35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FluxusZ Windows 1.2.5_73636963.exe
Size 702KB
Sample260711-cskvvacx9s
SHA256 35d5cdf23553b14ad8051f68b1af8199805f06479391888f609af4ed54ed5a63
MD5 cd85c75fa053954c4ae4ee338d3bcb63
SHA1 fb2fb89c667d901ef01600dae3f027c7dbfe16be
SHA512 f0d7e4732df889e6513f67e266c68bf7490c513bb78736b4fac4d90ed49040415a500ae8f0f9b696e100a92c871d5cf80fdb628bec0f42e3a531e1a636873f6d
SSDEEP 12288:utflJ50c6GeHR6Kjx288tG6rmC0tzeIiZ4fFo:ut9J6MB8gGaUtze74f+
TLSH
T123E48C16B6A801FCE1B7D179C9524912F7B1B847437297CF03A05A66AF2BAE05F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4636	ContentI3.exe
4444	pmropn.exe
3140	pmservice.exe
1600	svchost.exe
5716	pmropn.exe
4848	pmropn64.exe
2732	pmropn32.exe
4060	pmropn.exe
4200	Process not Found
3424	Process not Found
1148	Process not Found

Loads dropped DLL 20 IoCs

pid	Process
3140	pmservice.exe
3916	rundll32.exe
5716	pmropn.exe
4848	pmropn64.exe
4560	unsecapp.exe
2732	pmropn32.exe
4240	NOTEPAD.EXE
4156	Process not Found
1516	Process not Found
5108	FluxusZ Windows 1.2.5_73636963.exe
3184	NOTEPAD.EXE
3172	Process not Found
5356	NOTEPAD.EXE
2592	NOTEPAD.EXE
456	NOTEPAD.EXE
572	NOTEPAD.EXE
4264	NOTEPAD.EXE
1748	NOTEPAD.EXE
5704	NOTEPAD.EXE
4116	NOTEPAD.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pmls.dll	pmropn.exe
File created	C:\Windows\system32\pmls64.dll	pmropn.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PremierOpinion\pmropn.exe	ContentI3.exe
File created	C:\PROGRA~2\PREMIE~1\tms.bin	pmservice.exe
File created	C:\PROGRA~2\PREMIE~1\snt.dat	pmservice.exe
File created	C:\Program Files (x86)\PremierOpinion\pmoci.bin	pmropn.exe
File created	C:\Program Files (x86)\PremierOpinion\pmservice.exe	ContentI3.exe
File created	C:\Program Files (x86)\PremierOpinion\pmls64.dll	ContentI3.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmph.dll	ContentI3.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmropn.exe	ContentI3.exe
File created	C:\PROGRA~2\PREMIE~1\RData.reg	reg.exe
File opened for modification	C:\PROGRA~2\PREMIE~1\snt.dat.bac	pmservice.exe
File created	C:\Program Files (x86)\PremierOpinion\readme.txt	pmropn.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmls.dll	ContentI3.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmls64.dll	ContentI3.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmropn64.exe	ContentI3.exe
File created	C:\Program Files (x86)\PremierOpinion\catrust.pem	pmservice.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmservice.exe	ContentI3.exe
File created	C:\Program Files (x86)\PremierOpinion\pmls.dll	ContentI3.exe
File created	C:\Program Files (x86)\PremierOpinion\pmropn64.exe	ContentI3.exe
File opened for modification	C:\Program Files (x86)\PremierOpinion\pmropn32.exe	ContentI3.exe
File created	C:\Program Files (x86)\PremierOpinion\cacert.pem	pmservice.exe
File opened for modification	C:\PROGRA~2\PREMIE~1\RData.reg	reg.exe
File created	C:\Program Files (x86)\PremierOpinion\pmocid.bin	pmropn.exe
File created	C:\Program Files (x86)\PremierOpinion\pmropn32.exe	ContentI3.exe
File created	C:\Program Files (x86)\PremierOpinion\pmph.dll	ContentI3.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\REG9C80.tmp	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 7 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c76030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d6b0000000100000020000000e115835982ccb932a24fba804096fc7609c24ac74a155705f6308dde8c44c6292000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 140000000100000014000000c04d850dcd7a8e9bc67e8f20375eb747fd3d397e6b0000000100000020000000e115835982ccb932a24fba804096fc7609c24ac74a155705f6308dde8c44c629030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c762000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 19000000010000001000000012cab0233db2f09a0336851de92237df0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c76030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d6b0000000100000020000000e115835982ccb932a24fba804096fc7609c24ac74a155705f6308dde8c44c629140000000100000014000000c04d850dcd7a8e9bc67e8f20375eb747fd3d397e2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 5c000000010000000400000000080000140000000100000014000000c04d850dcd7a8e9bc67e8f20375eb747fd3d397e6b0000000100000020000000e115835982ccb932a24fba804096fc7609c24ac74a155705f6308dde8c44c629030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c7619000000010000001000000012cab0233db2f09a0336851de92237df2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmropn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c76030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d2000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D\Blob = 6b0000000100000020000000e115835982ccb932a24fba804096fc7609c24ac74a155705f6308dde8c44c629030000000100000014000000a8aed8642f8ab55f26212d915c615bdab8c0de7d0f000000010000002000000059b45fa897dc38a658a39e65922901f06e83ad128e69a13503a586f0ddb29c762000000001000000bf040000308204bb308203a3a003020102020900b8bc215aa037539d300d06092a864886f70d01010b05003081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d301e170d3139303932363230303231305a170d3439303931383230303231305a3081d9310b30090603550406130255533111300f06035504080c0856697267696e6961310f300d06035504070c06526573746f6e311b3019060355040a0c124469676974616c205265666c656374696f6e3131302f060355040b0c284469676974616c205265666c656374696f6e20436572746966696361746520417574686f72697479311e301c06035504030c154469676974616c205265666c656374696f6e2043413136303406092a864886f70d0109011627737570706f72742d7465616d406469676974616c7265666c656374696f6e70616e656c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d54e84e4ff6a497854211480176680c606b4e72935884775798aed7f7480686feeb63b1389feccf931e081c22000052094a03d257cfefa99dec2669f2ef4b79bd593dc3ad1e934156ffc803118f25525e055fce0fb21ba59156f915dd1bf73e5070940542be08d2ffe9757a07d9767086872503996a84f4576a4baea04c007326dfdd7d4742b9e17d6218a2f63fe2967a446792e4c1fda227fc6ca1efbbff315d88577d27bcc555e40af8f888caba76dd92dcdd3bbcbb8c0a1ac9153cc3661278858627666d8e4afab2b30ad19e6eb593c3e2febe478a5bff871cd29616bff8b1ce371fbbf375fcd8e869f89062167d855354803291513fb9668d7afbf24b9cb0203010001a38183308180301d0603551d0e04160414c04d850dcd7a8e9bc67e8f20375eb747fd3d397e301f0603551d23041830168014c04d850dcd7a8e9bc67e8f20375eb747fd3d397e300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b05000382010100bd8eb4a6bf99cb1d410709db71e2c933bfd76226013472f23a52da23652ab968e946bfdb495a20736b86ffb900f5ee2ccb1be25ae5eecec9ee47bfe75ccd143a76909febd45d3e240d4492e2b81d66622afb5de284683eb8455570961fa2b7ee899ff19d2f30c31d450a64d4f80b0658a37ebd37e9331f5eb9add40df722a141526c089bf7ce8f7559f766562fded7c78ef0ca231bd006db812b637d56e56805cef2106cec8e388b8d30e1510a1f00e45a55dad1859a6d7907fe5dba2465ec757277b85479dd8e3af211e6d247d51b3144705c7e18fc5bf7ac83f0e2e2bc080f6c27efe89c997156339e7d482411f34c401678651f2ea3c9ca4542769a28beeb	pmservice.exe

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmropn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmropn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ContentI3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmropn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmropn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe

Modifies data under HKEY_USERS 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	pmservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	pmservice.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\OperaGXStable	FluxusZ Windows 1.2.5_73636963.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	FluxusZ Windows 1.2.5_73636963.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\OperaStable	FluxusZ Windows 1.2.5_73636963.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	FluxusZ Windows 1.2.5_73636963.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	FluxusZ Windows 1.2.5_73636963.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D	pmservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	pmservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	pmservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8AED8642F8AB55F26212D915C615BDAB8C0DE7D	pmropn.exe

Opens file in notepad (likely ransom note) 16 IoCs

ransomware

pid	Process
4088	NOTEPAD.EXE
2928	NOTEPAD.EXE
456	NOTEPAD.EXE
4264	NOTEPAD.EXE
1748	NOTEPAD.EXE
5704	NOTEPAD.EXE
1200	NOTEPAD.EXE
2592	NOTEPAD.EXE
4240	NOTEPAD.EXE
3184	NOTEPAD.EXE
572	NOTEPAD.EXE
5652	NOTEPAD.EXE
812	NOTEPAD.EXE
4116	NOTEPAD.EXE
4984	NOTEPAD.EXE
5356	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	pmservice.exe
3140	pmservice.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe
5716	pmropn.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	rundll32.exe
Token: SeDebugPrivilege	3140	pmservice.exe
Token: SeTcbPrivilege	3140	pmservice.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5716	pmropn.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5716	pmropn.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4848	pmropn64.exe
4848	pmropn64.exe
4848	pmropn64.exe
2732	pmropn32.exe
2732	pmropn32.exe
2732	pmropn32.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 5652	5108	FluxusZ Windows 1.2.5_73636963.exe	88
PID 5108 wrote to memory of 1200	5108	FluxusZ Windows 1.2.5_73636963.exe	90
PID 5108 wrote to memory of 812	5108	FluxusZ Windows 1.2.5_73636963.exe	91
PID 5108 wrote to memory of 4636	5108	FluxusZ Windows 1.2.5_73636963.exe	92
PID 5108 wrote to memory of 4088	5108	FluxusZ Windows 1.2.5_73636963.exe	93
PID 4636 wrote to memory of 4444	4636	ContentI3.exe	94
PID 3140 wrote to memory of 3916	3140	pmservice.exe	97
PID 3916 wrote to memory of 1600	3916	rundll32.exe	23
PID 3140 wrote to memory of 4172	3140	pmservice.exe	98
PID 5108 wrote to memory of 2928	5108	FluxusZ Windows 1.2.5_73636963.exe	100
PID 5108 wrote to memory of 4984	5108	FluxusZ Windows 1.2.5_73636963.exe	101
PID 5108 wrote to memory of 2592	5108	FluxusZ Windows 1.2.5_73636963.exe	102
PID 5108 wrote to memory of 5356	5108	FluxusZ Windows 1.2.5_73636963.exe	103
PID 3140 wrote to memory of 5716	3140	pmservice.exe	104
PID 5108 wrote to memory of 4240	5108	FluxusZ Windows 1.2.5_73636963.exe	106
PID 3140 wrote to memory of 2324	3140	pmservice.exe	108
PID 3140 wrote to memory of 1008	3140	pmservice.exe	109
PID 1008 wrote to memory of 4848	1008	cmd.exe	110
PID 2324 wrote to memory of 2732	2324	cmd.exe	111
PID 5716 wrote to memory of 5720	5716	pmropn.exe	112
PID 3140 wrote to memory of 4060	3140	pmservice.exe	114
PID 4060 wrote to memory of 3244	4060	pmropn.exe	115
PID 4060 wrote to memory of 2040	4060	pmropn.exe	117
PID 4060 wrote to memory of 1816	4060	pmropn.exe	119
PID 4060 wrote to memory of 5180	4060	pmropn.exe	121
PID 4060 wrote to memory of 5936	4060	pmropn.exe	123
PID 4060 wrote to memory of 244	4060	pmropn.exe	125
PID 4060 wrote to memory of 1480	4060	pmropn.exe	127
PID 4060 wrote to memory of 3916	4060	pmropn.exe	129
PID 4060 wrote to memory of 6100	4060	pmropn.exe	131
PID 4060 wrote to memory of 4340	4060	pmropn.exe	133
PID 4060 wrote to memory of 4132	4060	pmropn.exe	135
PID 4060 wrote to memory of 4368	4060	pmropn.exe	137
PID 4060 wrote to memory of 6120	4060	pmropn.exe	139
PID 5716 wrote to memory of 4320	5716	pmropn.exe	141
PID 5108 wrote to memory of 3184	5108	FluxusZ Windows 1.2.5_73636963.exe	143
PID 5108 wrote to memory of 456	5108	FluxusZ Windows 1.2.5_73636963.exe	145
PID 5108 wrote to memory of 572	5108	FluxusZ Windows 1.2.5_73636963.exe	146
PID 5108 wrote to memory of 4264	5108	FluxusZ Windows 1.2.5_73636963.exe	147
PID 5108 wrote to memory of 1748	5108	FluxusZ Windows 1.2.5_73636963.exe	148
PID 5108 wrote to memory of 5704	5108	FluxusZ Windows 1.2.5_73636963.exe	149
PID 5108 wrote to memory of 4116	5108	FluxusZ Windows 1.2.5_73636963.exe	150

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Executes dropped EXE
PID:1600

C:\Users\Admin\AppData\Local\Temp\FluxusZ Windows 1.2.5_73636963.exe
"C:\Users\Admin\AppData\Local\Temp\FluxusZ Windows 1.2.5_73636963.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5652
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1200
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:812
- C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
  "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Program Files (x86)\PremierOpinion\pmropn.exe
    C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:wfldAUTO4BEF6p_vXfPOPN -o:0
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:4444
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4088
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2928
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4984
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Loads dropped DLL
  - Opens file in notepad (likely ransom note)
  PID:2592
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Loads dropped DLL
  - Opens file in notepad (likely ransom note)
  PID:5356
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Loads dropped DLL
  - Opens file in notepad (likely ransom note)
  PID:4240
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Loads dropped DLL
  - Opens file in notepad (likely ransom note)
  PID:3184
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Loads dropped DLL
  - Opens file in notepad (likely ransom note)
  PID:456
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Loads dropped DLL
  - Opens file in notepad (likely ransom note)
  PID:572
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Loads dropped DLL
  - Opens file in notepad (likely ransom note)
  PID:4264
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Loads dropped DLL
  - Opens file in notepad (likely ransom note)
  PID:1748
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Loads dropped DLL
  - Opens file in notepad (likely ransom note)
  PID:5704
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Loads dropped DLL
  - Opens file in notepad (likely ransom note)
  PID:4116

C:\Program Files (x86)\PremierOpinion\pmservice.exe
"C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\pmls64.dll,UpdateProcess 1600
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3916
- C:\Windows\SysWOW64\reg.exe
  reg.exe EXPORT "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}" C:\PROGRA~2\PREMIE~1\RData.reg /y
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4172
- \??\c:\program files (x86)\premieropinion\pmropn.exe
  "c:\program files (x86)\premieropinion\pmropn.exe" -boot
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -s
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5720
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -s
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4320
- C:\Windows\SysWOW64\cmd.exe
  /C C:\PROGRA~2\PREMIE~1\pmropn32.exe 5716
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\PROGRA~2\PREMIE~1\pmropn32.exe
    C:\PROGRA~2\PREMIE~1\pmropn32.exe 5716
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  /C C:\PROGRA~2\PREMIE~1\pmropn64.exe 5716
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\PROGRA~2\PREMIE~1\pmropn64.exe
    C:\PROGRA~2\PREMIE~1\pmropn64.exe 5716
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4848
- \??\c:\program files (x86)\premieropinion\pmropn.exe
  "c:\program files (x86)\premieropinion\pmropn.exe" -updateapps
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.aad.brokerplugin_cw5n1h2txyewy
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3244
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ecapp_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2040
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge.stable_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1816
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.sechealthui_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5180
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.ui.xaml.2.8_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5936
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.vclibs.140.00_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:244
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.win32webviewhost_cw5n1h2txyewy
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1480
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.narratorquickstart_8wekyb3d8bbwe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3916
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.shellexperiencehost_cw5n1h2txyewy
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6100
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4340
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=microsoftwindows.client.cbs_cw5n1h2txyewy
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4132
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=windows.immersivecontrolpanel_cw5n1h2txyewy
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4368
- - C:\Windows\SysWOW64\CheckNetIsolation.exe
    CheckNetIsolation.exe LoopbackExempt -a -n=windows_ie_ac_001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6120

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
- Loads dropped DLL
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cacert.pem

Path C:\Program Files (x86)\PremierOpinion\cacert.pem
Size 3KB
SHA256 9f19e7a7139cca8373b516ab1ae49c644aa1c8048e8c7aa5784774a081dcbb87
MD5 77eb3ade4c5b0db67c6e8a26f131073c
SHA1 ad9e8c00174cc2e707f59df671f89a9d7fc2ffc7
SHA512 20eb7d34c80bb8d8a415bcdccf8e46cb36396c095ed1468b69c0cb91da915e3a14c7fd55247f68e64ff71cf8d336cc286c3662710ca6281840fdc2f1eb7ac6a1
TLSH
T1CF616E89DB903C566CA941E3D52F37BE0551C7272D97EA620A09A050C32AF39423DDCC
MD5 SHA1 SHA512 TLSH

Submit Download

rule18[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3RN36VF1\rule18[1].xml
Size 128B
SHA256 9dfedfc7fa656ed83c4c5d9c517a694f59d6c1a40af31082d3ce011d28467591
MD5 895813e8661fe60698a61c73a66c24e8
SHA1 295e82d4bd9f16f89a9d19fec0b08c7285e53442
SHA512 61b5b8edb3a1a5a4c639355499aa32db516a9f4756b01accf69a668731f474a4ed24e3557ae6ec229373445659e2682c5d9bb5771ca0a55774aa23402a3ee341
TLSH
T179B02B26C391DC8061308B04F8C417148001C064C10C3453C43F18AA30532C33323B7C
MD5 SHA1 SHA512 TLSH

Submit Download

ContentI3.exe

Path C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
Size 3.8MB
SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
MD5 bf6eed6cdc17a0130189a33a55ef5209
SHA1 e337f5a0931f69c464f162385f1330b4d27b372f
SHA512 90d23fd84007343e85f9fc003cf826b112fd930216a24d8c1488468443ae2a4b0c3cc2426b91c81a8228e125050e922fce05672e010e65247709fc4a7b856f1d
SSDEEP 98304:QOlxyx1rYP44YaQqtGeIEAGoZXvFYfyCu:QOS7dqtGeIhGQXNYfRu
TLSH
T119166C02F6408039FAD201FAC3B64978EE789F141389A1D383D5B8F96B765D2783675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmls.dll

Path C:\Users\Admin\AppData\Local\Temp\~os91E2.tmp\pmls.dll
Size 884KB
SHA256 e471da417462c9f60181c27efe2355db4f0b3b4df6bd0d4097864a72677d8e5d
MD5 090730c9ca6c88c8ca73ded170e8b197
SHA1 5e4b58186e532af507fd4dca01f6396e55ddcbf7
SHA512 177efae6a662f42d4c59e6d9260af2eb126266e51e84ac324d4d319c761d9680044ffb6472c846d8c22895c6ad3c92d9ab6e4330b23febf1f8646e4e3bd572b7
SSDEEP 24576:Gde43g1CYMCZPGUpzR1EytT6ehqglHz5fbCKr1liRdHQJbi2pKwouuyv:GW1tfbCm1liUbi2Uwouuyv
TLSH
T10215AF023D59C070E39F117029696FABAAFDDD200BF18DDB67C01DFE99309D2653266A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmls64.dll

Path C:\Users\Admin\AppData\Local\Temp\~os91E2.tmp\pmls64.dll
Size 1.1MB
SHA256 877c2894f42bf078dfa36f06b543490d800a32c4f5245464bfec300b56867661
MD5 3bc077723836060db010dacc3daa5a7b
SHA1 ee2299462546960e9505d3aa339bbaf1f95688bd
SHA512 3b31567564ec4c01c478f58192f49237d4d7a9744ee65c8cd9f19c34d1aad32791baf7748d2d11f3a5c2b7c0de9a341774e5b2137dfd1c7416e44a07eb966840
SSDEEP 24576:vX5RidvQ7Df5LWOkAgiqqi7oc/ETQDw6s2KM:/5LPdWOkAgiqqiP88D9LKM
TLSH
T1A6358C1F636501BCE0ABD078C51B5A07E3B4784A03B09ADF17A056AA2F677B16F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmph.dll

Path C:\Users\Admin\AppData\Local\Temp\~os91E2.tmp\pmph.dll
Size 806KB
SHA256 7cdd0b4b6492483d07ddd1869ea4c213d8d5043aec14117b1a5926093bedc7e1
MD5 27c1633ae24898c3c8fc6638ad72d4e4
SHA1 5c7751029cfd5c4055512f40d95b63fdee919ac3
SHA512 4b670092da2fbb6ff7814ab170e2c8141d148d99300794fcbd524f7ce9d0b20b3abff80c250cb949c8bf53dbb1612be65613f20e02225ce4dc20f7c43fdaebdf
SSDEEP 12288:i9VZRG3DDOEM3/auz7iMpAxHeoHVMSe60z1eEX:EVZRODGhZa1eoHVMSFEX
TLSH
T16D057D01EA8380B1F85D137411A6A72E7ABCB716D3302BEFFB903E7A5C215E055792B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn.exe

Path C:\Users\Admin\AppData\Local\Temp\~os91E2.tmp\pmropn.exe
Size 7.4MB
SHA256 b8e134c1518903be8b260f821d1896b521f7f70956090562b3cc71b71bf8cb1b
MD5 4ab3a64141bcb6b1e34cbe8cd310fadc
SHA1 45120754f1821ca49f4520b1b31724023a07e752
SHA512 0e6a6dda054503f88eb714a4c6ea0b16e297a77757d4d42e243596d808f2a99540eeddb070dc3df06f0ca16822abe39f421c70e5d2891f7da6079020da963c97
SSDEEP 196608:wwlq5MyNKcI37mqQgLVSC3JEpgniiLkNCqtcF97:wwl0MwKcI3CqQSZ9iiLkUqt4
TLSH
T13B76AE02FA408079F6C600B582B60FB9EE78DE200365A5C353D1B9BD6F76ED27836756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn32.exe

Path C:\Users\Admin\AppData\Local\Temp\~os91E2.tmp\pmropn32.exe
Size 244KB
SHA256 b56a74fbe9b0a0c027f230a412dd69afbb697c41f31635352b37fe74d334fc15
MD5 a6348e20d0a07a438b3e596350c8875a
SHA1 6621babf23511ed41f8910d15a263da7ba9b3c24
SHA512 3158f2893ad8b316e69868bd98736d6405ab345925bb5bdbb0bb6897897ba048c72303e957aee0739c239bd45c17fb04827f7f21ab1a000beb1bad3616f3a6f8
SSDEEP 3072:Tf1jylH+OCcTA/3xjjjplcg8kNRuEbrqAyMyKpNoQwOqw8930/iuAg0FubzgIZAK:sleOvk/pp5Rh/yMy+ovDCAO7WU1
TLSH
T1AE349D1176D0C472D973153608F8DB799A7EBD200F519DEB53D80B3E8E306D2EA31A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmropn64.exe

Path C:\Users\Admin\AppData\Local\Temp\~os91E2.tmp\pmropn64.exe
Size 303KB
SHA256 f6de7618e24c0731e5ff77aa56f200d3c0e30e672a63c7d11b9717ece29e6814
MD5 b6ce4ef9f276abe27d3dff35eead758d
SHA1 77e8545d979a595acac1a900a0c1d551166eaf8c
SHA512 c13fd956bef83be59195e766874b8502ac514d12de2c2f411619ab8d61c3353e06ad01987b32e7a3cffdd51c25e07873f0bbcf2d00a8dfa5692539c3b96a9836
SSDEEP 6144:q335ui2SMWpQcXubvHPUyKn6ZXu/x630ohVbdquTCB:G35ui2CpRAvHPUDn6C630oxc
TLSH
T186646C59B3A414F5EDB3C13CC8911506EAB278665771DBEF03A0865A2F237E0AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmservice.exe

Path C:\Users\Admin\AppData\Local\Temp\~os91E2.tmp\pmservice.exe
Size 4.6MB
SHA256 f76c45ac8440c5a36096d7956bdf933bfff268469d1a73573c7f001f790dafa1
MD5 20eb40af892fabf7e74d1e64081ca481
SHA1 6683863abaefb1f8d9b201f5af316731655ea4b5
SHA512 249031743bb2a8f8466e2afca73b0ba9d1b99082746974629763099bc41e00db2107282a0dc1477789000f86268f3587b5051c7fe629634ea167d2c7bbb49704
SSDEEP 49152:agOW4nR8lACIclR6KeFWLkCFRRGN1NYWmkxMpXmP5cpmeNgYPgCFUJxazDGPO1pt:agOW4RkIcSEoCjIYW+vgYYCFQYN4R+
TLSH
T1AB268D01F5408029F9D300B283F70A78EE78AF201765A1C793D5B8F9AB769D1793979B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 5bb64791c2bf83b3560be9ca8d6d4039c3d794d789223d64f6c4102c42f5b16a
MD5 18770e05fe35ec606d430373be499644
SHA1 53f2f5b52190fd48e60d7833bb4febfff9be6482
SHA512 631beff2b02f4e068344bbda9716b09a24b65bb2d8b1ebed62ee2649590b884341ee2ce00fc3aef7e068f15cd3a80c103a32c6e3bc8cbfcf4066f74ccd04daea
TLSH
T1F2A002585499214E490A8A5C3AD0A4662454109321ADE356DD344602400671630B21C6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/456-320-0x00007FFC33C90000-0x00007FFC33D04000-memory.dmp

Download

memory/456-319-0x00007FFC32A00000-0x00007FFC32DA1000-memory.dmp

Download

memory/456-322-0x00007FFC318D0000-0x00007FFC31938000-memory.dmp

Download

memory/456-325-0x00007FFC31670000-0x00007FFC316B8000-memory.dmp

Download

memory/456-318-0x00007FFC330A0000-0x00007FFC33167000-memory.dmp

Download

memory/456-324-0x00007FFC2C990000-0x00007FFC2CAB6000-memory.dmp

Download

memory/456-323-0x00007FFC345B0000-0x00007FFC34CA6000-memory.dmp

Download

memory/456-321-0x00007FFC1F7F0000-0x00007FFC1FA73000-memory.dmp

Download

memory/572-375-0x00007FFC33C90000-0x00007FFC33D04000-memory.dmp

Download

memory/572-376-0x00007FFC1F7F0000-0x00007FFC1FA73000-memory.dmp

Download

memory/572-380-0x00007FFC31670000-0x00007FFC316B8000-memory.dmp

Download

memory/572-373-0x00007FFC330A0000-0x00007FFC33167000-memory.dmp

Download

memory/572-377-0x00007FFC318D0000-0x00007FFC31938000-memory.dmp

Download

memory/572-374-0x00007FFC32A00000-0x00007FFC32DA1000-memory.dmp

Download

memory/2592-282-0x00007FFC33C90000-0x00007FFC33D04000-memory.dmp

Download

memory/2592-284-0x00007FFC318D0000-0x00007FFC31938000-memory.dmp

Download

memory/2592-281-0x00007FFC303F0000-0x00007FFC30C1A000-memory.dmp

Download

memory/2592-286-0x00007FFC31670000-0x00007FFC316B8000-memory.dmp

Download

memory/2592-280-0x00007FFC32A00000-0x00007FFC32DA1000-memory.dmp

Download

memory/2592-283-0x00007FFC1F7F0000-0x00007FFC1FA73000-memory.dmp

Download

memory/2592-285-0x00007FFC2C990000-0x00007FFC2CAB6000-memory.dmp

Download

memory/2592-279-0x00007FFC330A0000-0x00007FFC33167000-memory.dmp

Download

memory/3184-291-0x00007FFC318D0000-0x00007FFC31938000-memory.dmp

Download

memory/3184-289-0x00007FFC33C90000-0x00007FFC33D04000-memory.dmp

Download

memory/3184-290-0x00007FFC1F7F0000-0x00007FFC1FA73000-memory.dmp

Download

memory/3184-292-0x00007FFC345B0000-0x00007FFC34CA6000-memory.dmp

Download

memory/3184-288-0x00007FFC32A00000-0x00007FFC32DA1000-memory.dmp

Download

memory/3184-293-0x00007FFC2C990000-0x00007FFC2CAB6000-memory.dmp

Download

memory/3184-294-0x00007FFC31670000-0x00007FFC316B8000-memory.dmp

Download

memory/3184-287-0x00007FFC330A0000-0x00007FFC33167000-memory.dmp

Download

memory/3916-130-0x00007FFC1F7F0000-0x00007FFC1FA73000-memory.dmp

Download

memory/3916-127-0x00007FFC32A00000-0x00007FFC32DA1000-memory.dmp

Download

memory/3916-131-0x00007FFC318D0000-0x00007FFC31938000-memory.dmp

Download

memory/3916-133-0x00007FFC31670000-0x00007FFC316B8000-memory.dmp

Download

memory/3916-134-0x00007FFC345B0000-0x00007FFC34CA6000-memory.dmp

Download

memory/3916-132-0x00007FFC2C990000-0x00007FFC2CAB6000-memory.dmp

Download

memory/3916-129-0x00007FFC33C90000-0x00007FFC33D04000-memory.dmp

Download

memory/3916-126-0x00007FFC330A0000-0x00007FFC33167000-memory.dmp

Download

memory/4240-258-0x00007FFC303F0000-0x00007FFC30C1A000-memory.dmp

Download

memory/4240-257-0x00007FFC32A00000-0x00007FFC32DA1000-memory.dmp

Download

memory/4240-262-0x00007FFC2C990000-0x00007FFC2CAB6000-memory.dmp

Download

memory/4240-259-0x00007FFC33C90000-0x00007FFC33D04000-memory.dmp

Download

memory/4240-261-0x00007FFC318D0000-0x00007FFC31938000-memory.dmp

Download

memory/4240-260-0x00007FFC1F7F0000-0x00007FFC1FA73000-memory.dmp

Download

memory/4240-263-0x00007FFC31670000-0x00007FFC316B8000-memory.dmp

Download

memory/4240-256-0x00007FFC330A0000-0x00007FFC33167000-memory.dmp

Download

memory/5108-248-0x00007FFC1F7F0000-0x00007FFC1FA73000-memory.dmp

Download

memory/5108-361-0x00007FFC303F0000-0x00007FFC30C1A000-memory.dmp

Download

memory/5108-299-0x00007FFC303F0000-0x00007FFC30C1A000-memory.dmp

Download

memory/5108-252-0x00007FFC2C990000-0x00007FFC2CAB6000-memory.dmp

Download

memory/5108-250-0x00007FFC303F0000-0x00007FFC30C1A000-memory.dmp

Download

memory/5108-253-0x00007FFC318D0000-0x00007FFC31938000-memory.dmp

Download

memory/5108-246-0x00007FFC330A0000-0x00007FFC33167000-memory.dmp

Download

memory/5108-249-0x00007FFC31670000-0x00007FFC316B8000-memory.dmp

Download

memory/5108-247-0x00007FFC32A00000-0x00007FFC32DA1000-memory.dmp

Download

memory/5108-251-0x00007FFC33C90000-0x00007FFC33D04000-memory.dmp

Download

memory/5356-273-0x00007FFC303F0000-0x00007FFC30C1A000-memory.dmp

Download

memory/5356-274-0x00007FFC33C90000-0x00007FFC33D04000-memory.dmp

Download

memory/5356-272-0x00007FFC32A00000-0x00007FFC32DA1000-memory.dmp

Download

memory/5356-275-0x00007FFC1F7F0000-0x00007FFC1FA73000-memory.dmp

Download

memory/5356-277-0x00007FFC2C990000-0x00007FFC2CAB6000-memory.dmp

Download

memory/5356-278-0x00007FFC31670000-0x00007FFC316B8000-memory.dmp

Download

memory/5356-276-0x00007FFC318D0000-0x00007FFC31938000-memory.dmp

Download

memory/5356-271-0x00007FFC330A0000-0x00007FFC33167000-memory.dmp

Download