ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox Evon Exploit V4 UWP_01606325.exe
Size 583KB
Sample260702-wx7d7agy4m
SHA256 ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684
MD5 7392e839c67ba537093c55353be265ba
SHA1 7c9bce283d6eb9b49dcdcc850e66e0148dc30d71
SHA512 07ccf85180c1d63cc03f9d0ff986d0c704f1ac7719e6f7bec56d32f397eb4400a623a19954914b1d391270ce0b08226ee48f92462c7ec2b6ee29500a36ca0617
SSDEEP 12288:w7yjhihTaVWs+OfaOp0XWgWasfMJo7WLrc7SrnTGf0TRz4hTB2eLsHjlsGk8y:yyjz99asfnyNrnTe0TShhLijlsGJy
TLSH
T132D49E123592C036C5B111B01929EFA690BEBD344F7245DBA7D41B2EDB346F26F31A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4072	ContentI3.exe
5972	OperaGX_01606325.exe
1344	installer.exe
5352	installer.exe
1668	installer.exe
3676	installer.exe
3212	installer.exe
5400	pmropn.exe
824	pmservice.exe
1672	svchost.exe
5928	pmropn.exe

Loads dropped DLL 2 IoCs

pid	Process
824	pmservice.exe
4396	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pmls.dll	pmropn.exe
File created	C:\Windows\system32\pmls64.dll	pmropn.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PremierOpinion\pmservice.exe	ContentI3.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmls.dll	ContentI3.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmropn64.exe	ContentI3.exe
File created	C:\Program Files (x86)\PremierOpinion\pmropn.exe	ContentI3.exe
File created	C:\PROGRA~2\PREMIE~1\RData.reg	reg.exe
File created	C:\PROGRA~2\PREMIE~1\tms.bin	pmservice.exe
File created	C:\Program Files (x86)\PremierOpinion\catrust.pem	pmservice.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmservice.exe	ContentI3.exe
File created	C:\Program Files (x86)\PremierOpinion\pmropn64.exe	ContentI3.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmph.dll	ContentI3.exe
File created	C:\Program Files (x86)\PremierOpinion\pmph.dll	ContentI3.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmropn.exe	ContentI3.exe
File created	C:\Program Files (x86)\PremierOpinion\pmropn32.exe	ContentI3.exe
File opened for modification	C:\PROGRA~2\PREMIE~1\RData.reg	reg.exe
File created	C:\Program Files (x86)\PremierOpinion\cacert.pem	pmservice.exe
File opened for modification	C:\PROGRA~2\PREMIE~1\snt.dat.bac	pmservice.exe
File created	C:\Program Files (x86)\PremierOpinion\pmls.dll	ContentI3.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmls64.dll	ContentI3.exe
File created	C:\Program Files (x86)\PremierOpinion\pmls64.dll	ContentI3.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmropn32.exe	ContentI3.exe
File created	C:\PROGRA~2\PREMIE~1\snt.dat	pmservice.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\REG694.tmp	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 19000000010000001000000012cab0233db2f09a0336851de92237df0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c76030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d6b0000000100000020000000e115835982ccb932a24fba804096fc7609c24ac74a155705f6308dde8c44c629140000000100000014000000c04d850dcd7a8e9bc67e8f20375eb747fd3d397e2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 5c000000010000000400000000080000140000000100000014000000c04d850dcd7a8e9bc67e8f20375eb747fd3d397e6b0000000100000020000000e115835982ccb932a24fba804096fc7609c24ac74a155705f6308dde8c44c629030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c7619000000010000001000000012cab0233db2f09a0336851de92237df2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmropn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c76030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 6b0000000100000020000000e115835982ccb932a24fba804096fc7609c24ac74a155705f6308dde8c44c629030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c762000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c76030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d6b0000000100000020000000e115835982ccb932a24fba804096fc7609c24ac74a155705f6308dde8c44c6292000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 140000000100000014000000c04d850dcd7a8e9bc67e8f20375eb747fd3d397e6b0000000100000020000000e115835982ccb932a24fba804096fc7609c24ac74a155705f6308dde8c44c629030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c762000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ContentI3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGX_01606325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmropn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmropn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Evon Exploit V4 UWP_01606325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Roblox Evon Exploit V4 UWP_01606325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Modifies data under HKEY_USERS 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	pmservice.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\OperaStable	Roblox Evon Exploit V4 UWP_01606325.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Roblox Evon Exploit V4 UWP_01606325.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings	Roblox Evon Exploit V4 UWP_01606325.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\OperaGXStable	Roblox Evon Exploit V4 UWP_01606325.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Roblox Evon Exploit V4 UWP_01606325.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\OperaGXStable	Roblox Evon Exploit V4 UWP_01606325.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Roblox Evon Exploit V4 UWP_01606325.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Roblox Evon Exploit V4 UWP_01606325.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\OperaStable	Roblox Evon Exploit V4 UWP_01606325.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D	pmropn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D	pmservice.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4388	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
824	pmservice.exe
824	pmservice.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	rundll32.exe
Token: SeDebugPrivilege	824	pmservice.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4388	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 4388	2136	Roblox Evon Exploit V4 UWP_01606325.exe	89
PID 2136 wrote to memory of 4072	2136	Roblox Evon Exploit V4 UWP_01606325.exe	95
PID 5820 wrote to memory of 5972	5820	Roblox Evon Exploit V4 UWP_01606325.exe	98
PID 5972 wrote to memory of 1344	5972	OperaGX_01606325.exe	99
PID 1344 wrote to memory of 5352	1344	installer.exe	100
PID 1344 wrote to memory of 1668	1344	installer.exe	101
PID 1344 wrote to memory of 3676	1344	installer.exe	102
PID 3676 wrote to memory of 3212	3676	installer.exe	103
PID 4072 wrote to memory of 5400	4072	ContentI3.exe	104
PID 824 wrote to memory of 4396	824	pmservice.exe	106
PID 824 wrote to memory of 1776	824	pmservice.exe	107
PID 4396 wrote to memory of 1672	4396	rundll32.exe	25
PID 824 wrote to memory of 5928	824	pmservice.exe	110

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Executes dropped EXE
PID:1672

C:\Users\Admin\AppData\Local\Temp\Roblox Evon Exploit V4 UWP_01606325.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox Evon Exploit V4 UWP_01606325.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  - Suspicious use of SetWindowsHookEx
  PID:4388
- C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
  "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Program Files (x86)\PremierOpinion\pmropn.exe
    C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:NcOc46Ic4WMHll1BAEPOGG -o:0
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:5400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:2608

C:\Users\Admin\AppData\Local\Temp\Roblox Evon Exploit V4 UWP_01606325.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox Evon Exploit V4 UWP_01606325.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5820
- C:\Users\Admin\AppData\Local\OperaGX_01606325.exe
  C:\Users\Admin\AppData\Local\OperaGX_01606325.exe --silent --allusers=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5972
- - C:\Users\Admin\AppData\Local\Temp\7zS457318BA\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS457318BA\installer.exe --silent --allusers=0 --server-tracking-blob=ZjNmNjA5MjBmYmUyNWUxZWM4MWIxNGRhNWY1ODkzNWVkMjc2NGIzZGQzMmFiNDhiMDQ5NmE4MmJhODI1MjMyMjp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTk2ZDBkYTkxM2RiYzRjMWZhMjY3ZWI3ZTczNDVlOGMxIiwidGltZXN0YW1wIjoiMTc4MzAxNjQ3MC44MjIyIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0dCX1BCNV85NDE2XzM1NzUiLCJpZCI6Ijk2ZDBkYTkxM2RiYzRjMWZhMjY3ZWI3ZTczNDVlOGMxIiwibWVkaXVtIjoicGEiLCJzb3VyY2UiOiJQV05nYW1lcyJ9LCJ1dWlkIjoiZTk3MTg1NTMtOTYzNy00ZGFjLTk0YWUtNjNiNjM5YzIxMGI5In0=
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\7zS457318BA\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS457318BA\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.18 --initial-client-data=0x2a8,0x2ac,0x2b0,0x288,0x2b4,0x7ff70d6ecd88,0x7ff70d6ecd94,0x7ff70d6ecda0
      4⤵
      Executes dropped EXE
      PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\.opera\c5c37a1e-391e-4afd-910e-2b5d72965979 Opera GX Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\c5c37a1e-391e-4afd-910e-2b5d72965979 Opera GX Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\7zS457318BA\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS457318BA\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera GX" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=1344 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\c5c37a1e-391e-4afd-910e-2b5d72965979 Opera GX Installer Temp\opera_package_20260702192114" --session-guid=a77dbfcc-6613-4e7c-96a3-afba67a06ee7 --server-tracking-blob="OGNkZmFjNDQ0ZjJkNWUyZWMwMTJiZWY4OTFhZWRjNmRjNzU1ZDkzZWM3MmFlZDkxZTdkOGRjODhlNDFjOGVjODp7ImNvdW50cnkiOiJHQiIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0dCX1BCNV85NDE2XzM1NzUmdXRtX2lkPTk2ZDBkYTkxM2RiYzRjMWZhMjY3ZWI3ZTczNDVlOGMxIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzgzMDE2NDcwLjgyMjIiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzQuMCAoY29tcGF0aWJsZTsgTVNJRSA3LjA7IFdpbmRvd3MgTlQgNi4yOyBXT1c2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fR0JfUEI1Xzk0MTZfMzU3NSIsImlkIjoiOTZkMGRhOTEzZGJjNGMxZmEyNjdlYjdlNzM0NWU4YzEiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJlOTcxODU1My05NjM3LTRkYWMtOTRhZS02M2I2MzljMjEwYjkifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=F007000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\7zS457318BA\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS457318BA\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=133.0.5932.18 --initial-client-data=0x2a0,0x2a4,0x2b4,0x27c,0x2b8,0x7ff70d6ecd88,0x7ff70d6ecd94,0x7ff70d6ecda0
        5⤵
        Executes dropped EXE
        
        PID:3212

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\452ec8e0194b4159b1c061e0a9261680 /t 1376 /p 5820
1⤵
PID:3612

C:\Program Files (x86)\PremierOpinion\pmservice.exe
"C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1672
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4396
- C:\Windows\SysWOW64\reg.exe
  reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1776
- \??\c:\program files (x86)\premieropinion\pmropn.exe
  "c:\program files (x86)\premieropinion\pmropn.exe" -boot
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cacert.pem

Path C:\Program Files (x86)\PremierOpinion\cacert.pem
Size 3KB
SHA256 9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87
MD5 77eb3ade4c5b0db67c6e8a26f131073c
SHA1 ad9e8c00174cc2e707f59df671f89a9d7fc2ffc7
SHA512 20eb7d34c80bb8d8a415bcdccf8e46cb36396c095ed1468b69c0cb91da915e3a14c7fd55247f68e64ff71cf8d336cc286c3662710ca6281840fdc2f1eb7ac6a1
TLSH
T1CF616E89DB903C566CA941E3D52F37BE0551C7272D97EA620A09A050C32AF39423DDCC
MD5 SHA1 SHA512 TLSH

Submit Download

644EF2CA4E57862261CCEF9D8157BC2F_A97F329B3857A69CCA0076D79EDD6283

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644EF2CA4E57862261CCEF9D8157BC2F_A97F329B3857A69CCA0076D79EDD6283
Size 471B
SHA256 df5e6434250063800d56d91154e52c83393d3c736dcd230a7eea50df1c9aafd7
MD5 8000ee6515d16128b45a95c09c3da66d
SHA1 fb9d14aeeccc9767fc611b1f6d61cbf3cc68db32
SHA512 65fbcfb5a867b9adcf1e5e32bf98e4be61856a3d698625a4e7ef69d63de58bf8d0baab0c2e421a6ae0c5821e4e49783e8d779878e86315ca1c28bf5fc24c8e17
TLSH
T18FF0DCFB44B7489198C3DE5426E6DF16351CFA641488092293318998A720FB9D2BE058
MD5 SHA1 SHA512 TLSH

Submit Download

75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA
Size 1KB
SHA256 6e561d00cb2f38f5c0a3552c35fd14e96ce6e29469ac95b8498c7ac151ef7e06
MD5 8f884876392a8a2cefbf2738302106d4
SHA1 09e0edb009e68e8eca5a7f134c12db623a821459
SHA512 6f1c58e73cd2b1c15f344c942f58aca8e972d5edc84d721098368f676f33604f78dd48713e51fbe26c7e26fbe7006614e161ded0b5cd224b96ce274b2a9895e8
TLSH
T1B921A7F75BA86CF1AE952F9A50D8DA39BD3061D8BDE188339421845654443734B1405D
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 71ccd39de69ec147afd8ad4337a36829dcababbf40897250380c7770de551242
MD5 2595e903fcb3b99996adb2cc2bf504c8
SHA1 89954e0577e83e0008d58a2dc6cd0aaad2972a62
SHA512 71a76aa25ce3ea545922ad9cee54cd3fff4c971ee4e5ddf6aa4832743db48da795ae8e76883cf5e5acab6818e8aba44515c72848579c476c54bda2e43e0cac35
TLSH
T1CA31CE4EA2113027D686BF72D8CEBE93CDB033476BCAD05B18455E8229AAFD11FC81C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 1KB
SHA256 47fe7df02f3013441f62bea37f9de87921e00e23ab8b40c91b9eeab13186c4f4
MD5 1c516e5f5b37335d0de290f97f63f3d2
SHA1 50efe1dcb9efb71b250ad5aa70cebaee3c36feff
SHA512 a58c53c26c640c4832be9117c757823d50500a4bb2e567dcb9bc6bc8f6aedcca452eddfba54a52520f933229aae0294d7af002d087bd129b06fc86f0715c11c5
TLSH
T15C310AFE1F516995AEC17F144E4DE33D1C306BE8A8D61C23B028C086D8C0BB3A84D40B
MD5 SHA1 SHA512 TLSH

Submit Download

C1FCA6D61D8F4CEC04EBECE6E4B83B12_5864C5D103AA2977DAA3610A2E65E58A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C1FCA6D61D8F4CEC04EBECE6E4B83B12_5864C5D103AA2977DAA3610A2E65E58A
Size 472B
SHA256 8a572112a91fc12fc680469797293af88e0e230d6628b64ab3e4d75a29588d26
MD5 d823e43e441595f4cb19a0e7f3959475
SHA1 64b1298f50246169736a70fd135acba790c931c5
SHA512 0e1102aecdca2b042b3a9cf2b19f923e18536ba058b8191e8b9e8d15dfe80b8bad81602fb5c1eece501ab530ddfc2f73c68bd9cc9a85988a246a73a14c6f19cd
TLSH
T114F054AB027F704162C694683DF37D6914FC55150C84082026383ED7AA617F7513A02C
MD5 SHA1 SHA512 TLSH

Submit Download

D1BEC81CCAFDC823A062FF26A89A6B6D_49003E2DFFA186EC4076AAFA80AAFC42

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_49003E2DFFA186EC4076AAFA80AAFC42
Size 471B
SHA256 7e89a8203b684b390ce7b1c201ec48378aa6eff97030162c12bc835ceb46fd94
MD5 453176e71e6dff3ce40c39c9edb48f97
SHA1 13bbdd7bc275ea84a674eda7f261f06956bf5094
SHA512 49e41a56dcb3707bcc2dc4ae8d82a1ac2466d30ea2848aaa2fa3ac7c944968359fc377b79abd64805f4bea2feb5b7fc182f4f5a22d0830649d0c7989cafc7f77
TLSH
T19BF0D4D50871E1B27E590D087DFC713B787348505CC25DFA24FD1084CA145DA643D426
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 4b00900886fc53df65f90f9bf7c1bc61d8e9588c8fb660ce2b57f89c4ba977f7
MD5 260a9a20500abb674200330b4c9b7892
SHA1 e6aa6344aa3205674d9aa9b27281f968fb26588a
SHA512 ebf38b5b9dcf399e8008229d3c1e3c95ace6055b81a473653bfe68eaf7b2d03988a4cbc8c288099af47b204ff43415495a152a5137056d7c26a6f44f2da316b1
TLSH
T109F0DC9341CEC87167CE4EDE43E4863C3826C16A58D62459913E4DF853692FE2E2E039
MD5 SHA1 SHA512 TLSH

Submit Download

644EF2CA4E57862261CCEF9D8157BC2F_A97F329B3857A69CCA0076D79EDD6283

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644EF2CA4E57862261CCEF9D8157BC2F_A97F329B3857A69CCA0076D79EDD6283
Size 410B
SHA256 81d3be8b602d322c43444afdf9d535fb7b04cff9a0b01dd79f282f17426e5dd8
MD5 59320d4f64b40dda37de86a6af945d21
SHA1 bc858b6157068858e58517350b546a134452b92b
SHA512 faf1a70e9657ffee29aae27041d3bf709d192f8f81c292a07fcc3c426642fe2ae57d8ad8a7e4bfcb5313992927e8d7215e87e1a60fea1b28cccb19ed0c0ab5e9
TLSH
T153E0200C25FE815DF1F1DD7ACBC1BA114A6BD155901742E519F44304A61AD425D53B35
MD5 SHA1 SHA512 TLSH

Submit Download

75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA
Size 438B
SHA256 2d15447093f0346a8307839fb91c393fb91826523ff8fc1da4e021fc9324080f
MD5 6353ecaf43e6d0b55031312067336863
SHA1 d7fdb97993a83d0f7cd5fd684b65592d0aab2263
SHA512 b699f52f99efa12a5bf595ff5c43a7b7a695cf9d4081cbd7d1c3e467ae0f1f318a389ad150f6cca2e407e9e45e26c22ab80658748b4692736890bb1a7b103c22
TLSH
T1D5F06834A6FF422EF232F9B54BCDB275C82EF2358409A3B459A0674C6741D809CA3516
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 f174d90931ef2f7af63c6cedf832546dfc5ff44050ab0a7fe5563a743cd15254
MD5 29a9c179faa67adaf064fc77e8f070f1
SHA1 cf6c60dcfaef5d318e96d591ef4e24367a0bd9d3
SHA512 96e153d5b5605d420b41be31a588b8cb49f998994db47895cad43d4f6356f1cb473ba9444b0973a8489554d38706b522cc1fdc91b86769999af5b3960a6f4ff6
TLSH
T158C04C1177215726F15409BF169669510AF59A43CA5283580F71321C551A98589E0D45
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 1bf273985d865968ea6a846131aa2a90dbdec201dcb254e48e20274557f684e6
MD5 a0ecb011d4a75944c87e2deec696a867
SHA1 1bb3a56326e43256c94e8af70d728a723e533439
SHA512 2c5e3c41d9cb02fb2158da16d25d69fa8f73aa78890e3ffc9ee5c716d239828f8a74c37cec06754eb06fc1e6eee388229d0a0acaf175e0ad9583202217fd61f5
TLSH
T150C09B1473654719F20D153D7AD51A0417B58505F5CAC3444B7551348518A450871D05
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 432B
SHA256 eae32da15b0c3b088cffbccd130f5ec1d5f0bea10dae4e4aba6b6e1fba6874ef
MD5 ffd46a33af902a500a992e51d60393e8
SHA1 eeb1079bc27dc627ea285af63905514781668e54
SHA512 cf8d9ffd18a47762d5dd4ed9c5bf81017f1a4215813923c50e138a7fbbe7bef53cc62b3ee3355c9c2737d5ee3d6589eda08d7c7f619c88096fcca1f40eecbc5f
TLSH
T1B0E0616625BE4319F2E1D7360FC93D15D47BF516500DB35117A0571576198401C3EA36
MD5 SHA1 SHA512 TLSH

Submit Download

C1FCA6D61D8F4CEC04EBECE6E4B83B12_5864C5D103AA2977DAA3610A2E65E58A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1FCA6D61D8F4CEC04EBECE6E4B83B12_5864C5D103AA2977DAA3610A2E65E58A
Size 418B
SHA256 0619f4c055bdb407f2fd914afef7d62391e24eefc77d25c89fec488b584acedb
MD5 4cbf1209d7c2354e5b2661070fb70f6f
SHA1 38a6729a28ab2058a1cee418418e448ea8a00f5d
SHA512 9db3a0330018720fb409ecd20ab9dd0357e05259ead5beb200cfe7f17baac111ceef5a556a41361eac6f78932f8fea737bc35a1e6f85d8eb4f808aca2ad14d41
TLSH
T11CE0201C31FE411EF7E2D97B57C477114496E069C02A43F545F48B046755C036D93B55
MD5 SHA1 SHA512 TLSH

Submit Download

D1BEC81CCAFDC823A062FF26A89A6B6D_49003E2DFFA186EC4076AAFA80AAFC42

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_49003E2DFFA186EC4076AAFA80AAFC42
Size 418B
SHA256 9f0a58aba9a25aab8ef1b9d9c7ccd28063d6401bd478c8e4873fa812b2b93fe3
MD5 f2a0c3be29bfedeb32ecc1b5371419bc
SHA1 13d4272da70085922bbd6d967cfef430e87badbf
SHA512 7753b4c8499c954ff58f5992cfe5c2bc79577c1f0386d8de073d12829b4a1af0ea5e6aa521df1f6cbad0a863c9fe4c3da9918dcd7a9a9a192369daf7c67d7a20
TLSH
T1A0E0C00424FE421EFB76DAF843C87432CAADE16F98009EF12AD14350A305D00CC57928
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 83ce7bdd272eca8b52219f583a104d8ebf182a4f9f1160b2290c7a8a59f745d4
MD5 ae98ceb0339533d6faffdb42daba43b8
SHA1 5259b4acc6b18664d08486758b824cbc566f2ce3
SHA512 7641f06cb6a50972c31e7a05f7afa1de74d25e670bd0af2ccbab9d3547f18b6250dcbee91ab34623bbc61a3f945779c0e3d5c39a5aeea3020e98593d670efd1d
TLSH
T1E6E0682415FB016DE5F4E0744BD5E9250956F026081892B41AE057047622900AE52A75
MD5 SHA1 SHA512 TLSH

Submit Download

geo[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5HSRKP1R\geo[1].htm
Size 18B
SHA256 0cd71ddb91eff71c88363a69f8df5c405619c00c427390b99fb40a48dcabe7f1
MD5 fe0b02245e5d1be38a3df5ab65dbe28e
SHA1 f96fd3e64c187e755c852e03b2dacde0056c7d36
SHA512 634065012812801a1930f2457830bf1f89dd555e647ca3aa841e644eb4ad0dc2d5c0ea5012863342135fdd4d607ec773557d8f1e16de421d80ffd06386352d45
MD5 SHA1 SHA512

Submit Download

PO[1].jpg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9Z0BH3YQ\PO[1].jpg
Size 31KB
SHA256 c5944813c497e6be5d78b100104b309ec0995e95cf0cf9748ba6ff0975de4c18
MD5 e65948b77ff1e2bf03fa680b5ee1a1d1
SHA1 c586378e25859837957a0d986a06906c84c4f779
SHA512 9b411cbfd917e3796a48a3ebae919e83cfc2e003013bc2f63606d6adbf39ecd0c0c37c43ba7a444a7b02d5beaf3850939a0f028d529c3fd577fc477b8d9b1645
SSDEEP 768:tmD7e5mo7mHYy2DHaxNGLURsuEa0do1mMbr0slGbx:tV5LcaTaxN8CxEDo1mmr/lGN
TLSH
T14AE2C0656B53CE42F9D2F7396469E3932331BB6913E33386B44CB451BB512C06C8E693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo[1].png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B4DAGNZR\logo[1].png
Size 1KB
SHA256 c97e703578120c1f7a570acac3b461178a5e051ce16be9e266c1789c1d610ac0
MD5 2d4e9e8198f0c3eade53c619cd1fe4ea
SHA1 80b29f8dd0c4951ce7cad0db1fad1d9fdb275fc9
SHA512 afef06bfc6bf857a1b7966a04a8779aabf3e8a6d79b4c51867335190959acc469a4e1929b4c66430a3eece1aa5d1decddad005b326ec830c2b3a57179f3c626e
TLSH
T16A210B4723B4BEC7A2A30085230E0056A13687501168B7E58B87ED57719518542A2B86
MD5 SHA1 SHA512 TLSH

Submit Download

OperaGX_01606325.exe

Path C:\Users\Admin\AppData\Local\OperaGX_01606325.exe
Size 3.9MB
SHA256 eef30c4d2faf13ebde7e1ab2e1345827fb21aa15b3da518d01ab72c55891460a
MD5 2c8b20faf965fa38dbe487a398902ead
SHA1 23d9e1cf737f55bdd9c7c24e2b71560169f9f488
SHA512 bfc0aa6bbdd9c927225583f0b82211c73a0c29741a9d3bb273646bc43541d366b0734a71410b0d85370857276f2da5a7b74e8fba886c87d9ebfa1a3d5dbcf7c7
SSDEEP 98304:rAUea9WGOiIELZxS7ORfjozZBQHkqzn2T0bsyvr/gO:zWGDkORfczZpM2Wsyvrn
TLSH
T1FF1633507B40A4B1E19211328B7CFB49A6BEF1765E224D9B67D80F3E8FB0941D939F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS457318BA\installer.exe
Size 9.1MB
SHA256 61b958aba3bb53517a10908bb03c845104f8c7b712255b8e3308d13c1b15580e
MD5 c62e9092c8a741472e701d1d20bb75d7
SHA1 94df291f722126688a755fbadf3c7596f0d13913
SHA512 69fc5a6f2721a62e954b98258a3ba98c27f614b44c8142ee226d5ab580c6f888159df81907f8332c7aa9c8c4686ce6d1882c497c13805bd36d8fa28d67660b90
SSDEEP 98304:DU+SWsBgkGKjqfmbZKhlGWuKUjzQweIgE0qroFBI3++wteEmE:4WsBg4Omb4k6Vqb3+BqE
TLSH
T195A68D53F3EA01E8D0AFCA748B7A5232A9757C464B34A2DF0A9436250E75FD45B3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ContentI3.exe

Path C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
Size 3.8MB
SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
MD5 bf6eed6cdc17a0130189a33a55ef5209
SHA1 e337f5a0931f69c464f162385f1330b4d27b372f
SHA512 90d23fd84007343e85f9fc003cf826b112fd930216a24d8c1488468443ae2a4b0c3cc2426b91c81a8228e125050e922fce05672e010e65247709fc4a7b856f1d
SSDEEP 98304:QOlxyx1rYP44YaQqtGeIEAGoZXvFYfyCu:QOS7dqtGeIhGQXNYfRu
TLSH
T119166C02F6408039FAD201FAC3B64978EE789F141389A1D383D5B8F96B765D2783675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmls.dll

Path C:\Users\Admin\AppData\Local\Temp\~osB9.tmp\pmls.dll
Size 884KB
SHA256 e471da417462c9f60181c27efe2355db4f0b3b4df6bd0d4097864a72677d8e5d
MD5 090730c9ca6c88c8ca73ded170e8b197
SHA1 5e4b58186e532af507fd4dca01f6396e55ddcbf7
SHA512 177efae6a662f42d4c59e6d9260af2eb126266e51e84ac324d4d319c761d9680044ffb6472c846d8c22895c6ad3c92d9ab6e4330b23febf1f8646e4e3bd572b7
SSDEEP 24576:Gde43g1CYMCZPGUpzR1EytT6ehqglHz5fbCKr1liRdHQJbi2pKwouuyv:GW1tfbCm1liUbi2Uwouuyv
TLSH
T10215AF023D59C070E39F117029696FABAAFDDD200BF18DDB67C01DFE99309D2653266A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmls64.dll

Path C:\Users\Admin\AppData\Local\Temp\~osB9.tmp\pmls64.dll
Size 1.1MB
SHA256 877c2894f42bf078dfa36f06b543490d800a32c4f5245464bfec300b56867661
MD5 3bc077723836060db010dacc3daa5a7b
SHA1 ee2299462546960e9505d3aa339bbaf1f95688bd
SHA512 3b31567564ec4c01c478f58192f49237d4d7a9744ee65c8cd9f19c34d1aad32791baf7748d2d11f3a5c2b7c0de9a341774e5b2137dfd1c7416e44a07eb966840
SSDEEP 24576:vX5RidvQ7Df5LWOkAgiqqi7oc/ETQDw6s2KM:/5LPdWOkAgiqqiP88D9LKM
TLSH
T1A6358C1F636501BCE0ABD078C51B5A07E3B4784A03B09ADF17A056AA2F677B16F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmph.dll

Path C:\Users\Admin\AppData\Local\Temp\~osB9.tmp\pmph.dll
Size 806KB
SHA256 7cdd0b4b6492483d07ddd1869ea4c213d8d5043aec14117b1a5926093bedc7e1
MD5 27c1633ae24898c3c8fc6638ad72d4e4
SHA1 5c7751029cfd5c4055512f40d95b63fdee919ac3
SHA512 4b670092da2fbb6ff7814ab170e2c8141d148d99300794fcbd524f7ce9d0b20b3abff80c250cb949c8bf53dbb1612be65613f20e02225ce4dc20f7c43fdaebdf
SSDEEP 12288:i9VZRG3DDOEM3/auz7iMpAxHeoHVMSe60z1eEX:EVZRODGhZa1eoHVMSFEX
TLSH
T16D057D01EA8380B1F85D137411A6A72E7ABCB716D3302BEFFB903E7A5C215E055792B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn.exe

Path C:\Users\Admin\AppData\Local\Temp\~osB9.tmp\pmropn.exe
Size 7.4MB
SHA256 b8e134c1518903be8b260f821d1896b521f7f70956090562b3cc71b71bf8cb1b
MD5 4ab3a64141bcb6b1e34cbe8cd310fadc
SHA1 45120754f1821ca49f4520b1b31724023a07e752
SHA512 0e6a6dda054503f88eb714a4c6ea0b16e297a77757d4d42e243596d808f2a99540eeddb070dc3df06f0ca16822abe39f421c70e5d2891f7da6079020da963c97
SSDEEP 196608:wwlq5MyNKcI37mqQgLVSC3JEpgniiLkNCqtcF97:wwl0MwKcI3CqQSZ9iiLkUqt4
TLSH
T13B76AE02FA408079F6C600B582B60FB9EE78DE200365A5C353D1B9BD6F76ED27836756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn32.exe

Path C:\Users\Admin\AppData\Local\Temp\~osB9.tmp\pmropn32.exe
Size 244KB
SHA256 b56a74fbe9b0a0c027f230a412dd69afbb697c41f31635352b37fe74d334fc15
MD5 a6348e20d0a07a438b3e596350c8875a
SHA1 6621babf23511ed41f8910d15a263da7ba9b3c24
SHA512 3158f2893ad8b316e69868bd98736d6405ab345925bb5bdbb0bb6897897ba048c72303e957aee0739c239bd45c17fb04827f7f21ab1a000beb1bad3616f3a6f8
SSDEEP 3072:Tf1jylH+OCcTA/3xjjjplcg8kNRuEbrqAyMyKpNoQwOqw8930/iuAg0FubzgIZAK:sleOvk/pp5Rh/yMy+ovDCAO7WU1
TLSH
T1AE349D1176D0C472D973153608F8DB799A7EBD200F519DEB53D80B3E8E306D2EA31A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn64.exe

Path C:\Users\Admin\AppData\Local\Temp\~osB9.tmp\pmropn64.exe
Size 303KB
SHA256 f6de7618e24c0731e5ff77aa56f200d3c0e30e672a63c7d11b9717ece29e6814
MD5 b6ce4ef9f276abe27d3dff35eead758d
SHA1 77e8545d979a595acac1a900a0c1d551166eaf8c
SHA512 c13fd956bef83be59195e766874b8502ac514d12de2c2f411619ab8d61c3353e06ad01987b32e7a3cffdd51c25e07873f0bbcf2d00a8dfa5692539c3b96a9836
SSDEEP 6144:q335ui2SMWpQcXubvHPUyKn6ZXu/x630ohVbdquTCB:G35ui2CpRAvHPUDn6C630oxc
TLSH
T186646C59B3A414F5EDB3C13CC8911506EAB278665771DBEF03A0865A2F237E0AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmservice.exe

Path C:\Users\Admin\AppData\Local\Temp\~osB9.tmp\pmservice.exe
Size 4.6MB
SHA256 f76c45ac8440c5a36096d7956bdf933bfff268469d1a73573c7f001f790dafa1
MD5 20eb40af892fabf7e74d1e64081ca481
SHA1 6683863abaefb1f8d9b201f5af316731655ea4b5
SHA512 249031743bb2a8f8466e2afca73b0ba9d1b99082746974629763099bc41e00db2107282a0dc1477789000f86268f3587b5051c7fe629634ea167d2c7bbb49704
SSDEEP 49152:agOW4nR8lACIclR6KeFWLkCFRRGN1NYWmkxMpXmP5cpmeNgYPgCFUJxazDGPO1pt:agOW4RkIcSEoCjIYW+vgYYCFQYN4R+
TLSH
T1AB268D01F5408029F9D300B283F70A78EE78AF201765A1C793D5B8F9AB769D1793979B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 93a7dd0e384e65d5cbbba745305b3be89e7e4d630e3dc8429a63fb7e10ff70ad
MD5 bb1a81cd014a90dc56d7e57a68a6e45e
SHA1 5d290111f5dda3ec8b0ca04c2cdbc1470592d9fd
SHA512 9d896768a00fdef9923f97e984245d95af6aea9ff3dd504cc75cb4c18c57b10cf315b9993cc0ace8e7f654c467b96e88a322806756e4016729ccc81353edd12f
TLSH
T194A00224A4D4A28D684E8B4C7BF194A434200047356DE355CC704701410770665E21C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 f756ee13789d70ece7df4f9078777e2ec809d328bda16d4bcbc8822b7b216fbf
MD5 8080c04f88d7cb727c061eac970e8b44
SHA1 09a58f358f6454eb71bd3c6571d7c3bddb1c9927
SHA512 97e26c0d47685a59b43c0110426a7a8fc7996c30ed6caeeb2b15c0e1e82322d4784e60503c6bdab35db64330e39c36918b2c002b9423af2b125d3690a2fbf671
MD5 SHA1 SHA512

Submit Download

memory/4396-157-0x00007FFF66380000-0x00007FFF663F4000-memory.dmp

Download

memory/4396-156-0x00007FFF64710000-0x00007FFF64AB1000-memory.dmp

Download

memory/4396-162-0x00007FFF631D0000-0x00007FFF63218000-memory.dmp

Download

memory/4396-161-0x00007FFF5E590000-0x00007FFF5E6B6000-memory.dmp

Download

memory/4396-163-0x00007FFF66530000-0x00007FFF66C26000-memory.dmp

Download

memory/4396-158-0x00007FFF50FA0000-0x00007FFF51223000-memory.dmp

Download

memory/4396-160-0x00007FFF63430000-0x00007FFF63498000-memory.dmp

Download

memory/4396-155-0x00007FFF660C0000-0x00007FFF66187000-memory.dmp

Download