39add9bfe01bfa97a090d75b6db0db39231c30677097a23b41c18d904682974d

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
precisionmedicPDF.msi
Size 27.7MB
Sample260916-w4e9aatfkf
SHA256 39add9bfe01bfa97a090d75b6db0db39231c30677097a23b41c18d904682974d
MD5 e2a7e84250bf95cddff219d6433db7dc
SHA1 a26286ee057b6f119433587dbe649fcc76344011
SHA512 106cdc9cbd828223452e3f5b2bc88f39635b2499f1f2d3aee508e20381eabbc5f16e21a672b13c43be15a657b2a02a94faf8a0d3c75cb83f2df4711d5d7e52c1
SSDEEP 393216:rQN68djKVYJ5oPX4n124EYGxn80Zhj6wvo9D:sQ8djKVYJMX4n16FpFt6
TLSH
T1B657AD472670A416FA34C0B88D52C8F35B36B99F461075B77ACC497527E2C632FBC9A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4076	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4496	OpsBridgeAgent.exe
4816	OpsBridgeAgent.exe

Loads dropped DLL 64 IoCs

pid	Process
2104	MsiExec.exe
5452	MsiExec.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe
2148	OpsBridgeAgent.exe
4932	OpsBridgeAgent.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4304	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5956	cmd.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File created	C:\Program Files\OpsBridge\_ssl.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\vcruntime140_1.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\win32ui.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_bz2.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\pywintypes313.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\win32api.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\win32event.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\psutil\python3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\_uuid.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\pyexpat.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\servicemanager.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\.write_probe	OpsBridgeAgent.exe
File created	C:\Program Files\OpsBridge\OpsBridgeAgent.exe	msiexec.exe
File created	C:\Program Files\OpsBridge\_ctypes.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_lzma.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_queue.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_socket.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_wmi.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\libcrypto-3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\python313.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\libssl-3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\perfmon.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\unicodedata.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\win32service.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\charset_normalizer\md.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\charset_normalizer\md__mypyc.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_decimal.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\libffi-8.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\_win32sysloader.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\pythoncom313.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\select.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\win32evtlog.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\certifi\cacert.pem	msiexec.exe
File created	C:\Program Files\OpsBridge\psutil\_psutil_windows.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\python3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\charset_normalizer\python3.dll	msiexec.exe
File created	C:\Program Files\OpsBridge\_elementtree.pyd	msiexec.exe
File created	C:\Program Files\OpsBridge\_hashlib.pyd	msiexec.exe

Drops file in Windows directory 49 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_nmwt1h1c.ybm.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vfyv5q1q.yx2.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_4cqvqqbk.s3y.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_thuv504p.awr.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_phtza4aj.fek.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_t2kh5333.lih.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_stbngba1.wgc.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI6FF2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_goutvuaw.h5k.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_b1f1iujm.xzk.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_201ovoe1.zjz.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_bdxjldhk.2ol.psm1	powershell.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79A8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_sr3ey52c.s5b.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_uq3svz3h.ply.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_smsa5m31.t4r.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hqxeq2zo.vov.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vfqxrfmm.wn2.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_brncurau.wdg.psm1	powershell.exe
File created	C:\Windows\Installer\{A7DCB3ED-CF03-4ED1-8D32-D7DBAB9E08E3}\OpsBridgeIcon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF337D29C8B0F249DB.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a63af.msi	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xlurbmko.v4d.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fk1q5u4b.o4p.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_y0m2k2gl.50v.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_zou5yoyd.h3c.ps1	powershell.exe
File opened for modification	C:\Windows\Installer\MSI6F65.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_p0dzaxf4.114.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ehvkfjnt.4ac.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_gsdiohqx.xa5.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_k3umuxnq.gui.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_kx1fxv5u.xge.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_sgx35zcz.uac.psm1	powershell.exe
File opened for modification	C:\Windows\Installer\e5a63ad.msi	msiexec.exe
File created	C:\Windows\Installer\wix{A7DCB3ED-CF03-4ED1-8D32-D7DBAB9E08E3}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{A7DCB3ED-CF03-4ED1-8D32-D7DBAB9E08E3}\OpsBridgeIcon.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF055F12B325FEC9AD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_bvkegit2.zpu.ps1	powershell.exe
File created	C:\Windows\Installer\e5a63ad.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF47B32DEF5C418321.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vyei10xe.qt2.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hyehfknj.2tv.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5421sbir.erw.psm1	powershell.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7DCB3ED-CF03-4ED1-8D32-D7DBAB9E08E3}	msiexec.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_kcj5gm3g.uxk.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DF9C84690109BC3898.TMP	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3552	powershell.exe
1928	powershell.exe
4324	powershell.exe
6120	powershell.exe
2668	powershell.exe
5084	powershell.exe
5380	powershell.exe
4556	powershell.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4304	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\ProductName = "OpsBridge Service"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\Version = "50331657"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DE3BCD7A30FC1DE4D8237DBDBAE9803E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DE3BCD7A30FC1DE4D8237DBDBAE9803E\Complete	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8\DE3BCD7A30FC1DE4D8237DBDBAE9803E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\PackageName = "precisionmedicPDF.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\PackageCode = "83D1EF9097D6FA542B0A1AA573D9D649"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\ProductIcon = "C:\\Windows\\Installer\\{A7DCB3ED-CF03-4ED1-8D32-D7DBAB9E08E3}\\OpsBridgeIcon.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DE3BCD7A30FC1DE4D8237DBDBAE9803E\DeploymentFlags = "3"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\C:\Windows\Temp\ob_sc_455c0e81.out\	cmd.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5508	msiexec.exe
5508	msiexec.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
3552	powershell.exe
3552	powershell.exe
3552	powershell.exe
1928	powershell.exe
1928	powershell.exe
1928	powershell.exe
4324	powershell.exe
4324	powershell.exe
4324	powershell.exe
6120	powershell.exe
6120	powershell.exe
6120	powershell.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
2668	powershell.exe
2668	powershell.exe
2668	powershell.exe
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe
5380	powershell.exe
5380	powershell.exe
4556	powershell.exe
4556	powershell.exe
4076	OpsBridgeAgent.exe
4076	OpsBridgeAgent.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4304	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4304	msiexec.exe
Token: SeSecurityPrivilege	5508	msiexec.exe
Token: SeCreateTokenPrivilege	4304	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4304	msiexec.exe
Token: SeLockMemoryPrivilege	4304	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4304	msiexec.exe
Token: SeMachineAccountPrivilege	4304	msiexec.exe
Token: SeTcbPrivilege	4304	msiexec.exe
Token: SeSecurityPrivilege	4304	msiexec.exe
Token: SeTakeOwnershipPrivilege	4304	msiexec.exe
Token: SeLoadDriverPrivilege	4304	msiexec.exe
Token: SeSystemProfilePrivilege	4304	msiexec.exe
Token: SeSystemtimePrivilege	4304	msiexec.exe
Token: SeProfSingleProcessPrivilege	4304	msiexec.exe
Token: SeIncBasePriorityPrivilege	4304	msiexec.exe
Token: SeCreatePagefilePrivilege	4304	msiexec.exe
Token: SeCreatePermanentPrivilege	4304	msiexec.exe
Token: SeBackupPrivilege	4304	msiexec.exe
Token: SeRestorePrivilege	4304	msiexec.exe
Token: SeShutdownPrivilege	4304	msiexec.exe
Token: SeDebugPrivilege	4304	msiexec.exe
Token: SeAuditPrivilege	4304	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4304	msiexec.exe
Token: SeChangeNotifyPrivilege	4304	msiexec.exe
Token: SeRemoteShutdownPrivilege	4304	msiexec.exe
Token: SeUndockPrivilege	4304	msiexec.exe
Token: SeSyncAgentPrivilege	4304	msiexec.exe
Token: SeEnableDelegationPrivilege	4304	msiexec.exe
Token: SeManageVolumePrivilege	4304	msiexec.exe
Token: SeImpersonatePrivilege	4304	msiexec.exe
Token: SeCreateGlobalPrivilege	4304	msiexec.exe
Token: SeBackupPrivilege	4352	vssvc.exe
Token: SeRestorePrivilege	4352	vssvc.exe
Token: SeAuditPrivilege	4352	vssvc.exe
Token: SeBackupPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeShutdownPrivilege	5452	MsiExec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe
Token: SeRestorePrivilege	5508	msiexec.exe
Token: SeTakeOwnershipPrivilege	5508	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4304	msiexec.exe
4304	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4304	msiexec.exe
5508	msiexec.exe
2104	MsiExec.exe
5452	MsiExec.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5508 wrote to memory of 4344	5508	msiexec.exe	93
PID 5508 wrote to memory of 2104	5508	msiexec.exe	96
PID 5508 wrote to memory of 5452	5508	msiexec.exe	97
PID 4076 wrote to memory of 3552	4076	OpsBridgeAgent.exe	100
PID 4076 wrote to memory of 1928	4076	OpsBridgeAgent.exe	102
PID 4076 wrote to memory of 5324	4076	OpsBridgeAgent.exe	105
PID 4076 wrote to memory of 4324	4076	OpsBridgeAgent.exe	107
PID 4076 wrote to memory of 6120	4076	OpsBridgeAgent.exe	109
PID 4076 wrote to memory of 4340	4076	OpsBridgeAgent.exe	111
PID 4076 wrote to memory of 5956	4076	OpsBridgeAgent.exe	113
PID 4076 wrote to memory of 4932	4076	OpsBridgeAgent.exe	115
PID 4076 wrote to memory of 2148	4076	OpsBridgeAgent.exe	116
PID 4076 wrote to memory of 4816	4076	OpsBridgeAgent.exe	117
PID 4076 wrote to memory of 4496	4076	OpsBridgeAgent.exe	118
PID 4076 wrote to memory of 2668	4076	OpsBridgeAgent.exe	119
PID 4076 wrote to memory of 5084	4076	OpsBridgeAgent.exe	121
PID 4076 wrote to memory of 6044	4076	OpsBridgeAgent.exe	123
PID 4076 wrote to memory of 5380	4076	OpsBridgeAgent.exe	125
PID 4076 wrote to memory of 4556	4076	OpsBridgeAgent.exe	127
PID 4076 wrote to memory of 2052	4076	OpsBridgeAgent.exe	129

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\precisionmedicPDF.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4304

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4344
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 661850C6FEC993A5A57879AB6AEA2B21
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2104
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1707220E0E8601772DB66F43A29268D7 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5452

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:996

C:\Program Files\OpsBridge\OpsBridgeAgent.exe
"C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:6120
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4340
- C:\Windows\system32\cmd.exe
  cmd.exe /c "powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\Windows\Temp\ob_sc_455c0e81.ps1\" > \"C:\Windows\Temp\ob_sc_455c0e81.out\" 2>&1"
  2⤵
  - Hide Artifacts: Hidden Window
  - NTFS ADS
  PID:5956
- C:\Program Files\OpsBridge\OpsBridgeAgent.exe
  "C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --worker C:\ProgramData\OpsBridge\task_fc637aa1633d46699fecc173da99e083.json
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4932
- C:\Program Files\OpsBridge\OpsBridgeAgent.exe
  "C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --worker C:\ProgramData\OpsBridge\task_16a39f3d15914f0d8d829076cd089811.json
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2148
- C:\Program Files\OpsBridge\OpsBridgeAgent.exe
  "C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --worker C:\ProgramData\OpsBridge\task_6b967870f9884a1b92ff5d01b2d26de4.json
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Program Files\OpsBridge\OpsBridgeAgent.exe
  "C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --worker C:\ProgramData\OpsBridge\task_12744487e1a0475cad11c76addcebf97.json
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1).NextHop"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses | Select-Object -Unique | ConvertTo-Json -Compress"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a63ae.rbs

Path C:\Config.Msi\e5a63ae.rbs
Size 427KB
SHA256 7fe5c4def7aab2a20efcea8fbd80e789a72aeded1f216005d44378830e6b3917
MD5 c79c288b28298e7ecafe7b5d4a31f363
SHA1 9cfe7f2a5e03cb792af02b889b081b5ad2db9b84
SHA512 f8b03283bbef8d10b89562488a0f7ab4e690bf740e947d6e23c624b52e356d72fbfb64de879942f12ee121e262be333e4b5af1f07229e80c28e361f8b8f5151e
SSDEEP 6144:H9n7J9PsUtPDEzbKBYq+dwzO6wgmpm9r6ck+XJzRbJ:dn7J+UdYzbVduYgWmtk+XR
TLSH
T1A9946B29B3E418EDE4B68276C5978034FF75740D332095AE8BA8952D2F3B7A470BB705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\PROGRA~1\OPSBRI~1\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\PROGRA~1\OPSBRI~1\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\PROGRA~1\OPSBRI~1\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\PROGRA~1\OPSBRI~1\_queue.pyd
Size 34KB
SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
TLSH
T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\PROGRA~1\OPSBRI~1\_ssl.pyd
Size 177KB
SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
MD5 689f1abac772c9e4c2d3bad3758cb398
SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
TLSH
T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.pyd

Path C:\PROGRA~1\OPSBRI~1\charset_normalizer\md.pyd
Size 20KB
SHA256 b04a2d1a0e945bc4ea3294f54caecbd244842a423a3910b2cbcffa1c64ecc9cb
MD5 3dd84b17f29c04409b96d4c559bf2aa2
SHA1 20ae2b9a54083cd7fbd7b191fa7d0cb279e44b57
SHA512 116b727afe8780c32f1d774075d0551b2f8f576003885348249a45e6d4c83cf9671b2159c6683ef233598d98fdf4b5fbb64d1137f13f5f78f33acf2272cb3a11
SSDEEP 384:7Px4m446oDZuI8AePLdwFsEYwVJClbNKmMwUaym/BW9G:7P6s6o1VJKWFdql4RwLyKR
TLSH
T1D6926D9AEE2954E2DD428A34C0E64D17B933BB810B0576DF5334C4156EC67F17A3E22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.pyd

Path C:\PROGRA~1\OPSBRI~1\charset_normalizer\md__mypyc.pyd
Size 133KB
SHA256 86cde3b9a2fa9d37f7cf90776e91f82fa0060613aeebc89cc3b941589527b914
MD5 de1e58e5c307bcbb6beeb3b7d409ac2d
SHA1 26b1e3d1c251ec1a92590cd284d360f25044e3c4
SHA512 a0ce06c92d3079ada57f2d43169c62f5f08dd67051efad62e7926b3ecf40bdd52406cb3ebb90f8d611ac896942c57becc911aa7affd1e05d298b1fb7f57fb2c0
SSDEEP 3072:edOHcsVOUm2jVPoV9wsBOYtvsHgFXYwbOUwNdqcv:j8frBntIwbOjxv
TLSH
T1A6D32967529500B7CA634179CCB7A513DBF2B5510B3263CF04A4C6966F03BE6AEBEB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\PROGRA~1\OPSBRI~1\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\PROGRA~1\OPSBRI~1\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\PROGRA~1\OPSBRI~1\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\PROGRA~1\OPSBRI~1\psutil\_psutil_windows.pyd
Size 78KB
SHA256 3b8a55774805cbddb51f78f1f31a782b4fd62c307287ce097afa65c362e6a6ce
MD5 7d8f83ccefb1751b9ceb7e7f0f266724
SHA1 00234f4e31cc01bb1bf9af6a5aa0e40ce535bbf6
SHA512 2b701e378baf19ea0ad49322aa2e1e7c732060959b5d3155534bd1d7eccf54f2058f6436730179a5a08ea41feb173b25498c417b8b3c0645ebb1e28ff9ebcc4e
SSDEEP 1536:IZzwq2+SBRJdpZnJbPoPVM04YnUjHmCZWFdqWRRK:IZzkBhpZn4M04qMmrdqW
TLSH
T110734A96B75800F8D95B913C9AF26A37EBB2B091132557DF0160C64A0FA3BD36E7DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\PROGRA~1\OPSBRI~1\psutil\python3.dll
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\PROGRA~1\OPSBRI~1\pywintypes313.dll
Size 142KB
SHA256 a9a4c2ae2104d132ba53c85b516cb3b678d51ba54d2e33f0a7687d42f3ccca5a
MD5 2f34d7f5e14591ec64b9360b16b976d2
SHA1 554dc60f5bfd5eb4915c83af681b16255a7f93e3
SHA512 b9f1b1a7cc055187e6cdf0595f6bc74f48ca7bc7a51a7d0487d9190b54b127867ca6371a006f3685ce9471bdd76b8d9c4e536218bcb7fb947c3330bbf6a2b73a
SSDEEP 3072:cdyqdYmyWa5br4d1qfGHrY/rZ6Yr2laFU4LGUgl4jptIaiTamdqYh:c4aYlWa9r61LrY/rPbFU4NgOjptIzhh
TLSH
T12DE33A47374684DAE9669379CDB71A03D7A2B0000711E3CF46A1C28B6F637E6AD3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\PROGRA~1\OPSBRI~1\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\PROGRA~1\OPSBRI~1\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\PROGRA~1\OPSBRI~1\win32api.pyd
Size 145KB
SHA256 6b239e17ae134242c843097366bce8cc3d3ddebe823aed629e12cc77ff0f70ac
MD5 e014f3ac45a3f46887d70e3dfc4251ef
SHA1 e028db1f9caf331577603430b2f8d72d1af6983f
SHA512 3faa722ac326c0a65ffe33f4708f52d162d40950eb2dbcc1492a41128b3b72696edba3bbc236410a6e02006af80fa0cc7f23fc35e0c3895fd33e800c7e1f4150
SSDEEP 3072:E7AK00RjZk+uEIvPlRVlhLaN/PSexhlT9qTmP9bDm/GgUXJkerdq7t:AAF0fu73lRVsPSexhbqyvcGg0NWt
TLSH
T1FAE31783B35410D6D86AA37CC1671E23DB72B8240725A7CF06A0C68A1F63BE97D3D795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32service.pyd

Path C:\PROGRA~1\OPSBRI~1\win32service.pyd
Size 68KB
SHA256 141ba285e6129e108f3e248ca61d862c9415634679754897172efaeb92f80693
MD5 499828447d8f4afaadf090d42457c394
SHA1 18bfbb88f77f1c50cc7665189a554c6b6da2f34b
SHA512 60e9b6ba2510a8077ebc096b5dc4f513ad2e9cd04e8d55f525996c9600ed8f6572028379fdd70d3acb708ea36df8cb692954e1a7a5b82b2ac8437fc64dea5898
SSDEEP 1536:fe7pZxWJERz66jkltv/vN66NuSs7jNKWFdqFRRK:qbnW3166oSsvNjdqF
TLSH
T1B6633A4BA35611E5E826C2FCD5A31F53EA72B804139076CF03D1C6491FA7BC47E3AA96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpsBridgeAgent.exe

Path C:\Program Files\OpsBridge\OpsBridgeAgent.exe
Size 17.6MB
SHA256 d53fa7a44c109988c7dcedd909b114acd122e0efb5487db0cf8f06421a183d10
MD5 0ea0b4a66c7c71b971f35eb21b950952
SHA1 baf89533ba4910e3d903a05b4962b6a518e09548
SHA512 f13c27f3fb075ee3b8d02eb5dc991046b02428a81416c4a08e8016c9f6aa82be70fd0096de2f5a3ff7fd70b7193b68a8da0bb6a6b3f5c2716b4c5a12a4bbdd9c
SSDEEP 98304:qdxH8DpkSLlpy2iSu6Z9+5SUDmf57mJq5JY3TxsUmNmQTzoYOSQY7XtVNN8vKd7R:D5GcUSNZgXcYtMdjKLeVNiYfT
TLSH
T1C90759472A70A416FA34C0B88D56C8F35B36B99F461075B37ADC497527D2C632FBC8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Program Files\OpsBridge\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Program Files\OpsBridge\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_win32sysloader.pyd

Path C:\Program Files\OpsBridge\_win32sysloader.pyd
Size 25KB
SHA256 5731054623ade7b387270009073bbaf3b7a13074fdbf05ab10e2b3269c83ebb3
MD5 4603d4199933b643cf6e21a401797f85
SHA1 a738adb31cf680b3dc4deae97b03c0d09b7f44ea
SHA512 ae50d93c237e47d8a8f312d48439107d87f0592ec4ac49c42a91c788e90bbe58ddfc58842717b289b42a67b54be65b38c35551b640649fbdc9679ed279158a44
SSDEEP 384:7qm8dKXx8Hkwly4Y3s/0uvVL7/kLdwFsEYwVJCmKmMwUaym/Ns9:7+d28Hkwlyx3s/Dv97/kWFdqDRwLyK
TLSH
T108B25AC2BF5940D2E8A3C638C0F31F57AA37B9A51731129F02B681151D9A7D07F2EA6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Program Files\OpsBridge\_wmi.pyd
Size 38KB
SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
MD5 47e6fd132f44a4feb595bd0fda3c4e1c
SHA1 37c6c2c1ff309db7273afc9324a37b716c5cbfdb
SHA512 69c031d4ff2dac70739f9c188fca3c6969304f22782adf5a9c0ca303a3a712630541bda888ef25d3252b46d43df56f6e7e03c83d331840088c4224d1a1a512c4
SSDEEP 768:nEkKVVUWO0X1ctqDFIgLi6OytxJEKrLy2Ip4RsCxf1mljr8VMOj:nE9v3JctqDFIgLi1ytH/9R1fI38VMi
TLSH
T1AC037D8AE2640046E663DAB5C9A6CE53F571B7C36B11D38F365582990F233C0E73A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Program Files\OpsBridge\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servicemanager.pyd

Path C:\Program Files\OpsBridge\servicemanager.pyd
Size 51KB
SHA256 9b63642f49f68ae743360e8e0501ff50d94e1bc1c7e96daa71c5c858f5b1b889
MD5 e5a00a9dcefa4cd4e081eada0177977d
SHA1 2ae3334682b2faecedbc86020119970d5509cd95
SHA512 faa2340734fbdc3c5de71565e6c65ff644a429fc9c5e4451bf6373d28203e49e350c928386fb0bb750c999793cc3f3177f741a415f9e8d8c9bfdb62d2b189747
SSDEEP 1536:t8ldu4SMi6x1DDDRuuLCwhaXoCCPtWFdqQRRKd:tug4SMVx1DDDEICwhaXoXP8dqQa
TLSH
T1AD333B4767A64059F573A638D4F306739A3278811B75A2CF0260C50E3EB2BD4BD35BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\OpsBridge\vcruntime140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\OpsBridge\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32event.pyd

Path C:\Program Files\OpsBridge\win32event.pyd
Size 39KB
SHA256 333c8b60ba7b8dcebfe7321b75f45cdd5e8ccb1fb6369dcf7efd0eea5c52bc9e
MD5 a06383038d18a83cf15a94ee9f36f62d
SHA1 cedcfc6239be407da031b29aae76ffdb6100943d
SHA512 3eac3856e5518055140a9662556fa3a8b6bc665e6ebc4a9bdb61a686c6f2e73041f3180cec1168ab61d81f9ce42bd04a4a9d2e67833898bfab8c474e47acfe81
SSDEEP 768:oaWut7Goxs5Llg+Ebc/jhfWddbcrb8l/99mku36U4a4+WFdq+RwLyK:o8Rc/jhfWddbcH8l/99mku36U4a4+WFK
TLSH
T11B0328C727686096E967C53CD4961E07EA73B96003A0B3EF0222D55A1F623E17A3DB4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.write_test

Path C:\ProgramData\OpsBridge\.write_test
Size 2B
SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
MD5 444bcb3a3fcf8389296c49467f27e1d6
SHA1 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
SHA512 9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570
MD5 SHA1 SHA512

Submit Download

install.log

Path C:\ProgramData\OpsBridge\install.log
Size 779B
SHA256 c52151473e6c7a11241d02ff55142a99e56892c7e27fb48050d074f0064cb43e
MD5 b4d588c52e57f6e99b8001f8a0d79644
SHA1 37a4ece067d20998927d582fc3accd2371a0ddf7
SHA512 4e0ef766845f4dca924b146f16b7ed8c72e37a9ee01f6de6daeed4322520c84e07e53ffaf7648a6c25e1863b4460dacce7967f7fb33e6cec6a60af21adb8edaa
TLSH
T1660161C85FBC8876BAC2F11442536F8757B2B71AD98577D07BD738196942C0C062E86E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6FF2.tmp

Path C:\Windows\Installer\MSI6FF2.tmp
Size 412KB
SHA256 ddfcd04f2ef5a87b8732f552460f7491576607d7c674e1783021c09c42279371
MD5 168c58eda31144be9a857905be57cfb7
SHA1 31c6e24890d4758e3719b0044e38d0fcd3350c24
SHA512 fd7c68901ba3c17e8d4ee29b77fec7c5f5acff21d4d0ad8466f83bf3060dea2e594e6e7e0cf3c645c7ecead813a4f6125157f1e8413d811c1174a867c804f974
SSDEEP 6144:P9n7J9PsUtPDEzbKBYq+dwzO6wgmpm9r6ck+XJzRbc:Fn7J+UdYzbVduYgWmtk+X0
TLSH
T1D6946A29B3E418EDE4B68276C5A78034FF75744D3320D5AE87A8952D2F3B6A070BB705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a63ad.msi

Path C:\Windows\Installer\e5a63ad.msi
Size 27.7MB
SHA256 39add9bfe01bfa97a090d75b6db0db39231c30677097a23b41c18d904682974d
MD5 e2a7e84250bf95cddff219d6433db7dc
SHA1 a26286ee057b6f119433587dbe649fcc76344011
SHA512 106cdc9cbd828223452e3f5b2bc88f39635b2499f1f2d3aee508e20381eabbc5f16e21a672b13c43be15a657b2a02a94faf8a0d3c75cb83f2df4711d5d7e52c1
SSDEEP 393216:rQN68djKVYJ5oPX4n124EYGxn80Zhj6wvo9D:sQ8djKVYJMX4n16FpFt6
TLSH
T1B657AD472670A416FA34C0B88D52C8F35B36B99F461075B77ACC497527E2C632FBC9A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_nmwt1h1c.ybm.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_nmwt1h1c.ybm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

{bb50cc14-600e-4a65-82df-a735065f6a1e}_OnDiskSnapshotProp

Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{bb50cc14-600e-4a65-82df-a735065f6a1e}_OnDiskSnapshotProp
Size 6KB
SHA256 ac4ee2e12bfcdaa6ab0d821d7eb4be6bf07046e191cdbdad192057b87dd859a5
MD5 00ac78b121fa6e060e03a491d996e741
SHA1 083b47681839dc472cff9bb42d15344affb1ab16
SHA512 8f3f7b64b26d816324a90b598bbf09a32e1da657b5dfa3037116ee4db059fb2b311e8396f21f4930367c8795595ef77738721a2b5f28db7467c2b8255a92c759
SSDEEP 96:FHxTjLCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Hqb++uVmN
TLSH
T143D189085AF54711E2F3AB3129F18557A477B812EF33CB8E0194238E6670910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1928-155-0x00000233E8560000-0x00000233E8570000-memory.dmp

Download

memory/1928-156-0x00000233E8590000-0x00000233E85AA000-memory.dmp

Download

memory/1928-157-0x00000233E8780000-0x00000233E8942000-memory.dmp

Download

memory/1928-158-0x00000233E8E80000-0x00000233E93A8000-memory.dmp

Download

memory/2668-206-0x000002C7A01F0000-0x000002C7A02A2000-memory.dmp

Download

memory/3552-146-0x000001B5C9960000-0x000001B5C9A12000-memory.dmp

Download

memory/3552-147-0x000001B5C9A20000-0x000001B5C9A2A000-memory.dmp

Download

memory/3552-149-0x000001B5C9BA0000-0x000001B5C9BBE000-memory.dmp

Download

memory/3552-145-0x000001B5C9940000-0x000001B5C995E000-memory.dmp

Download

memory/3552-141-0x000001B5C9640000-0x000001B5C9662000-memory.dmp

Download

memory/4324-170-0x00000278423F0000-0x00000278424A2000-memory.dmp

Download

memory/5508-12-0x0000026541FA0000-0x0000026542944000-memory.dmp

Download