Malware Analysis Report

2025-01-22 08:44

Sample ID 241027-spfpqazcmm
Target Vega X Windows_04224392.exe
SHA256 61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42
Tags
discovery spyware stealer
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42

Threat Level: Shows suspicious behavior

The file Vega X Windows_04224392.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery spyware stealer

Password Policy Discovery

Network Share Discovery

Drops file in System32 directory

Checks installed software on the system

Drops file in Windows directory

Drops file in Program Files directory

Loads dropped DLL

Executes dropped EXE

System Location Discovery: System Language Discovery

Browser Information Discovery

Reads user/profile data of web browsers

Enumerates physical storage devices

Opens file in notepad (likely ransom note)

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Modifies data under HKEY_USERS

Checks SCSI registry key(s)

Enumerates system info in registry

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-27 15:17

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-27 15:17

Reported

2024-10-27 15:22

Platform

win11-20241007-en

Max time kernel

208s

Max time network

240s

Command Line

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

Signatures

Network Share Discovery

discovery

Password Policy Discovery

discovery

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\pmls.dll C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
File created C:\Windows\system32\pmls64.dll C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\rule18[1].xml \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\SysWOW64\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\pmls.dll C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\rule18[1].xml \??\c:\program files (x86)\premieropinion\pmropn.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\appinstaller.exe \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\icui18n56.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\mfc140u.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\metconv.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\presentationcore.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\system.data.datasetextensions.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\system.text.encoding.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\system.xml.xdocument.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_am.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\system.drawing.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\system.io.filesystem.driveinfo.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\inkobj.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\system.net.quic.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\system.windows.forms.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\system.xaml.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\fulltrustnotifier.exe \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\msedgeupdateres_bn.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\presentationcore.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\system.web.httputility.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\windowsformsintegration.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\microsoft.excel.reportingservices.querydesigners.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\excel.exe \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\tabletextservice.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\ado\msjro.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\system.io.filesystem.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\system.windows.forms.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\visshe.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\et-EE\pad.console.host.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\microsoft.data.connectionui.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\runtimeconfiguration.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\mpvis.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\system.windows.forms.primitives.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\textintelligence.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\fpsrvutl.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\system.net.requests.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\system.windows.forms.design.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\system.runtime.interopservices.runtimeinformation.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\microsoft.win32.systemevents.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\vviewer.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_2_app.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\system.security.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\system.windows.forms.design.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\system.collections.nongeneric.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\axe8sharedexpat.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\system.console.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-heap-l1-1-0.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\system.data.datasetextensions.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Requests\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.net.requests.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\1d589cbe22752e155579f67b60ee1ad6\microsoft.powershell.diagnostics.activities.ni.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\system.data.entity.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic.Runtime\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.dynamic.runtime.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\v4.0_1.0.0.0_de_31bf3856ad364e35\microsoft.windows.diagnosis.commands.writediagprogress.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http.WebRequest\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.net.http.webrequest.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_fr_31bf3856ad364e35\microsoft.powershell.commands.utility.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W193497eb#\eb12b0c1a56f3957653cc70c3473b105\microsoft.wsman.runtime.ni.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\v4.0_10.0.0.0__31bf3856ad364e35\microsoft.grouppolicy.admtmpleditor.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.net.security.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\diagnostics\system\Speech\speechdiagnosticutil.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\EventViewer.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\eventviewer.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\v4.0_1.0.0.0_en_31bf3856ad364e35\microsoft.windows.diagnosis.commands.writediagprogress.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\v4.0_10.0.0.0_fr_b03f5f7f11d50a3a\microsoft.visualbasic.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\presentationframework.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.linq.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.tools.office.excel.addinproxy.v9.0.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\39fb3818bf101de8ebb100a67b6c61f0\microsoft.powershell.commands.management.ni.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Ink\dfae08f7dc99bfcdc20605e5d13beabc\microsoft.ink.ni.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\EventViewer.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\eventviewer.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\microsoft.security.applicationid.policymanagement.policymodel.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Resources\3.0.0.0_es_b77a5c561934e089\system.runtime.serialization.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Resources\3.0.0.0_it_b77a5c561934e089\system.runtime.serialization.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\microsoft.secureboot.commands.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\system.management.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.G46fcc235#\eed27ddd585dc9a9c69072c5ff040401\microsoft.grouppolicy.interop.ni.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\microsoft.workflow.compiler.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AppContext\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.appcontext.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\aspnet_regbrowsers.resources\v4.0_4.0.0.0_de_b03f5f7f11d50a3a\aspnet_regbrowsers.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\system.enterpriseservices.wrapper.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrord32.exe \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\microsoft.appv.appvclientcomconsumer.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\system.deployment.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization.Calendars\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.globalization.calendars.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\system.web.applicationservices.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Web.DynamicData.Resources\3.5.0.0_de_31bf3856ad364e35\system.web.dynamicdata.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.AeroLite\v4.0_4.0.0.0__31bf3856ad364e35\presentationframework.aerolite.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\system.data.services.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\system.web.datavisualization.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\v4.0_1.0.0.0_en_31bf3856ad364e35\microsoft.windows.diagnosis.sdhost.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\system.servicemodel.internals.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\microsoft.security.applicationid.policymanagement.policymodel.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\system.activities.core.presentation.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\system.activities.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem.resources\v4.0_4.0.0.0_es_b77a5c561934e089\system.io.compression.filesystem.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\microsoft.grouppolicy.admtmpleditor.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.enterpriseservices.wrapper.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\microsoft.transactions.bridge.dtc.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\v4.0_1.0.0.0_fr_31bf3856ad364e35\microsoft.windows.diagnosis.commands.getdiaginput.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors\v4.0_4.0.0.0__b77a5c561934e089\system.identitymodel.selectors.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.io.log.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\microsoft.secureboot.commands.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\microsoft.configci.commands.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Workflow.ServiceCore.Resources\v4.0_3.0.0.0_en_31bf3856ad364e35\microsoft.powershell.workflow.servicecore.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pad0e0718#\b3f64ecd16a933f1d875689f1aac2b75\microsoft.powershell.cmdletization.odata.ni.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\diagnostics\system\WindowsMediaPlayerMediaLibrary\diagpackage.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\v4.0_10.0.0.0__31bf3856ad364e35\microsoft.applicationid.framework.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.resources\v4.0_4.0.0.0_es_b77a5c561934e089\system.servicemodel.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\aspnetmmcext.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Install.Resources\3.0.0.0_ja_b77a5c561934e089\system.servicemodel.install.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\a963b872e0946ef03bf8cf108963dfda\microsoft.powershell.commands.diagnostics.ni.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Drawing.Design.Resources\2.0.0.0_es_b03f5f7f11d50a3a\system.drawing.design.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ISECommon.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\microsoft.powershell.isecommon.resources.dll \??\c:\program files (x86)\premieropinion\pmropn.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A C:\PROGRA~2\PREMIE~1\pmropn32.exe N/A
N/A N/A C:\PROGRA~2\PREMIE~1\pmropn64.exe N/A
N/A N/A C:\Windows\system32\wbem\unsecapp.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Windows\System32\rundll32.exe N/A
N/A N/A N/A N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\Desktop\Vega X Dev Mode\Vega X.exe N/A
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Reads user/profile data of web browsers

spyware stealer

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\NOTEPAD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\Vega X Dev Mode\Vega X.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\PROGRA~2\PREMIE~1\pmropn32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\CheckNetIsolation.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Class \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\ClassGUID \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\ClassGUID \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Class \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\Class \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ClassGUID \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\mfg \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ClassGUID \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Class \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\mfg \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\ClassGUID \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\ClassGUID \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ClassGUID \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\Class \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Class \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\Class \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Class \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\mfg \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\mfg \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ClassGUID \??\c:\program files (x86)\premieropinion\pmropn.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133745159627828384" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Opera GXStable C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Opera GXStable C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 040000000100000010000000d7331d40fc0ca9d2f4e45d8a280a5810030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c762000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 140000000100000014000000c04d850dcd7a8e9bc67e8f20375eb747fd3d397e040000000100000010000000d7331d40fc0ca9d2f4e45d8a280a5810030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c762000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 5c000000010000000400000000080000140000000100000014000000c04d850dcd7a8e9bc67e8f20375eb747fd3d397e040000000100000010000000d7331d40fc0ca9d2f4e45d8a280a5810030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c7619000000010000001000000012cab0233db2f09a0336851de92237df2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 19000000010000001000000012cab0233db2f09a0336851de92237df0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c76030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d040000000100000010000000d7331d40fc0ca9d2f4e45d8a280a5810140000000100000014000000c04d850dcd7a8e9bc67e8f20375eb747fd3d397e2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c76030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c76030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d040000000100000010000000d7331d40fc0ca9d2f4e45d8a280a58102000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Vega X Dev Mode.zip:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\Vega X Windows.txt:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
N/A N/A C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
N/A N/A C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
N/A N/A C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
N/A N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
N/A N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe N/A
N/A N/A C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
N/A N/A C:\PROGRA~2\PREMIE~1\pmropn32.exe N/A
N/A N/A C:\PROGRA~2\PREMIE~1\pmropn32.exe N/A
N/A N/A C:\PROGRA~2\PREMIE~1\pmropn32.exe N/A
N/A N/A C:\PROGRA~2\PREMIE~1\pmropn64.exe N/A
N/A N/A C:\PROGRA~2\PREMIE~1\pmropn64.exe N/A
N/A N/A C:\PROGRA~2\PREMIE~1\pmropn64.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A \??\c:\program files (x86)\premieropinion\pmropn.exe N/A
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 6112 wrote to memory of 5988 N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
PID 6112 wrote to memory of 5988 N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
PID 6112 wrote to memory of 5988 N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
PID 6112 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 6112 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 6112 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 5988 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe C:\Program Files (x86)\PremierOpinion\pmropn.exe
PID 5988 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe C:\Program Files (x86)\PremierOpinion\pmropn.exe
PID 5988 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe C:\Program Files (x86)\PremierOpinion\pmropn.exe
PID 4116 wrote to memory of 3364 N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe C:\Windows\system32\rundll32.exe
PID 4116 wrote to memory of 3364 N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe C:\Windows\system32\rundll32.exe
PID 3364 wrote to memory of 1216 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\svchost.exe
PID 4116 wrote to memory of 1052 N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe C:\Windows\SysWOW64\reg.exe
PID 4116 wrote to memory of 1052 N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe C:\Windows\SysWOW64\reg.exe
PID 4116 wrote to memory of 1052 N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe C:\Windows\SysWOW64\reg.exe
PID 4116 wrote to memory of 2076 N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe \??\c:\program files (x86)\premieropinion\pmropn.exe
PID 4116 wrote to memory of 2076 N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe \??\c:\program files (x86)\premieropinion\pmropn.exe
PID 4116 wrote to memory of 2076 N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe \??\c:\program files (x86)\premieropinion\pmropn.exe
PID 5336 wrote to memory of 5932 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5932 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 1976 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5152 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5336 wrote to memory of 5748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe

"C:\Users\Admin\AppData\Local\Temp\Vega X Windows_04224392.exe"

C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe

"C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt

C:\Program Files (x86)\PremierOpinion\pmropn.exe

C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:8RMfF9CuAdLUH6wrYCPOGG -o:0

C:\Program Files (x86)\PremierOpinion\pmservice.exe

"C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1216

C:\Windows\SysWOW64\reg.exe

reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y

\??\c:\program files (x86)\premieropinion\pmropn.exe

"c:\program files (x86)\premieropinion\pmropn.exe" -boot

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabdb2cc40,0x7ffabdb2cc4c,0x7ffabdb2cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1788 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2012,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2120 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2148 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3252 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3316 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4460,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4416 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4620,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4628 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4272 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4552,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4832 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4844,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4856 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4824,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5216,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5224 /prefetch:8

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Vega X Windows.txt

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

/C C:\PROGRA~2\PREMIE~1\pmropn32.exe 2076

C:\Windows\SysWOW64\cmd.exe

/C C:\PROGRA~2\PREMIE~1\pmropn64.exe 2076

C:\PROGRA~2\PREMIE~1\pmropn32.exe

C:\PROGRA~2\PREMIE~1\pmropn32.exe 2076

C:\PROGRA~2\PREMIE~1\pmropn64.exe

C:\PROGRA~2\PREMIE~1\pmropn64.exe 2076

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -s

\??\c:\program files (x86)\premieropinion\pmropn.exe

"c:\program files (x86)\premieropinion\pmropn.exe" -updateapps

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=e2a4f912-2574-4a75-9bb0-0d023378592b_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=f46d4000-fd22-4db4-ac8e-4e1ddde828fe_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.aad.brokerplugin_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.accountscontrol_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.asynctextservice_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.bioenrollment_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.creddialoghost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.desktopappinstaller_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ecapp_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.lockapp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedgedevtoolsclient_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.onedrivesync_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.cbs_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00.uwpdesktop_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.win32webviewhost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.apprep.chxapp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.callingshellapp_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.capturepicker_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.cloudexperiencehost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.contentdeliverymanager_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.narratorquickstart_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.oobenetworkcaptiveportal_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.oobenetworkconnectionflow_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.parentalcontrols_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.peopleexperiencehost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.pinningconfirmationdialog_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.search_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.secureassessmentbrowser_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.shellexperiencehost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.xgpuejectdialog_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.xboxgamecallableui_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.client.cbs_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.undockeddevkit_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=ncsiuwpapp_8wekyb3d8bbwe

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=windows.cbspreview_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=windows.printdialog_cw5n1h2txyewy

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -a -n=windows_ie_ac_001

C:\Windows\SysWOW64\CheckNetIsolation.exe

CheckNetIsolation.exe LoopbackExempt -s

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5212,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5520 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5776,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5780 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5072,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4360 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-features="NoStatePrefetch" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4636,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca

\??\c:\program files (x86)\premieropinion\pmropn.exe

"c:\program files (x86)\premieropinion\pmropn.exe" -installmenu:PremierOpinion -v:NONE

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Get-AppxPackage

C:\Users\Admin\Desktop\Vega X Dev Mode\Vega X.exe

"C:\Users\Admin\Desktop\Vega X Dev Mode\Vega X.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Vega X Dev Mode\TUTORIAL.txt

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-features="NoStatePrefetch" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4932,i,1075251311965162944,17649438008038302,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5096 /prefetch:8

C:\Users\Admin\Desktop\Vega X Dev Mode\bin\commservice\node\node.exe

"bin\commservice\node\node.exe" bin\commservice\files\index.js

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.dlsft.com udp
US 35.190.60.70:443 www.dlsft.com tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 216.58.204.67:80 c.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 70.60.190.35.in-addr.arpa udp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 35.190.60.70:443 dlsft.com tcp
US 35.190.60.70:443 dlsft.com tcp
US 172.67.195.231:443 filedm.com tcp
NL 18.238.243.115:443 dpd.securestudies.com tcp
NL 18.238.246.206:80 ocsp.r2m02.amazontrust.com tcp
US 165.193.78.234:80 post.securestudies.com tcp
US 165.193.78.234:80 post.securestudies.com tcp
US 165.193.78.234:443 post.securestudies.com tcp
US 165.193.78.234:80 post.securestudies.com tcp
US 165.193.78.234:443 post.securestudies.com tcp
US 165.193.78.234:443 post.securestudies.com tcp
N/A 127.0.0.1:49855 tcp
N/A 127.0.0.1:49859 tcp
N/A 127.0.0.1:49862 tcp
US 165.193.78.234:443 post.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
US 165.193.78.250:80 www.premieropinion.com tcp
US 165.193.78.234:443 post.securestudies.com tcp
N/A 127.0.0.1:50001 tcp
N/A 127.0.0.1:50025 tcp
N/A 127.0.0.1:50057 tcp
US 165.193.78.234:443 post.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50128 tcp
N/A 127.0.0.1:50132 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
GB 172.217.169.36:443 www.google.com udp
GB 172.217.169.36:443 www.google.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
GB 142.250.200.46:443 apis.google.com udp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50140 tcp
N/A 127.0.0.1:50149 tcp
N/A 127.0.0.1:50163 tcp
N/A 127.0.0.1:50180 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
GB 142.250.187.206:443 play.google.com udp
GB 142.250.187.206:443 play.google.com tcp
US 165.193.78.210:443 oss-ad.securestudies.com tcp
GB 142.250.178.14:443 ogs.google.com udp
GB 142.250.178.14:443 ogs.google.com tcp
N/A 224.0.0.251:5353 udp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50187 tcp
N/A 127.0.0.1:50193 tcp
N/A 127.0.0.1:50198 tcp
N/A 127.0.0.1:50203 tcp
N/A 127.0.0.1:50212 tcp
N/A 127.0.0.1:50217 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50221 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50224 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50234 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50238 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50242 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50246 tcp
N/A 127.0.0.1:50250 tcp
N/A 127.0.0.1:50255 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50260 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 167.235.218.62:80 a.directfiledl.com tcp
DE 167.235.218.62:80 a.directfiledl.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50264 tcp
N/A 127.0.0.1:50269 tcp
N/A 127.0.0.1:50277 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50296 tcp
N/A 127.0.0.1:50301 tcp
N/A 127.0.0.1:50305 tcp
N/A 127.0.0.1:50309 tcp
N/A 127.0.0.1:50320 tcp
N/A 127.0.0.1:50324 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50339 tcp
N/A 127.0.0.1:50342 tcp
GB 142.250.178.14:443 ogs.google.com tcp
GB 142.250.187.195:443 ssl.gstatic.com tcp
LU 31.216.144.5:443 mega.nz tcp
LU 31.216.144.5:443 mega.nz tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
LU 31.216.144.5:443 mega.nz tcp
N/A 127.0.0.1:8888 tcp
GB 142.250.179.234:443 ogads-pa.googleapis.com tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
LU 31.216.144.5:443 mega.nz tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
GB 2.18.190.73:80 r10.o.lencr.org tcp
GB 216.58.212.202:443 ogads-pa.googleapis.com tcp
LU 66.203.125.14:443 g.api.mega.co.nz tcp
LU 66.203.125.14:443 g.api.mega.co.nz tcp
GB 142.250.180.3:80 www.gstatic.com tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
US 165.193.78.210:443 oss-ad.securestudies.com tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
LU 66.203.124.37:443 eu.static.mega.co.nz tcp
N/A 127.0.0.1:8888 tcp
US 165.193.78.250:443 www.premieropinion.com tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:6341 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:6341 tcp
US 165.193.78.250:443 www.premieropinion.com tcp
LU 66.203.125.15:443 g.api.mega.co.nz tcp
N/A 127.0.0.1:8888 tcp
NL 185.206.24.76:443 gfs204n148.userstorage.mega.co.nz tcp
DE 94.24.36.44:443 gfs262n334.userstorage.mega.co.nz tcp
NL 185.206.24.76:443 gfs204n148.userstorage.mega.co.nz tcp
DE 94.24.36.44:443 gfs262n334.userstorage.mega.co.nz tcp
NL 185.206.24.76:443 gfs204n148.userstorage.mega.co.nz tcp
DE 94.24.36.44:443 gfs262n334.userstorage.mega.co.nz tcp
LU 89.44.168.43:443 gfs270n333.userstorage.mega.co.nz tcp
LU 89.44.168.43:443 gfs270n333.userstorage.mega.co.nz tcp
LU 89.44.168.43:443 gfs270n333.userstorage.mega.co.nz tcp
LU 89.44.168.43:443 gfs270n333.userstorage.mega.co.nz tcp
NL 185.206.24.76:443 gfs204n148.userstorage.mega.co.nz tcp
CA 162.208.16.31:443 gfs302n121.userstorage.mega.co.nz tcp
CA 162.208.16.31:443 gfs302n121.userstorage.mega.co.nz tcp
CA 162.208.16.31:443 gfs302n121.userstorage.mega.co.nz tcp
ES 185.206.27.51:443 gfs214n141.userstorage.mega.co.nz tcp
ES 185.206.27.51:443 gfs214n141.userstorage.mega.co.nz tcp
ES 185.206.27.51:443 gfs214n141.userstorage.mega.co.nz tcp
CA 162.208.16.31:443 gfs302n121.userstorage.mega.co.nz tcp
BE 94.24.37.46:443 gfs206n136.userstorage.mega.co.nz tcp
BE 94.24.37.46:443 gfs206n136.userstorage.mega.co.nz tcp
BE 94.24.37.46:443 gfs206n136.userstorage.mega.co.nz tcp
BE 94.24.37.46:443 gfs206n136.userstorage.mega.co.nz tcp
ES 185.206.27.51:443 gfs214n141.userstorage.mega.co.nz tcp
DE 94.24.36.44:443 gfs262n334.userstorage.mega.co.nz tcp
US 8.8.8.8:53 46.37.24.94.in-addr.arpa udp
US 8.8.8.8:53 31.16.208.162.in-addr.arpa udp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
LU 89.44.168.43:443 gfs270n333.userstorage.mega.co.nz tcp
N/A 127.0.0.1:8888 tcp
US 3.218.14.94:443 p-content.securestudies.com tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
NL 185.206.24.76:443 gfs204n148.userstorage.mega.co.nz tcp
DE 94.24.36.44:443 gfs262n334.userstorage.mega.co.nz tcp
ES 185.206.27.51:443 gfs214n141.userstorage.mega.co.nz tcp
CA 162.208.16.31:443 gfs302n121.userstorage.mega.co.nz tcp
N/A 127.0.0.1:50785 tcp
US 3.218.14.94:443 p-content.securestudies.com tcp
N/A 127.0.0.1:50842 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:50925 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
US 165.193.78.250:80 www.premieropinion.com tcp
N/A 127.0.0.1:50928 tcp
N/A 127.0.0.1:50931 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:80 rules.securestudies.com tcp
DE 207.120.58.26:80 rules.securestudies.com tcp
DE 207.120.58.26:80 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:80 rules.securestudies.com tcp
DE 207.120.58.26:80 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50942 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50948 tcp
N/A 127.0.0.1:50961 tcp
N/A 127.0.0.1:50973 tcp
N/A 127.0.0.1:50987 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50990 tcp
DE 207.120.58.26:80 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:80 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:50995 tcp
N/A 127.0.0.1:51001 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:51012 tcp
N/A 127.0.0.1:51014 tcp
N/A 127.0.0.1:51020 tcp
N/A 127.0.0.1:51023 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:51027 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:51031 tcp
N/A 127.0.0.1:51035 tcp
N/A 127.0.0.1:51039 tcp
N/A 127.0.0.1:51044 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:51047 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
US 23.23.21.45:443 p-content.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:51051 tcp
N/A 127.0.0.1:51054 tcp
N/A 127.0.0.1:51058 tcp
N/A 127.0.0.1:51063 tcp
N/A 127.0.0.1:51070 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:51074 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:51078 tcp
N/A 127.0.0.1:51082 tcp
N/A 127.0.0.1:51095 tcp
N/A 127.0.0.1:51106 tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
DE 207.120.58.26:443 rules.securestudies.com tcp
N/A 127.0.0.1:51110 tcp
N/A 127.0.0.1:51114 tcp
N/A 127.0.0.1:51119 tcp
N/A 127.0.0.1:51123 tcp
US 3.232.172.89:444 hawk.securestudies.com tcp
N/A 127.0.0.1:51136 tcp
US 3.232.172.89:444 hawk.securestudies.com tcp
N/A 127.0.0.1:51216 tcp
N/A 10.127.0.1:80 tcp
US 172.67.192.170:443 vegax.gg tcp
US 172.67.69.68:443 scriptblox.com tcp
GB 2.18.190.78:443 tr.rbxcdn.com tcp
GB 2.18.190.78:443 tr.rbxcdn.com tcp
US 172.67.69.68:443 scriptblox.com tcp
US 172.67.69.68:443 scriptblox.com tcp
US 23.23.21.45:443 p-content.securestudies.com tcp
N/A 127.0.0.1:51349 tcp
US 23.23.21.45:443 p-content.securestudies.com tcp
US 3.232.172.89:443 hawk.securestudies.com tcp
US 3.232.172.89:443 hawk.securestudies.com tcp
US 3.232.172.89:444 hawk.securestudies.com tcp
US 3.232.172.89:444 hawk.securestudies.com tcp
US 52.207.127.73:444 hawk.securestudies.com tcp
US 52.207.127.73:444 hawk.securestudies.com tcp
US 52.207.127.73:443 hawk.securestudies.com tcp
US 52.207.127.73:443 hawk.securestudies.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe

MD5 bf6eed6cdc17a0130189a33a55ef5209
SHA1 e337f5a0931f69c464f162385f1330b4d27b372f
SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
SHA512 90d23fd84007343e85f9fc003cf826b112fd930216a24d8c1488468443ae2a4b0c3cc2426b91c81a8228e125050e922fce05672e010e65247709fc4a7b856f1d

C:\Users\Admin\AppData\Local\link.txt

MD5 1d0ff1e63edfbf12f9b0ac305113c5a4
SHA1 da57b7cea52dfb5acc33772d1dac752775477def
SHA256 058c773397c8b99d3fac024f3edce00df30ba9160ff89998d0c47123bbdd41c4
SHA512 21be7bb17153e92bff5473598d9a61334046538c69038ee879354a0bb30172f7157d96af5fc8587b69b6dbddbed7b12231de3e6bdd7ce24d52082d4ebd67c0ba

C:\Users\Admin\AppData\Local\Temp\~os9595.tmp\pmservice.exe

MD5 4ef95918e313c7ca01084629416fc714
SHA1 5bdaba6920d3f4d1f8ea47ce693276530b5f2a9c
SHA256 303707068aab06ab0341178558c28ce1670d10f16c39522859c4f21097a87ee9
SHA512 75861731e9ec1a43741b2b84f60677e9fdf26d5db8d6e4e91297f826fc2c357272c18cede7f64c42798f5459900b33d693ababe4e1140e4cfc54ef7a04af633a

C:\Program Files (x86)\PremierOpinion\pmls.dll

MD5 50a0c6c01cdc5d2690ccd1f1541f6670
SHA1 c5e017a468efb70eabb1f861784edac62acb0e17
SHA256 f9a853830949bb22d6f4d128d71a0ab923d9b5549c0dc8785c7de7d1a4eabf99
SHA512 028d5a56c581d3751628c7503e83aa52c332678495943c3648049ae0b26a7190e98395ad205cf60896140d1a802c14a346a2d1553e7b53090c3f5beefd66e9b1

C:\Program Files (x86)\PremierOpinion\pmls64.dll

MD5 aa56cb7fd83150c3a75cd6a0de97eb78
SHA1 34415c5c8e57cfe9a7b4a498eacfe1403f3191ec
SHA256 034e066829d28bbc81604250f6df721a35ab1c0898ab82bef6305ffada240765
SHA512 765f12e5e060db934d0f4e8159bb9bd10cdbe797d79488a0dc88215a73e49101e279ca69e10c1775a5e161bb4dd02585724c7c87bbefdcdd047adb4277804fa2

C:\Program Files (x86)\PremierOpinion\pmropn64.exe

MD5 ae5bbcc69b05359d0d5cc72ca6a1262e
SHA1 6843bd883d50216be44065411a983a4bcccdcc91
SHA256 12bfd1007634138b22c56ead24db02a1fe3a4d4b7fe04d30cd07a0ff5d4c8425
SHA512 6417aaeb4ccd86504bc1f83e32c91a60920e98fff833c02fdbef974819a3288cab0c96d6b114ceed4432c305d49120cacbc7e0da69c911f4035aadfbec7a91de

C:\Program Files (x86)\PremierOpinion\pmropn32.exe

MD5 6e4d6b68e9565c4cc7791b00c2094ff9
SHA1 965a00a5a8bb05b35fbaa357951779ea3b71e392
SHA256 65d6f18e1b366aff5343c3f6628041329e7c1375d18ba57076b19bf5f48bc483
SHA512 0cb1396822c7350057cfc7280e1c67ccf1e1a2206347a10025e285f00e9364563685ba5282775960a9329511fd321a631222c87ae7ca8106eca00fb78722b20f

C:\Program Files (x86)\PremierOpinion\pmph.dll

MD5 9d96ccb0d5ab5541b61d5c138d91796f
SHA1 cf3ee3e66c8f9c23e3efd29978215461347e650d
SHA256 379a1f1f02c8cb704f248c2f1ff79c8986f73c350a3bf6d9bbc93aeacd286e36
SHA512 69ca7d96896d872eefa63f0c0bd9613526a914e99c4cf12b5d221315277aa64894d99d0f5ce9c5e0ef640d61c9202cd3d51ddb2ab4c55f8fdf60d24a8c1ff6ac

C:\Program Files (x86)\PremierOpinion\pmropn.exe

MD5 f27f98c1a877f9ca6f06c23bed4014ca
SHA1 25a231319659c30d6f86a5c9cdd1747d7c471542
SHA256 1ed47933c9f33c4860ecc0bf1ba7525212aa00054037a9a51a8d8f5ce3b821bd
SHA512 f054a618d2f8e7a829c26548312b436e21058ee1ff64b40e7c19be2bde037003c21332af3c60e2fd92675af80526ef6faf84b8c1d7a095bb2c4d0b799e66599c

memory/1868-113-0x00000000036E0000-0x00000000036E1000-memory.dmp

memory/1868-114-0x00000000036E0000-0x00000000036E1000-memory.dmp

memory/1868-115-0x00000000036E0000-0x00000000036E1000-memory.dmp

memory/1868-124-0x00000000036E0000-0x00000000036E1000-memory.dmp

memory/1868-125-0x00000000036E0000-0x00000000036E1000-memory.dmp

memory/1868-123-0x00000000036E0000-0x00000000036E1000-memory.dmp

memory/1868-122-0x00000000036E0000-0x00000000036E1000-memory.dmp

memory/1868-121-0x00000000036E0000-0x00000000036E1000-memory.dmp

memory/1868-120-0x00000000036E0000-0x00000000036E1000-memory.dmp

memory/1868-119-0x00000000036E0000-0x00000000036E1000-memory.dmp

memory/3364-193-0x00007FFACBA80000-0x00007FFACBB3D000-memory.dmp

memory/3364-195-0x00007FFACB480000-0x00007FFACB4EF000-memory.dmp

memory/3364-194-0x00007FFACA920000-0x00007FFACAC94000-memory.dmp

memory/3364-199-0x00007FFAC9820000-0x00007FFAC9887000-memory.dmp

memory/3364-201-0x00007FFAC9610000-0x00007FFAC9652000-memory.dmp

memory/3364-200-0x00007FFAC5980000-0x00007FFAC5A8C000-memory.dmp

memory/3364-196-0x00007FFAB64B0000-0x00007FFAB69AA000-memory.dmp

memory/3364-202-0x00007FFACC0E0000-0x00007FFACC88E000-memory.dmp

C:\Windows\SystemTemp\REGAB4E.tmp

MD5 d85bc2bb311831c7f3f25418e7c2df6d
SHA1 7f1fbd384a47262ef1400bed4306707940a5ea73
SHA256 a48df2b9d462c480d1386f82533ebd3f5ae0cea49acc6401be7577ccc7a24d25
SHA512 7f26363a41d73adcddd433c012632794b059b3033956a747e1884c13f5c5717ed7dcb4e1d3fcb0248dc22209d95c0f62c9379ca28479ecde3ce428e627dfc625

C:\PROGRA~2\PREMIE~1\snt.dat.bac

MD5 6661f56b507220fe3651db441a9f5c96
SHA1 1ca70063905d7b1fcb3352d8bfcce0e9d47597b9
SHA256 f987b6e1bd79abad328abe44b08370726e2a0f29f208fa1e4bb045328ed1a8fe
SHA512 679daa36f6a9e14d0c0d20aaf00ed6b0704fa855872764d24b72ffe9abe997a516505361a0792daaef9841badfc96a22517ab33b0d4b52ce3082a00d49577029

C:\Program Files (x86)\PremierOpinion\cacert.pem

MD5 77eb3ade4c5b0db67c6e8a26f131073c
SHA1 ad9e8c00174cc2e707f59df671f89a9d7fc2ffc7
SHA256 9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87
SHA512 20eb7d34c80bb8d8a415bcdccf8e46cb36396c095ed1468b69c0cb91da915e3a14c7fd55247f68e64ff71cf8d336cc286c3662710ca6281840fdc2f1eb7ac6a1

memory/2076-243-0x0000000003520000-0x0000000003521000-memory.dmp

memory/2076-244-0x0000000003520000-0x0000000003521000-memory.dmp

C:\Users\Admin\AppData\Local\D3DSCache\3231ae299a0af0b2\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

\??\pipe\crashpad_5336_NBGRFJFNIGRUONWD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 775541188cb8415ac0159a71b40883be
SHA1 7f8a397c1cb98d496913cab844b17f1535de084c
SHA256 0e891c6c9c572c2d4bc67248802ba277a84de338a6eecf5f7c0f26ef84fbb7b3
SHA512 2a97570a5863965ac8f9a947287ca3e4ba3fc251a50692a4e901a13dc91403a7cf117fe09f36ccb4dcf523e384b8a39c170fff78255abee474bb88d6186f322d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 36bb177d4629a150e13a134111de4ead
SHA1 ccc38b336e1bec85e2be59186d23f81059e788d1
SHA256 7755ca1c256350266103e1e6b0a79f71aa9705bbae367cb41d66a278af4ed8d7
SHA512 c010b870527494449c084b0296c5ceeecc8c1ea414fc16b99692919f4993855845645d807f766bd9890b95481c9bbeaf86ba2525d78c04414b6f0b5441e8fda1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 776a5c20bcb726bffecfcfd18efa254f
SHA1 533f3d7b148c3f7cc3d53d7d95e37080d5b871e3
SHA256 b86b284076b1ac5b0e90f6d47ef351c6d0231a9f1f7a8da6a8503113fd2815e0
SHA512 da29be92823f2c89847018a28a1b377963b5f915547720a5939b22d3da58a0df73b05739e526b03ad91b76a8ab72fe4b9381a80c7b7e9b1a98c83b85bfb022eb

C:\Users\Admin\Downloads\Vega X Windows.txt

MD5 170fe56d140afd534a5b8224c637decd
SHA1 0bd7de2ee07701e011530244179affcc623a53d4
SHA256 03d1d67a28d4377d9dd36a09fce69b70ea656de902660af8e9d9af20247f679a
SHA512 2fb13791588437046795c6bfcba63ba3fce6dea337638252c9de76f1882401d321e0c109030bb31cf409594cd24af3bc87deda73453ea8c0f03a4c60bab5873a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 0847745ede82ee310baae911a3a03307
SHA1 a142707f40b2af7486b5d45fd4a3c76798edd3c6
SHA256 fc654f851cf37da7cedaa007ff3c4312e5c7270f1c68e508ffb2ac931dc9e1ec
SHA512 40e160cfdc6752f0dbabe542ccde0c1582d719cbfa0437378f68561d2c6e1631b8e8f21d4c9c1806894830490bb54a07b38e538224c8fef149b0b0dc182fa497

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 9eb02b5a9c47ccd6e5d9ee6e83087dc0
SHA1 1aefecf5fece2b4174f2ac40cab59a029867b9fb
SHA256 9d75bf70cd3b175ca32fcd248826d691f9449e38b138ba2b8de3109420609eec
SHA512 f6b8d92a65ea38bf33e3fbb007eb69d137988fb8caa445940ec789c1d35356ded6e0d643feb51f8dd040d4653fa0e916bfb998401653894c22aa84b7065390a9

C:\Users\Admin\AppData\Local\D3DSCache\3231ae299a0af0b2\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

MD5 2e56822cad031b72223f47167d62bf5b
SHA1 1403ee99a61e9ae9d15a22106700044e30873b91
SHA256 8200a2554862473fb558df7f62dea2553e92d883ff9c808aba22d7c9572185fa
SHA512 852b024b63259d5a6b6690f94761faed40bac758662f23496fb1c3839e99062fe37d6487b423cf1d145265e1bbdfb3d4bda37b3e74eaa136bd5b8e61838d5817

C:\Users\Admin\AppData\Local\D3DSCache\3231ae299a0af0b2\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

MD5 0083b29045af4f4d3ecd49f5fd541bfe
SHA1 83b92c5187e7b93298f86d83826c73da1098850c
SHA256 cc62ff55c91b10f17b0543d59486a3fb907d7be658043a3b23ece70dbfac797d
SHA512 006257f5be6341184434d071f7c38984d9f1aee74602475f38ca0637c66a5169856e21603d758c3f3a47fbf1aa65aa5f798e2e49b598f75147c4fd47207bbc51

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 2e63730969cc7bcdd808e116f5f204d9
SHA1 b53e852c5721a9abb7bcd4874d4532dcdf8f3e1e
SHA256 50fe6f9789687f44af304493b7892d88e29b9f82991e5c0bd4dd038f5679757e
SHA512 ea5e0f7dc1b782fcfa143b7803555fe0dea5c6bd26b7e137ca070aebdc5b0b66222b5282ec70f453691d89d4103278393090871bb0147b03315767ad272e2f1e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 a981ab0241954955ee88ab5dba480538
SHA1 8648a4174dabd53bec115a0dbb031a0559c90daa
SHA256 0a8b6055c3ed8405bdbd5fef404f4742c497fcb4f4e2bc0b70268c01c65b851f
SHA512 c7ea3d22c0211c894ed0d5f39979f6399fe9f58bf6723ff2965931ec6dddb3c668454b30931e1415e4191d22e7313e80ca6246981a5620c354546a8696f0bb28

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 1e9f9f217aba82518418b627fe5a8861
SHA1 cba5f5e79625cf365cf303cb5ff08e8a75d3363b
SHA256 d076aee972f3449db60f593afe0e82daae992ce3f1d787b87a63d8a652e3d843
SHA512 0056c8ef8d8cac4840aee690ffc24b6c54eb579940a9a7c6ea3aebc694a9250f4194604ce755a0f40b2543779934c92657100918c3c86ae29469523172c27a52

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a0c9dd78472375bcb431a661423e5df0
SHA1 7315c7bfd1e62b7aa0cac70dce73ac81b9365420
SHA256 0b0c9c8cae90f4fc4c52ce1200d2313c674d06ec5c586b6fdd0e1825497b5243
SHA512 28622791ff4f881e867a23545dc403f937c9d6300588312751ab97fd4d5a4109426687394bfd6e937abed9f3e5e2a188c2d1b7c695e5fd5640a057a02a22a508

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6c9af9f95a27a3af12c2de6bbee38473
SHA1 c7047bc125884b81bacf401da4ab98a08204c1e1
SHA256 5ce9165af9b5fc6afdad9a697602ee1b8d0bbe86dd93c3983c839c844e2666d0
SHA512 f84e696b95a234917ba1ff2ef9f878ac143c0818060861e55aa92fbeab769b54a25ce1847ebac9636c749caf2e4522ee3205df6ed58a6306b2cd4ba30abb1e81

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 44c7f63e7a443361c21e9d12d044d437
SHA1 84f59639515bfcfd01344fc8f3c60ec339e39dab
SHA256 ea11a36a60744894c26148817fd144267966d9670e5c6909acd96e39c41d6288
SHA512 101656961ec781dc1e0d192f9a1669c099e22612fcc20d54ee7ec50ff1c643e37bc8694b1317414f3dfefe58454fbc74af621453e30d472d28b540aa2224db9a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 426e48bffe5a3269eaa9e1e8056bc2e6
SHA1 2165828774475d74eca15951c2f1b106a4025c1b
SHA256 493942a96a3b611bdeecfb8177f1f368b59001cdd0cb7438225224efe33bb28e
SHA512 ef30c541466b732a33118ebe2d1fa5df596c59086b719d729dfa4bf4d31fe16553440c17c69314c8d819aa922e86c5abdfacc345ae108e27eec496abd21e2811

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

MD5 f9d783c395119c556bae73cdb91e2187
SHA1 9ff784fd9dd32255cce332cfafcecdaeb27f83a1
SHA256 0d282032a17d0fc5bd8257787d02c8190de73cf358d5e49638ba085c2b5f4812
SHA512 d1e6b5d801266d36ae2e5ba1f7fa9c0019be5d12028a6666dd436d30e84bccbfffe86ef3c5ee607d3e7a981f830c30b9467af754076892a7a8321f18c06e7d8c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B

MD5 8510a131aaf4f24ae1d0982220c48d0f
SHA1 e94fd3ed08466090f508a76f333e8f85b286ed7b
SHA256 921a15f4b94474f24b1b9f5f55e19eb5f11d21c51c2baefc2d308439f2b27592
SHA512 bb79126fbd18413c38232f449ed45bd5901fb146c27e61736a379144e7a616ff46ca6e9956dc349b4f57a308a2bf1f994a3863b1c91ff0471f2b81fc0bc38094

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4360fcd6aea359a3aaa7add0d6296b18
SHA1 a7fbdde307fa665575d4c6e21342d393a196f060
SHA256 d2e55bda285e966a1b6acad170c4e9cf9419d468751d7c82ba5fa4c07681bf5c
SHA512 af9ddb79dcd87387dbb3dedac109c60082cddfbfdceac0a722c56ebcace389694b217281781b3b58230caf300e6182150efafdd34288d02e3406f4c43d5a8d59

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 d8b9d3e8bffd68da8f4f1e89ccb96f3e
SHA1 5ddf7b416a87a3a8a22fd2650b58ade4cf061c33
SHA256 a2bad3b9b2854685604080de7d0777acb30312ef42de3f557d701b01042c0612
SHA512 b38768f8be353d86ef98de0aecf0cac5d527d28c50ac370862dbccd35c6f210b2d15fbc6c601ac25c2a4dc3c5265858d5a0fa464cc8b0c495a4e6709b28512bb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 02c962e033e1c93c7549118205830b23
SHA1 c0f766eb205b922648341fa38b3d18f945817e03
SHA256 7498b4cee351149effcddeeb38f8aad73bbe1a3d8fadf141010eecee116f9195
SHA512 5384d98f5d9f25e72fdc7a84efdc915747c3d3908452d963a0c357a130e490b6dc6a9c6606da1ddcf37c29cf25170d1e330c57f21fc2a953d34cb3d565de3f68

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d

MD5 950eca48e414acbe2c3b5d046dcb8521
SHA1 1731f264e979f18cdf08c405c7b7d32789a6fb59
SHA256 c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2
SHA512 27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 13e3b963f2122e39f6b2258071f71e19
SHA1 b6b773e97999862a6e16bd878a70aabcfb5d837c
SHA256 4ec6b9ece307b822c5a9f2c969ea045a4211277ee06fe59071e46604b018436d
SHA512 fbb4cc234b8bb99c41d95a980db160e97d8cca85a1bd956041030f69952adce38113f96bdc311b7557b0652a5a86b5e8c25a6fbc58ad42e4aa64f0cec97b5542

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cce14e2592b5fd21704c764fafa78fdb
SHA1 b9db7bec26e9262190aba6d9e2a9a7d686a15f36
SHA256 cec609ad1b656a20b9947ddf87f4f2cbbcf951976b2d33254dc8a47c9ddcea7a
SHA512 b742d4dbb4f19f347fa5de53965760db109378501a0f0558e8159169989c982a81a7d70a3449de30b94df6589097141eada45bcae0b6c7c9cb2e2bd2d82750ed

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 155bc65846800a4fdb69ca2f6598a52b
SHA1 fe89b016cbdd581c6e4703864f7f13d00cfd4734
SHA256 b4e164a039c334ba698c287f3f54d4dec0cd7b4d2665782f7a958ce0cb6a5cdf
SHA512 d3b95674a6f17b32a7e2dd6c09c13b6c4910bbf4d1b4ec7cdb5dbf64caac93768a9ae36d29c061b916f2a599a9786e88f12e47406214c1e4c2d55c8ee3193425

C:\Users\Admin\Downloads\Vega X Dev Mode.zip:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\Downloads\Vega X Dev Mode.zip

MD5 e6ee01480cf9daf82e34d03f840581d6
SHA1 dc1330733028c6c3151fb6f08d2b3c2c64d47238
SHA256 992057e88c9e6bab5cfa15460ba7a8dfaedb56f25f32887820bdc38ec4e314bd
SHA512 9accec551e191b23f9e23ce117ed01fb5687e7cbe038424e53ec59df0ff2b27e39a566c2a4014e0e4d8abe387673f96826a1a76b09c4a4014f276337ea6b4b29

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 47915012e7bc31b7c8c785a31b658525
SHA1 b9d56939980855c874f99e03d10c76f1808a39d5
SHA256 6ac87a2fa2eb01e88f5ebb513a339a328dbd3e5f75e4d28f2896eb1a6aa27fd1
SHA512 cc19bc30ab0a2dbedae43a40f9907b1372878e02124abddfe1e109e017195c6866a30d1373441e14a365ab58007f1b3883b7f4413aa67531ccd94b2a8c12ada4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 7a0cf608d58cdc4289a5a6e25b03a2a0
SHA1 98e459d4ca35c354efa7f3c0f0d201b6c13b48ae
SHA256 da8bfbe78e58eab7fbbb5fc06026b21bdddc5fc3de4e2c94472c541fa0903697
SHA512 9ad306a1c1d6ddd406e452406409fc1d62efe0fab8cbdeb8adc446592d32250012ab309086a9ccc3f75658c5211558944d1971a8e64baee4bec859090219f6f7

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 18a8be8dc6d1119caa44def9406da74e
SHA1 77ef642ab41a50c6512a3887ac858c0bd1d19b21
SHA256 c06c99c74c67653220269675584d9a9f5f25ae05f474602c2940da1413488da5
SHA512 ac39317f3afb2023023d4fc4ca216143fda8e3c6a01302d780ccc941e5892858d5c110df5862e98a5ed1b6117b60138153f431b4a5aa15a54d88153f1ed1110e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3718df276e823a5742b53817b7adfd23
SHA1 e34bd02ff09f6da35dc58773fc86393ca3f813d4
SHA256 dcf5ba422140e9e784a815cdbd4e000b4f1f74e0e3f9bef56c66ce9f3d8f6ed1
SHA512 de35399ff4f670fe6ec5a0b591647e509decddf43f481d79ed7fbc7e2da68cbdf73fa245d98380332a820c88443b929dfab045fcb2b22f18c2d1f01dad6165de

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6KSU6P1R\POicon[1].bin

MD5 3ef9efb5c3c17e2b685057beac484e0b
SHA1 92e7ae0ebf2b57d72ea4091f065f29187cdf76fa
SHA256 20b0f94844860501e115fccd5c1462b2e2c932041d7989dc51c6d885b3429d8a
SHA512 6631ba4269375b502eccbcf601b0daccc98538f36bc0e1e2e5e48a28b4b9f523e06cb46d14b7ac2c60f70ce258b873fc42e31ebfb5237cb43cba7fb6a428eafc

memory/5704-979-0x0000000002BA0000-0x0000000002BD6000-memory.dmp

memory/5704-980-0x00000000052E0000-0x000000000590A000-memory.dmp

memory/5704-981-0x0000000005190000-0x00000000051B2000-memory.dmp

memory/5704-982-0x0000000005980000-0x00000000059E6000-memory.dmp

memory/5704-983-0x00000000059F0000-0x0000000005A56000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pqtalveq.wvl.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5704-992-0x0000000005A60000-0x0000000005DB7000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5311adb814ecb956a75d42496709e006
SHA1 7389539b1fbd3532ba5e6535d2914ef699181a07
SHA256 5f487a5d168149e051ebaa97dad2388305652c24a47a0d77f67268390b8e00d1
SHA512 a5d6098a9397c8a06293abc66700e24d75647d593da90231a103f74f0b36a2c9a9dfbd4c254ef110774946b381d23f45731d65f204bf81b315c838eecc8b7db8

memory/5704-1002-0x0000000005F40000-0x0000000005F5E000-memory.dmp

memory/5704-1003-0x0000000006200000-0x000000000624C000-memory.dmp

memory/5704-1020-0x0000000006530000-0x0000000006564000-memory.dmp

memory/5704-1021-0x000000006AD00000-0x000000006AD4C000-memory.dmp

memory/5704-1030-0x00000000064F0000-0x000000000650E000-memory.dmp

memory/5704-1031-0x0000000007140000-0x00000000071E4000-memory.dmp

memory/5704-1032-0x0000000007A30000-0x00000000080AA000-memory.dmp

memory/5704-1033-0x00000000073B0000-0x00000000073CA000-memory.dmp

memory/5704-1034-0x0000000007580000-0x000000000759C000-memory.dmp

memory/5704-1035-0x0000000006500000-0x000000000650A000-memory.dmp

memory/5704-1036-0x0000000007610000-0x0000000007636000-memory.dmp

memory/1644-1121-0x0000000000D40000-0x0000000001480000-memory.dmp

memory/1644-1122-0x0000000008760000-0x000000000908C000-memory.dmp

memory/1644-1123-0x00000000097E0000-0x000000000989A000-memory.dmp

memory/1644-1124-0x000000000A320000-0x000000000A3BE000-memory.dmp

memory/1644-1125-0x000000000AB60000-0x000000000AB68000-memory.dmp

memory/1644-1126-0x000000000ABB0000-0x000000000ABE8000-memory.dmp

memory/1644-1127-0x000000000AB70000-0x000000000AB7E000-memory.dmp

memory/1644-1147-0x00000000064A0000-0x00000000064B0000-memory.dmp

memory/1644-1150-0x00000000065F0000-0x0000000006666000-memory.dmp

memory/1644-1148-0x00000000063E0000-0x0000000006492000-memory.dmp

memory/1644-1149-0x00000000064B0000-0x0000000006562000-memory.dmp

memory/1644-1151-0x00000000072D0000-0x00000000072EE000-memory.dmp

memory/1644-1152-0x00000000078A0000-0x0000000007A28000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3f194f56ed519679ac816e78ae5c1fa8
SHA1 adb6274a659d17b295f5ee4ad90463c5df681e22
SHA256 6b4352ab1632eec8dcd1eaf937500843a7e8738ca76e221488e0be10472160d6
SHA512 8685ec9ed2b3ff35c43ba26b1e4cf98f5020b533fd0d883e15feb508339d8d90921ac9b1bac241c10bded85a7ae39d224149367d34a6160352875562ca7966ad

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

MD5 b5ad5caaaee00cb8cf445427975ae66c
SHA1 dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256 b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA512 92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

MD5 d222b77a61527f2c177b0869e7babc24
SHA1 3f23acb984307a4aeba41ebbb70439c97ad1f268
SHA256 80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512 d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

memory/1644-1223-0x0000000010000000-0x00000000105A6000-memory.dmp

memory/1644-1224-0x0000000008210000-0x00000000082A2000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 00a3afb16b683dcd4920b118fd8f8fd4
SHA1 e8d23b929cfece152fb7c39a8766a2f832447441
SHA256 c7c99af216cbd65c7163fd3b5fb86a674c7a76ceb899c9007e8594808d907ed6
SHA512 0dbda6cdfa21e5380086cf54726afecbe8d46ba6afaf1031df32f7ffda22335c6ece8f3cd5c644a596c1c9e43650a60addf7418307f743b2483ca330db22cb1b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 2e8529e2c06a4e652eda95188f34ef94
SHA1 874e79d7876bd17e791ed65830142c078eaae52c
SHA256 6abbb496899628b8a8cc198892fb1ad407658c3c5f6eae5ad5f282626ca3f782
SHA512 689939e30bd0612425211eca5f149de978ebf6309fb245e284fa7d8e85968cd9c1486e910713c3a718b11b352f87cc239ec330accaf14ba47961c6cdbed8d422

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4ef284eee72644b9d35056c46503810d
SHA1 65a1adf4992c15c7c1f328de4c2afc14c90ad07c
SHA256 326e76760abc3671415e6cc44380cd33be377d4b03072eb3cd9a01aa8b161f8f
SHA512 4bb78f9d22b355342a67c503900e8c6e3529d0b66be5f187978586307bbf0525017ca31cec4de779f98be506c532f365f2b101e90e71d832142499e100f02ad2