azMLxEDpgA/X1bytv1xHo0nqSXwvg4i:NHHzM+jqnqSXw
TLSH
T15AC56E03FFA281E8C4DDC1B8876B5632A732BC8D4621739B27D41B213E57B915B8E359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtiff-6.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libtiff-6.dll
Size 409KB
SHA256 8d24f437fc308cd5b18b21a38cbb0f153bd0404a3563b77f8eebf4b892baad50
MD5 a30f7d14be71bbdd86c3cc4b7aa4d895
SHA1 3cc4f880b87d3f9adbda3db4d2335cb892c73679
SHA512 088144fa3d8eaaa6657288fe2019043585d2f688f33dad8042305a730bacbb000c60647fc2e81d97b2bfed55387bf959af39449858ee3b264003f7c278fe0fb0
SSDEEP 6144:JAjL5uAeQjBmNEHPIyzUlPqIbgN/GJNA:J2eQVmNEvIyzUmNEA
TLSH
T166949306DEC049ABC875817556E78221F273F48A7F02E75BA74871303E527D02A9B6FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libuhdr.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libuhdr.dll
Size 301KB
SHA256 e36a1ca2143ee3c4569857997a5f26a1654ac3691d609f0edf30e791a5b91968
MD5 1da42af116e0e406243ba1a6a20595f5
SHA1 a2406461ab39070b6692fcd417e37405f785e8f3
SHA512 4569e648e701f05372288071b8d2b2fd21f4a4bcc2e39552a214f1e8ac512626420f03e8220cfcaa1752c22eb515179b68ef181aa14812dce93604201f67bdc0
SSDEEP 6144:fzqbuu+12pxml4s+fF2PqEhdo6vAKXMVGjcVYOv:fzqbuuu6xmEjEbo6o5v
TLSH
T1D7646B07E35690EDD4A9C17A5387A226FF71B8858720F9DB17A083252FE1FE0673A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libvips-42.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libvips-42.dll
Size 2.6MB
SHA256 e4f34196452e87e2b151af285b17aef82266bada19ae9c78657d0cf2a377efb5
MD5 77d8c5c93d2807e9f4f84e485d0df9f7
SHA1 a382a1cc9cef54f216acb0c3b6c7e1897edf0ae4
SHA512 fbc867ab5bf8e821a89085b1af2fa46cc03c7b4d64b4486bf5906332460f66ce976a7b771e2f10bcc6e0bdcf9416d72812a4d618af58f83c5fb396b656cac781
SSDEEP 49152:q8XlvenV0n8PymOu90eVxxN1MF9ZrqynSlx83MSV02klJ0QXAVmC1LD/X8zsSQwj:LvenV0n8PymOu90eVxxN1MF9ZrqynSwt
TLSH
T145C59D5BE69250ECCD2BD271835A3222B15031994B347CEB0661C6353E76FE02B7BF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebp-7.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libwebp-7.dll
Size 373KB
SHA256 fdebbdf151bd1c3df5c5a18b9b24979fa48e5b3f40cdbb76cbab7b4cdd933813
MD5 4d1d803a253c3af7134b102626d9d537
SHA1 4e5b91736787223df810c57b3a4e66b2e533bb8e
SHA512 2b64092ca309d5454618318bb3c159f7fc5844187e314d9214e051e939e02ad44d7e093b14346e631f92c1537043902349d7a116ea2d7cdf2043fc4b796ca185
SSDEEP 6144:Q4sird3QQH4XuvcPtTf8IIjfQBGGPj8o+jzLTm3Yele+GV4W:z3LHcKhjfQAZo+jzLTq/
TLSH
T17D847C0FE146244DD84BC9748A2E6322F61D3D1E8798B19E13977E30BA767C09B1BF09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebpdemux-2.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libwebpdemux-2.dll
Size 18KB
SHA256 8a9080009642a7e9654b7dcdbeb8fa83c2cf5650f92b52a107ea1871d5a9ef6c
MD5 874ce20262b27d689fb498e465c86b68
SHA1 f99a0d11826452a9323cd4dbd790cf329be9e774
SHA512 9d7e1b53e4cd2ebb4b4b32fdcdbaedb5b8ea6ca429c5adf7de076d127af9d1633834f60d1497372a9f2e379d6af4aab49e50870dc529970a76f246de7e27db2c
SSDEEP 384:1DNOAqEU6nt/1gGtUE8mtbnM6u1P5WJ34za:1ZOApt1Ny6u3WD
TLSH
T100826D83BFAA206FE846C0379113AB39D9B2B05017254DEB1391DD7D4E747D0AE3C999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwebpmux-3.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libwebpmux-3.dll
Size 34KB
SHA256 cb2f2e90ca17807e8d2b323cc4e9e8f3ae6d8cf48d926fcda56ecabaea36c22a
MD5 bce778326bb40915431a9f7d3d16ec30
SHA1 38010a528efb0badd0ee6e8ce4f31e4ef0b24020
SHA512 08a9dc01d254486cd9daf65f6738b157a9b19d4b30368d2c6854db69df7baf95fbe9f15552b8360e997e0543a19e3f0b2fd02b45dfa445a46b35bd0e811a549c
SSDEEP 768:+ta4PFZBuUBU0Soce4RsY6Pjb3rHeQU1Z7QlOFzI:+lFZBugSocTiYGjb3rHluZ84FzI
TLSH
T1AFF24A03A79140BCE869C076836ADB69EA71B8451B10D5EF179143193E72FF0AB3F1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libz1.dll

Path C:\Program Files\bigImgPin\vips-win64\bin\libz1.dll
Size 197KB
SHA256 4aacea95976b8e5b9a937ab0d298f3e458ab732355b89bd1657af63e5bdc7fc0
MD5 41e059364c5262ab2e952b487bcb1d44
SHA1 1664cd6b3897cb138d7b5f065d8ee583ea9ff344
SHA512 757e9d5c1bb32d6610718f143dab9b9cc1907b951c92c340afde5f9a6649bb7fb83af8b0001341cbc14f88327ff63649e43ee4a40cbd3cbebeec9a9e1d4166f5
SSDEEP 3072:eSi7KjiR4trb0AFjDX3aSEOz0yroYDawa5ewz0N2Ku76kOknBTEOblzRh2HoQA:eSGOfrztJEOz0yNatlKYBTteoQ
TLSH
T10314AE4BF5A248ECC477C271C6DA9762F52578644700ADEB4340CE712A67FE06638FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vips.exe

Path C:\Program Files\bigImgPin\vips-win64\bin\vips.exe
Size 21KB
SHA256 7781e4d7118de8598bfcbaec88840ccffef00c802084a0f6a711d683a5d847c9
MD5 f4f94a1462a7121c4e2dfb4beb9a659b
SHA1 dd6bb45e6934676ccc1cec3f6e53b97ad223cd54
SHA512 5a681dfd4c0c4e8ad6db509de90ef38bc798ee858d0a80c4ac8b8319f1f2b2d177186bafa52e2bf891b8e0364c0257d0507dd382d42dea3f0fe9de052858bc20
SSDEEP 384:DaLEqFwbTSEN0xjDusXEcSw7qzyARNlx1TWu:ygTSM6jDAct7qzyIW
TLSH
T125A21925154166EEFC9F823AC0517625F2B0FA962B31B1EF4392A3252F70BF55FB4482
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bigImgPin.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bigImgPin\bigImgPin.lnk
Size 1KB
SHA256 9e9fe5870d61d5c83d42a23131248a9bfc4fa200f219513c2a44a2326b7c067a
MD5 32e0baed20dbdeaf465dc7ab308c3789
SHA1 5dd9bc5b5632f8d2447edda8f5660ac108829ff5
SHA512 a4e2673db7a504ea5674857e459d43abbfab4b3662778b7fbca71c6fdacad3b037112b91fdf7368303000817e340993d6da2cf72742f40943ca7bcbf508b7b21
TLSH
T1F541C42456E9075EF3F347365AA14A31D671FC02B7254F2B40C5038C0968541E9B8F7F
MD5 SHA1 SHA512 TLSH

Submit Download

~igImgPin.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bigImgPin\~igImgPin.tmp
Size 2KB
SHA256 579a0442f4ddb4a90055704db49dfa4ff2ec139ff896e298eda3f584669c2154
MD5 344897f50a4a265fcfcca1e4241a591c
SHA1 f61557fe09274132c10229b5238e2a7409300bb1
SHA512 869116be8ab5b568d33de8310afce6389e905102af20b5771c2d7e41810bb6e7f259c9ec80b764ee390ca76ff0d6db406ee52f9116d1fa1c394526b6cd71ac73
TLSH
T17A41A02456E9175EF3F347365AA14A21D675FC02F7294F2B41C5028C0DA8541E9BCF7B
MD5 SHA1 SHA512 TLSH

Submit Download

MSI8004.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8004.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a79be85-dd4b-40f4-971d-7e6c9d19fe95.tmp

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\1a79be85-dd4b-40f4-971d-7e6c9d19fe95.tmp
Size 15KB
SHA256 62fd763fd9d24b6e30aa413140d6525ee14c4c5c15cc38d7d1c120e14f53eb18
MD5 bdfd8b46f76fe1a018dfc84eb09deafc
SHA1 f44032b5fc7d7141178a2f000873d41c36edb16e
SHA512 956176ef4e87232d553313f2dc1ef9e54618aa3ff3daa6311f0ef0c1b3194a4853c32fb853ef6734341f1253930b2bb1aa11bce18d5b49783592d2558d5b23e7
SSDEEP 384:J+OBqImmJvGBLx3NaFMJF4NBSrlKvfjEkIg6r2:kcvGtlNJuQkmK
TLSH
T16872AF7A28B96E373CF7890A7A8D2747CB6462A3C0D57BE8D9EC4F0F016E4841391C55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2459993b-0091-4e0d-ace1-f511f159baea.tmp

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\2459993b-0091-4e0d-ace1-f511f159baea.tmp
Size 2KB
SHA256 aa50d6cbe8844491fede32880dad25652c3d2d2fadeea2bfbe1aa0e35da11e06
MD5 7b3db32bc68998c46b82b502e9ddfda6
SHA1 d732405b7229bc1bf2233fba3b6fe2affb5f52b0
SHA512 bb3013bf43dd5ae61e31473634963702793ae2191762434f625266c0cb34566dd91f47c855dd3c262986e1adda4baf33773a84fba5d5e649bca1915c9ce092c3
TLSH
T18851A5B36864BA3799F24A09794A2F23DF3960B6DA562F309ADD0B0C00D755C5382C3B
MD5 SHA1 SHA512 TLSH

Submit Download

9d52121a-cec1-478b-966d-a4f1b7f79e50.tmp

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\9d52121a-cec1-478b-966d-a4f1b7f79e50.tmp
Size 3KB
SHA256 72f7f6d0b2248592f1182a55873e338ab46cd3a8e26f62cea613b69d660db1f5
MD5 e035f166718ff3df4257248af49a9b8f
SHA1 94b3a3c9b2a8d530d1d4069b5aff82b6a2d4123c
SHA512 5ffcfb6aa465e9a4a41fd7a26d8fed5528db6235e29a9c49648276d29e08f363a525e5c8f18af604d8c285b73af23391320314a88e5ae40a78a5bd2510c95921
TLSH
T1FE61846769B4A93B4EF28A05B8862F17FB655037D5853F68D6EC0F0C01D729C1382C2B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 05880a922bce684102231e5442753fac42d7b310fc5b3f5a30108a5ca0a2dd78
MD5 b62d16d8434a8875f01cfcf3fc59b75e
SHA1 b6bc0685b184fb42b698aafe161fbc70b0ac3535
SHA512 47fdeb77fe0fdee0826e42ebb292e8949491f8bad6f699d436f5ff8e97825c126c7650b45187f35bc0065c6de943ae51640904c1bcd2a36e34e7f85e7a22030e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 92d9c849a1b4964ac5ff0de26d9c29eeceaf7bf25a4a669f434fd3b87873075b
MD5 1241c5907f5f12114df7f33958499edd
SHA1 cd3863f10ffd73dc521e47f28bf5acf21256bc47
SHA512 6320cbc87cc009908bb44c6da87d944832731388958cbf49bc33b179bd0edd195d3ecf61dfd290ba4d3b3b80abdfb0d02a54d4bde348ab9acd9e0514e2dd8b8d
TLSH
T157D0121772110674C41029330502A10C0640E90B424580417428DA1D2B14C540D07441
MD5 SHA1 SHA512 TLSH

Submit Download

44da7d89-3a6c-4dee-8c33-ea9fade13775.tmp

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\44da7d89-3a6c-4dee-8c33-ea9fade13775.tmp
Size 6KB
SHA256 7e40b560c821555f550b411c90ae2267b88ee5335acc01767cfd0a5ddcb7bfe7
MD5 b8adfa16e90cb89aed81724cca8d461f
SHA1 546edccb5f71968eb19b60281b51ed2f1026b68e
SHA512 a178d9f68a22e604a99e9d15cd8d7f1b390aa4bc6639e641949ac2e2c0a5215cebd15e37067f48529b9ed9a5ce23f0a41994e750d1c099cef667d9984a8b1e3f
SSDEEP 96:str/dyKH5b95kmo5h16Z06s7/x+6MhmuecJhh1ejerK+gB28XM1C7K:stzMyNon6sV+FdhhQjl/G6K
TLSH
T1DBD1A6456E68797B4CC6E109BA397E07E3F9607264D92D58EBF8462C04DAACC3307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 8f64e11121c36e4a54b076eddc4021efd92fe1d64541044f926bb0ccfd7d95a8
MD5 51c37ff640c14987526c6363a606a521
SHA1 32f2858590f1cddca72dce40bb4f3d005f78268a
SHA512 1e64b00249d24e947e722380b568d20cec029a59308f0e6f9b305e52a1ad263f8d108c545ebe3e9d892c09b46f1c190fbd64b45798c489df404eeca4454461c5
TLSH
T109A002645341C413C229077011E106A132384D7416470716D0D55179DE547E26643535
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 239164fbb472aff89a6ce046aa2dd45ff0f032fcbe4bdfa42eed4ca20b066403
MD5 fae6264f42ec0d67a85ba2010e789ce2
SHA1 afa43069a8341dd8690636973c69157ad9f32f90
SHA512 b2bf53824092716f5151af384d8b0ccad12e2d4b96f550453217289d95dd13c63d27b46c7fbe03e9dad0bf6eb458796aba74e40f6e11b6d8e62ace4ab896d171
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f8de8768-0bac-4544-a0b7-e4c996268d0a.tmp

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Network\f8de8768-0bac-4544-a0b7-e4c996268d0a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.liuliyi.bigimgpin\EBWebView\Local State
Size 1KB
SHA256 d6d0c2d00875be0fb807d8aa4da0dc19966ab64b7852ed7a3791b1285044ad84
MD5 ecc422bf55c9d81ddad028c648eda2ea
SHA1 a25def2ac17b8cf410b8799db6d865e40d2d8e9a
SHA512 31d6227ea3aa20dfae399f9471acbebfe45d84b8e3b59f0ae2deabd564d99066d2871dc1aad69ae38d652399a75a7d82167d29121b64e696d0186253b22e183c
TLSH
T1AE2192F3E8F05B33ACA0160A315A6F57EE30207AC2144E1862DE4B1C05E209CD1A6C3B
MD5 SHA1 SHA512 TLSH

Submit Download

e59dfc9.msi

Path C:\Windows\Installer\e59dfc9.msi
Size 20.1MB
SHA256 42cb138a9da77a959da18c66e0625e0de3f9f5a5c8e5e28aa4c7ece67b88247f
MD5 253841eaa92fd5f14dce283fb189ac42
SHA1 81332371dd42de2c9bc62b8b0746f5a4487ccc15
SHA512 1fe1683502c3f589b6a6083001c696eb620cd6f98e5a3d945bd2725c413cbbb4b0428a9d1fa995253fa787bb634c16080c48fcec698f329c1cac69bd6fadd115
SSDEEP 393216:+e17h21xhNFABOjHWbo9EO6wWaFlnKbkNLohlkujS8W:97hYhNigjHUO6wWwl7ShSu28W
TLSH
T19627338BBE81E5C6D42A4E3018708B68E9747C5448A804573AA473BDFDFB6CD677E1C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1499020211\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1048-233-0x00007FF9BAFC0000-0x00007FF9BAFC1000-memory.dmp

Download

memory/1408-417-0x00007FF997D00000-0x00007FF997FEA000-memory.dmp

Download

memory/1408-418-0x00007FF993F50000-0x00007FF99404C000-memory.dmp

Download

memory/1408-423-0x00007FF999320000-0x00007FF99949D000-memory.dmp

Download

memory/1408-416-0x00007FF994690000-0x00007FF9946E1000-memory.dmp

Download

memory/2972-540-0x00007FF9BC2B0000-0x00007FF9BC2B1000-memory.dmp

Download

memory/2972-541-0x00007FF9BB480000-0x00007FF9BB481000-memory.dmp

Download

memory/3332-256-0x00007FF9BAFC0000-0x00007FF9BAFC1000-memory.dmp

Download

memory/3348-9-0x0000027E08FA0000-0x0000027E09944000-memory.dmp

Download

memory/4840-422-0x00007FF999320000-0x00007FF99949D000-memory.dmp

Download

memory/4840-421-0x00007FF993F50000-0x00007FF99404C000-memory.dmp

Download

memory/4840-420-0x00007FF997D00000-0x00007FF997FEA000-memory.dmp

Download

memory/4840-419-0x00007FF994690000-0x00007FF9946E1000-memory.dmp

Download

memory/4856-431-0x00007FF994320000-0x00007FF99449D000-memory.dmp

Download

memory/4856-430-0x00007FF994510000-0x00007FF99460C000-memory.dmp

Download

memory/4856-429-0x00007FF994610000-0x00007FF9948FA000-memory.dmp

Download

memory/4856-428-0x00007FF9998A0000-0x00007FF9998F1000-memory.dmp

Download

memory/5012-427-0x00007FF994320000-0x00007FF99449D000-memory.dmp

Download

memory/5012-426-0x00007FF994510000-0x00007FF99460C000-memory.dmp

Download

memory/5012-425-0x00007FF994610000-0x00007FF9948FA000-memory.dmp

Download

memory/5012-424-0x00007FF9998A0000-0x00007FF9998F1000-memory.dmp

Download