Technical Information
Malicious functions
Injects code into
the following user processes:
- pgloader.exe
Modifies file system
Creates the following files
- %TEMP%\nswca71.tmp\system.dll
- %TEMP%\nswca71.tmp\app-64.7z
- %TEMP%\nswca71.tmp\nsis7z.dll
- %TEMP%\nswca71.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nswca71.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nswca71.tmp\7z-out\icudtl.dat
- %TEMP%\nswca71.tmp\7z-out\license.electron.txt
- %TEMP%\nswca71.tmp\7z-out\licenses.chromium.html
- %TEMP%\nswca71.tmp\7z-out\locales\af.pak
- %TEMP%\nswca71.tmp\7z-out\locales\am.pak
- %TEMP%\nswca71.tmp\7z-out\locales\ar.pak
- %TEMP%\nswca71.tmp\7z-out\locales\bg.pak
- %TEMP%\nswca71.tmp\7z-out\locales\bn.pak
- %TEMP%\nswca71.tmp\7z-out\locales\ca.pak
- %TEMP%\nswca71.tmp\7z-out\locales\cs.pak
- %TEMP%\nswca71.tmp\7z-out\locales\da.pak
- %TEMP%\nswca71.tmp\7z-out\locales\de.pak
- %TEMP%\nswca71.tmp\7z-out\locales\el.pak
- %TEMP%\nswca71.tmp\7z-out\locales\en-gb.pak
- %TEMP%\nswca71.tmp\7z-out\locales\en-us.pak
- %TEMP%\nswca71.tmp\7z-out\locales\es-419.pak
- %TEMP%\nswca71.tmp\7z-out\locales\es.pak
- %TEMP%\nswca71.tmp\7z-out\locales\et.pak
- %TEMP%\nswca71.tmp\7z-out\locales\fa.pak
- %TEMP%\nswca71.tmp\7z-out\locales\fi.pak
- %TEMP%\nswca71.tmp\7z-out\locales\fil.pak
- %TEMP%\nswca71.tmp\7z-out\locales\fr.pak
- %TEMP%\nswca71.tmp\7z-out\locales\gu.pak
- %TEMP%\nswca71.tmp\7z-out\locales\he.pak
- %TEMP%\nswca71.tmp\7z-out\locales\hi.pak
- %TEMP%\nswca71.tmp\7z-out\locales\hr.pak
- %TEMP%\nswca71.tmp\7z-out\locales\hu.pak
- %TEMP%\nswca71.tmp\7z-out\locales\id.pak
- %TEMP%\nswca71.tmp\7z-out\locales\it.pak
- %TEMP%\nswca71.tmp\7z-out\locales\ja.pak
- %TEMP%\nswca71.tmp\7z-out\locales\kn.pak
- %TEMP%\nswca71.tmp\7z-out\locales\ko.pak
- %TEMP%\nswca71.tmp\7z-out\locales\lt.pak
- %TEMP%\nswca71.tmp\7z-out\locales\lv.pak
- %TEMP%\nswca71.tmp\7z-out\locales\ml.pak
- %TEMP%\nswca71.tmp\7z-out\locales\mr.pak
- %TEMP%\nswca71.tmp\7z-out\locales\ms.pak
- %TEMP%\nswca71.tmp\7z-out\locales\nb.pak
- %TEMP%\nswca71.tmp\7z-out\locales\nl.pak
- %TEMP%\nswca71.tmp\7z-out\locales\pl.pak
- %TEMP%\nswca71.tmp\7z-out\locales\pt-br.pak
- %TEMP%\nswca71.tmp\7z-out\locales\pt-pt.pak
- %TEMP%\nswca71.tmp\7z-out\locales\ro.pak
- %TEMP%\nswca71.tmp\7z-out\locales\ru.pak
- %TEMP%\nswca71.tmp\7z-out\locales\sk.pak
- %TEMP%\nswca71.tmp\7z-out\locales\sl.pak
- %TEMP%\nswca71.tmp\7z-out\locales\sr.pak
- %TEMP%\nswca71.tmp\7z-out\locales\sv.pak
- %TEMP%\nswca71.tmp\7z-out\locales\sw.pak
- %TEMP%\nswca71.tmp\7z-out\locales\ta.pak
- %TEMP%\nswca71.tmp\7z-out\locales\te.pak
- %TEMP%\nswca71.tmp\7z-out\locales\th.pak
- %TEMP%\nswca71.tmp\7z-out\locales\tr.pak
- %TEMP%\nswca71.tmp\7z-out\locales\uk.pak
- %TEMP%\nswca71.tmp\7z-out\locales\ur.pak
- %TEMP%\nswca71.tmp\7z-out\locales\vi.pak
- %TEMP%\nswca71.tmp\7z-out\locales\zh-cn.pak
- %TEMP%\nswca71.tmp\7z-out\locales\zh-tw.pak
- %TEMP%\nswca71.tmp\7z-out\resources\app\cs2fetchicon.png
- %TEMP%\nswca71.tmp\7z-out\resources\app\dashboard.html
- %TEMP%\nswca71.tmp\7z-out\resources\app\dashboard.js
- %TEMP%\nswca71.tmp\7z-out\resources\app\icon - kopi.ico
- %TEMP%\nswca71.tmp\7z-out\resources\app\icon.ico
- %TEMP%\nswca71.tmp\7z-out\resources\app\index.html
- %TEMP%\nswca71.tmp\7z-out\resources\app\injection\binding.gyp
- %TEMP%\nswca71.tmp\7z-out\resources\app\injection\build\release\injection.node
- %TEMP%\nswca71.tmp\7z-out\resources\app\injection\injection.cpp
- %TEMP%\nswca71.tmp\7z-out\resources\app\injection\injection.h
- %TEMP%\nswca71.tmp\7z-out\resources\app\injection\injection_binding.cpp
- %TEMP%\nswca71.tmp\7z-out\resources\app\injection\package.json
- %TEMP%\nswca71.tmp\7z-out\resources\app\login.css
- %TEMP%\nswca71.tmp\7z-out\resources\app\login.html
- %TEMP%\nswca71.tmp\7z-out\resources\app\login.js
- %TEMP%\nswca71.tmp\7z-out\resources\app\main.js
- %TEMP%\nswca71.tmp\7z-out\resources\app\package.json
- %TEMP%\nswca71.tmp\7z-out\resources\app\renderer.js
- %TEMP%\nswca71.tmp\7z-out\resources\app\styles.css
- %TEMP%\nswca71.tmp\7z-out\resources\app\whitelist.html
- %TEMP%\nswca71.tmp\7z-out\resources\app\whitelist.js
- %TEMP%\nswca71.tmp\7z-out\resources\injection\build\release\injection.node
- %TEMP%\nswca71.tmp\7z-out\resources.pak
- %TEMP%\nswca71.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nswca71.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nswca71.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nswca71.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nswca71.tmp\7z-out\ffmpeg.dll
- %TEMP%\nswca71.tmp\7z-out\libegl.dll
- %TEMP%\nswca71.tmp\7z-out\libglesv2.dll
- %TEMP%\nswca71.tmp\7z-out\pgloader.exe
- %TEMP%\nswca71.tmp\7z-out\resources\elevate.exe
- %TEMP%\nswca71.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nswca71.tmp\7z-out\vulkan-1.dll
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\chrome_100_percent.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\chrome_200_percent.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\d3dcompiler_47.dll
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\ffmpeg.dll
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\icudtl.dat
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\libegl.dll
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\libglesv2.dll
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\license.electron.txt
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\licenses.chromium.html
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\pgloader.exe
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\snapshot_blob.bin
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\v8_context_snapshot.bin
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\vk_swiftshader.dll
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\vk_swiftshader_icd.json
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\vulkan-1.dll
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\af.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\am.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\ar.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\bg.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\bn.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\ca.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\cs.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\da.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\de.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\el.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\en-gb.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\en-us.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\es-419.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\es.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\et.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\fa.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\fi.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\fil.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\fr.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\gu.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\he.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\hi.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\hr.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\hu.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\id.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\it.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\ja.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\kn.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\ko.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\lt.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\lv.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\ml.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\mr.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\ms.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\nb.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\nl.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\pl.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\pt-br.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\pt-pt.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\ro.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\ru.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\sk.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\sl.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\sr.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\sv.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\sw.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\ta.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\te.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\th.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\tr.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\uk.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\ur.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\vi.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\zh-cn.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\locales\zh-tw.pak
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\elevate.exe
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\cs2fetchicon.png
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\dashboard.html
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\dashboard.js
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\icon - kopi.ico
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\icon.ico
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\index.html
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\login.css
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\login.html
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\login.js
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\main.js
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\package.json
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\renderer.js
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\styles.css
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\whitelist.html
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\whitelist.js
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\injection\binding.gyp
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\injection\injection.cpp
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\injection\injection.h
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\injection\injection_binding.cpp
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\injection\package.json
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\app\injection\build\release\injection.node
- %TEMP%\39r7j5pmcj6elgbksupzxmvktyu\resources\injection\build\release\injection.node
- %TEMP%\nswca71.tmp\stdutils.dll
- %APPDATA%\pgloader\code cache\wasm\index
- %APPDATA%\pgloader\local storage\leveldb\log
- %APPDATA%\pgloader\code cache\js\index
- %APPDATA%\pgloader\local storage\leveldb\manifest-000001
- %APPDATA%\pgloader\code cache\wasm\index-dir\temp-index
- %APPDATA%\pgloader\code cache\js\index-dir\temp-index
- %APPDATA%\pgloader\gpucache\index
- %APPDATA%\pgloader\gpucache\data_0
- %APPDATA%\pgloader\gpucache\data_1
- %APPDATA%\pgloader\gpucache\data_2
- %APPDATA%\pgloader\gpucache\data_3
- %APPDATA%\pgloader\dawncache\index
- %APPDATA%\pgloader\dawncache\data_0
- %APPDATA%\pgloader\dawncache\data_1
- %APPDATA%\pgloader\dawncache\data_2
- %APPDATA%\pgloader\dawncache\data_3
- %APPDATA%\pgloader\local storage\leveldb\000001.dbtmp
- %APPDATA%\pgloader\shared dictionary\cache\index
- %APPDATA%\pgloader\shared dictionary\cache\index-dir\temp-index
- %APPDATA%\pgloader\network\trust tokens-journal
- %APPDATA%\pgloader\shared dictionary\db-journal
- %APPDATA%\microsoft\spelling\en-us\default.dic
- %APPDATA%\microsoft\spelling\en-us\default.exc
- %APPDATA%\pgloader\network\trust tokens
- %APPDATA%\microsoft\spelling\en-us\default.acl
- %APPDATA%\pgloader\network\cookies-journal
- %APPDATA%\pgloader\shared dictionary\db
- %APPDATA%\pgloader\cache\cache_data\index
- %APPDATA%\pgloader\cache\cache_data\data_0
- %APPDATA%\pgloader\cache\cache_data\data_1
- %APPDATA%\pgloader\cache\cache_data\data_2
- %APPDATA%\pgloader\cache\cache_data\data_3
- %APPDATA%\pgloader\network\cookies
- %APPDATA%\pgloader\79b08718-817a-4124-8216-5d3b235f20e9.tmp
- %APPDATA%\pgloader\2c2b5c33-02ee-4f3b-979d-0ba77a4b10e2.tmp
- %APPDATA%\pgloader\network\d183b2d9-3d1b-43b4-8071-b26d1deedf39.tmp
- %APPDATA%\pgloader\network\f49ba817-1d61-4289-b3e2-4b49c08a134d.tmp
- %TEMP%\00f969d1-2092-4e78-b8e1-923840db4ec2.tmp
- %APPDATA%\pgloader\cache\cache_data\f_000001
- %APPDATA%\pgloader\network\70541e29-2c87-476e-9986-61c91d45d612.tmp
Moves the following files
- from %APPDATA%\pgloader\code cache\wasm\index-dir\temp-index to %APPDATA%\pgloader\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\pgloader\code cache\js\index-dir\temp-index to %APPDATA%\pgloader\code cache\js\index-dir\the-real-index
- from %APPDATA%\pgloader\shared dictionary\cache\index-dir\temp-index to %APPDATA%\pgloader\shared dictionary\cache\index-dir\the-real-index
- from %APPDATA%\pgloader\local storage\leveldb\000001.dbtmp to %APPDATA%\pgloader\local storage\leveldb\current
- from %APPDATA%\pgloader\79b08718-817a-4124-8216-5d3b235f20e9.tmp to %APPDATA%\pgloader\local state
- from %APPDATA%\pgloader\2c2b5c33-02ee-4f3b-979d-0ba77a4b10e2.tmp to %APPDATA%\pgloader\preferences
- from %APPDATA%\pgloader\network\d183b2d9-3d1b-43b4-8071-b26d1deedf39.tmp to %APPDATA%\pgloader\network\network persistent state
- from %APPDATA%\pgloader\network\f49ba817-1d61-4289-b3e2-4b49c08a134d.tmp to %APPDATA%\pgloader\network\transportsecurity
Network activity
Connects to
- 'dn#.google':443
- '64.##3.161.95':443
- 'ra#.####ubusercontent.com':443
- 'di##ord.com':443
TCP
Other
- 'dn#.google':443
- '64.##3.161.95':443
- 'ra#.####ubusercontent.com':443
- 'di##ord.com':443
UDP
- DNS ASK dn#.google
- DNS ASK ra#.####ubusercontent.com
- DNS ASK di##ord.com
- 'dn#.google':443
- '74.##5.131.94':443
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%TEMP%\39r7j5pmcj6elgbksupzxmvktyu\pgloader.exe'
- '%TEMP%\39r7j5pmcj6elgbksupzxmvktyu\pgloader.exe' --type=gpu-process --user-data-dir="%APPDATA%\pgloader" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAg...
- '%TEMP%\39r7j5pmcj6elgbksupzxmvktyu\pgloader.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\pgloader" --mojo-platform-channel-handle=1924 --field-trial-ha...
- '%TEMP%\39r7j5pmcj6elgbksupzxmvktyu\pgloader.exe' --type=renderer --user-data-dir="%APPDATA%\pgloader" --app-path="%TEMP%\39r7j5PMCJ6ELgBksupZXmvktYu\resources\app" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-...
- '%TEMP%\39r7j5pmcj6elgbksupzxmvktyu\pgloader.exe' --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="%...
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get name"
- '<SYSTEM32>\wbem\wmic.exe' computersystem get name
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic computersystem get name"' (with hidden window)