Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
Fileshared.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fileshared.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target Fileshared.msi
- Size 9.4MB
- Sample261002-wwxtcsvbmb
- SHA256 e2a34605b9b59bac25a77ee77d0ae62dea9b441a0b2018af8dea570bc40af23f
- MD5 b90046c6b9c86ce594cdd5fbda85fb1b
- SHA1 362014fc69dd463f925ca5f3036a4d24867d10f8
- SHA512 935a575a354f3398c9f4ba20e9e7f5f1586ec8c7fe60a460cfa3ea5817de5dfd0f26839a653bb81a5ec457abe2db39ae4daa141eaf1f5cabd0fdac3bef7deb6b
- SSDEEP 196608:Gp4jpwZRWG9Ob2TsjYzpa/ZUHm3jdgt/vCL9w5cJh83/6:GupwbWhSlSv3xAvo9TJC
- TLSH T1BAA63365B7A515AAE1B282B1C2A78234FF397C4D3720C19F4B65B1580F7A7B030BB716
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4348 OpsBridgeAgent.exe - Loads dropped DLL 32 IoCs
pid Process 2416 MsiExec.exe 2812 MsiExec.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 4964 msiexec.exe 6 4964 msiexec.exe - Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe - Drops file in Program Files directory 36 IoCs
description ioc Process File created C:\Program Files\OpsBridge\_ctypes.pyd msiexec.exe File created C:\Program Files\OpsBridge\_queue.pyd msiexec.exe File created C:\Program Files\OpsBridge\select.pyd msiexec.exe File created C:\Program Files\OpsBridge\win32event.pyd msiexec.exe File created C:\Program Files\OpsBridge\pythoncom313.dll msiexec.exe File created C:\Program Files\OpsBridge\vcruntime140_1.dll msiexec.exe File created C:\Program Files\OpsBridge\win32api.pyd msiexec.exe File created C:\Program Files\OpsBridge\win32service.pyd msiexec.exe File created C:\Program Files\OpsBridge\_elementtree.pyd msiexec.exe File created C:\Program Files\OpsBridge\_win32sysloader.pyd msiexec.exe File created C:\Program Files\OpsBridge\libffi-8.dll msiexec.exe File created C:\Program Files\OpsBridge\pyexpat.pyd msiexec.exe File created C:\Program Files\OpsBridge\python3.dll msiexec.exe File created C:\Program Files\OpsBridge\pywintypes313.dll msiexec.exe File created C:\Program Files\OpsBridge\servicemanager.pyd msiexec.exe File created C:\Program Files\OpsBridge\vcruntime140.dll msiexec.exe File created C:\Program Files\OpsBridge\_hashlib.pyd msiexec.exe File created C:\Program Files\OpsBridge\certifi\cacert.pem msiexec.exe File created C:\Program Files\OpsBridge\charset_normalizer\md__mypyc.pyd msiexec.exe File created C:\Program Files\OpsBridge\psutil\_psutil_windows.pyd msiexec.exe File created C:\Program Files\OpsBridge\_ssl.pyd msiexec.exe File created C:\Program Files\OpsBridge\charset_normalizer\python3.dll msiexec.exe File created C:\Program Files\OpsBridge\_bz2.pyd msiexec.exe File created C:\Program Files\OpsBridge\python313.dll msiexec.exe File created C:\Program Files\OpsBridge\win32evtlog.pyd msiexec.exe File created C:\Program Files\OpsBridge\OpsBridgeAgent.exe msiexec.exe File created C:\Program Files\OpsBridge\_decimal.pyd msiexec.exe File created C:\Program Files\OpsBridge\_socket.pyd msiexec.exe File created C:\Program Files\OpsBridge\_wmi.pyd msiexec.exe File created C:\Program Files\OpsBridge\libssl-3.dll msiexec.exe File created C:\Program Files\OpsBridge\charset_normalizer\md.pyd msiexec.exe File created C:\Program Files\OpsBridge\_lzma.pyd msiexec.exe File created C:\Program Files\OpsBridge\libcrypto-3.dll msiexec.exe File created C:\Program Files\OpsBridge\perfmon.pyd msiexec.exe File created C:\Program Files\OpsBridge\unicodedata.pyd msiexec.exe File created C:\Program Files\OpsBridge\psutil\python3.dll msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\e58e8f4.msi msiexec.exe File opened for modification C:\Windows\Installer\e58e8f4.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIEB46.tmp msiexec.exe File created C:\Windows\Installer\wix{1E35E1FA-B57D-446F-9722-D1555C49F8B1}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\{1E35E1FA-B57D-446F-9722-D1555C49F8B1}\OpsBridgeIcon.ico msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{1E35E1FA-B57D-446F-9722-D1555C49F8B1} msiexec.exe File opened for modification C:\Windows\Installer\MSIEAA9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF2F8.tmp msiexec.exe File created C:\Windows\Installer\e58e8f6.msi msiexec.exe File created C:\Windows\Installer\{1E35E1FA-B57D-446F-9722-D1555C49F8B1}\OpsBridgeIcon.ico msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4964 msiexec.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname OpsBridgeAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain OpsBridgeAgent.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000298171ba54d972bf0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000298171ba0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900298171ba000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a298171ba000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d298171ba000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 12 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" OpsBridgeAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" OpsBridgeAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\ProductIcon = "C:\\Windows\\Installer\\{1E35E1FA-B57D-446F-9722-D1555C49F8B1}\\OpsBridgeIcon.ico" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AF1E53E1D75BF64479221D55C5948F1B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\ProductName = "OpsBridge Service" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\PackageName = "Fileshared.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\Version = "50397185" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8\AF1E53E1D75BF64479221D55C5948F1B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AF1E53E1D75BF64479221D55C5948F1B\Complete msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\PackageCode = "22F3D7FD9424F5E4CA19E59492E896C0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\Language = "1033" msiexec.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4456 msiexec.exe 4456 msiexec.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe 4348 OpsBridgeAgent.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4964 msiexec.exe Token: SeIncreaseQuotaPrivilege 4964 msiexec.exe Token: SeSecurityPrivilege 4456 msiexec.exe Token: SeCreateTokenPrivilege 4964 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4964 msiexec.exe Token: SeLockMemoryPrivilege 4964 msiexec.exe Token: SeIncreaseQuotaPrivilege 4964 msiexec.exe Token: SeMachineAccountPrivilege 4964 msiexec.exe Token: SeTcbPrivilege 4964 msiexec.exe Token: SeSecurityPrivilege 4964 msiexec.exe Token: SeTakeOwnershipPrivilege 4964 msiexec.exe Token: SeLoadDriverPrivilege 4964 msiexec.exe Token: SeSystemProfilePrivilege 4964 msiexec.exe Token: SeSystemtimePrivilege 4964 msiexec.exe Token: SeProfSingleProcessPrivilege 4964 msiexec.exe Token: SeIncBasePriorityPrivilege 4964 msiexec.exe Token: SeCreatePagefilePrivilege 4964 msiexec.exe Token: SeCreatePermanentPrivilege 4964 msiexec.exe Token: SeBackupPrivilege 4964 msiexec.exe Token: SeRestorePrivilege 4964 msiexec.exe Token: SeShutdownPrivilege 4964 msiexec.exe Token: SeDebugPrivilege 4964 msiexec.exe Token: SeAuditPrivilege 4964 msiexec.exe Token: SeSystemEnvironmentPrivilege 4964 msiexec.exe Token: SeChangeNotifyPrivilege 4964 msiexec.exe Token: SeRemoteShutdownPrivilege 4964 msiexec.exe Token: SeUndockPrivilege 4964 msiexec.exe Token: SeSyncAgentPrivilege 4964 msiexec.exe Token: SeEnableDelegationPrivilege 4964 msiexec.exe Token: SeManageVolumePrivilege 4964 msiexec.exe Token: SeImpersonatePrivilege 4964 msiexec.exe Token: SeCreateGlobalPrivilege 4964 msiexec.exe Token: SeBackupPrivilege 3300 vssvc.exe Token: SeRestorePrivilege 3300 vssvc.exe Token: SeAuditPrivilege 3300 vssvc.exe Token: SeBackupPrivilege 4456 msiexec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe Token: SeBackupPrivilege 4464 srtasks.exe Token: SeRestorePrivilege 4464 srtasks.exe Token: SeSecurityPrivilege 4464 srtasks.exe Token: SeTakeOwnershipPrivilege 4464 srtasks.exe Token: SeBackupPrivilege 4464 srtasks.exe Token: SeRestorePrivilege 4464 srtasks.exe Token: SeSecurityPrivilege 4464 srtasks.exe Token: SeTakeOwnershipPrivilege 4464 srtasks.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe Token: SeShutdownPrivilege 2812 MsiExec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe Token: SeRestorePrivilege 4456 msiexec.exe Token: SeTakeOwnershipPrivilege 4456 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4964 msiexec.exe 4964 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4456 wrote to memory of 4464 4456 msiexec.exe 101 PID 4456 wrote to memory of 2416 4456 msiexec.exe 105 PID 4456 wrote to memory of 2812 4456 msiexec.exe 107 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Fileshared.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4964
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8391516F02D05697DB58A741EFDB3ABB2⤵
- Loads dropped DLL
PID:2416
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 0CA57CA74A4A410421AF1C5AAC99D37B E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
C:\Program Files\OpsBridge\OpsBridgeAgent.exe"C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58e8f5.rbs
- Size 426KB
- SHA256 9d2415a036ac2387617bf0bcc228b4b49e42a589ded47c2ebc161cf2c3283899
- MD5 56626eb31ef33fd7a07a7a6d11598f2e
- SHA1 8d141f61f21dc79130b56d3f7d096d274cb23deb
- SHA512 9fa857f9137519708e7241ea5a4d37ab285e03467c75cf8671f95415e913b106679557dd9573bbe3d9ee0ff6feebe155ce24076060395b34e3ac71cbbf9393d3
- SSDEEP 6144:e9n7J9PsUtPDEzbKBYq+dwzO6wgmpm9r6ck+XJzRbO:Yn7J+UdYzbVduYgWmtk+X2
- TLSH T1D5946B29B3E418EDE4B78272C5978134FF75744D332096AE47A8942D2F3B6A470BB706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\_socket.pyd
- Size 83KB
- SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
- MD5 566cb4d39b700c19dbd7175bd4f2b649
- SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
- SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
- SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
- TLSH T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\charset_normalizer\md__mypyc.pyd
- Size 133KB
- SHA256 9766b5875c44e9cf8c2b60ff86445d27625396a8f6a940ebed99f6ed83a4d327
- MD5 9b6a61b0cac43b16b87d75ccd50b2bbc
- SHA1 99247d72c5f878df693e1c3f1e84bb88b0b14720
- SHA512 22e135b39be9dae3d5903f54d1695c64299d44132eead4536bf8493b10db74c71a833f527491e1f24d9b7526a9760eba14ec67b74cbb7daf07c97b238f9bf9b7
- SSDEEP 3072:8dOHcsVOUm2jVPoV9wsBOYtvsHgFXYwbOUwktq5g:Z8frBntIwbOmAg
- TLSH T1C1D31967529500B7CA634179CCB7A513DBE1B5510B3263CF04A4C69A6F037E6AEBEB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\OpsBridgeAgent.exe
- Size 15.4MB
- SHA256 fb41c882a4eb7b430712f76d68c24705a3b717f8e2bbeeadb396c4c9e9e6de65
- MD5 d23c9f5c7da3188c644f86695cbfebda
- SHA1 cec88228edab950464b976398e5fc2b60f44ffcc
- SHA512 8ac3072526a855ca0a938f3edb3bc1b48b553e91dcb71ccd504735dce4483580a3ba82aa12d2b64a25052d2ac20bab60f5f1668f0e82c5e64913d862585dfb55
- SSDEEP 98304:mhLDpisuDD6kyQQN6+T+FJOoft0kC52KzUE8mcwkAYhMZ6IW9+GQ9XkK0dLqDLQF:k56P8WgXcYtMojKLdVmiYq
- TLSH T14EF66B072670A416FE38D0B88D56C8F2573AB99F8610B5B3369D45752BD2C632FBC89C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_bz2.pyd
- Size 83KB
- SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
- MD5 684d656aada9f7d74f5a5bdcf16d0edb
- SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
- SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
- SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
- TLSH T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_ctypes.pyd
- Size 130KB
- SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
- MD5 29873384e13b0a78ee9857604161514b
- SHA1 110f60f74b06b3972acd5908937a40e078636479
- SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
- SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
- TLSH T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_hashlib.pyd
- Size 63KB
- SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
- MD5 3e540ef568215561590df215801b0f59
- SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
- SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
- SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
- TLSH T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_lzma.pyd
- Size 155KB
- SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
- MD5 d63e2e743ea103626d33b3c1d882f419
- SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
- SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
- SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
- TLSH T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_queue.pyd
- Size 34KB
- SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
- MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
- SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
- SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
- SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
- TLSH T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_ssl.pyd
- Size 177KB
- SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
- MD5 689f1abac772c9e4c2d3bad3758cb398
- SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
- SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
- SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
- TLSH T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_win32sysloader.pyd
- Size 25KB
- SHA256 d85da81d8620334656d9dbb7638f35ab0b93f2a2d21a2a4830a7d947ddb32fef
- MD5 ad148c5dbeb5ae9b8bc5bf24380dbdb7
- SHA1 6ca22a04c0715c4ced717a1405e6a242787200af
- SHA512 d09384499c13b7989fddaa020e3c9c1b1f030fce1df544ce2ecbe7a08bf6558fdcfdb56258f3fd870493710267da5d1a7459e1c76aff57cb19c7ab8a67331a64
- SSDEEP 768:k+d28Hkwlyx3s/Dv97/vWFtq0T0RwLyKv:74Gkd3sLv9/vWFtq0T0RRKv
- TLSH T1B7B26B83BB5980E6E4B3C63CC4F31B57AD37B9A42721539F02A291151D963D07F2E6AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_wmi.pyd
- Size 38KB
- SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
- MD5 47e6fd132f44a4feb595bd0fda3c4e1c
- SHA1 37c6c2c1ff309db7273afc9324a37b716c5cbfdb
- SHA512 69c031d4ff2dac70739f9c188fca3c6969304f22782adf5a9c0ca303a3a712630541bda888ef25d3252b46d43df56f6e7e03c83d331840088c4224d1a1a512c4
- SSDEEP 768:nEkKVVUWO0X1ctqDFIgLi6OytxJEKrLy2Ip4RsCxf1mljr8VMOj:nE9v3JctqDFIgLi1ytH/9R1fI38VMi
- TLSH T1AC037D8AE2640046E663DAB5C9A6CE53F571B7C36B11D38F365582990F233C0E73A336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\charset_normalizer\md.pyd
- Size 20KB
- SHA256 b3be8a8abd07fd1d0b1ba27ee42d2c705851cc2f4ab31512541a50b5a9a9ecd1
- MD5 f3d0e88c6cace726bff103e64208c747
- SHA1 86771b0a7f80085bbeb1dee9f239a2d40cf0f511
- SHA512 1f3dc0bcdad4ec556b2fc54eea81e560d4c302f944085f0bcd0864446d42a79f0810ee900922aae9f62598dac950c9ec137af2cc97a89f02522ed521a13f8e85
- SSDEEP 384:7Vx4m446oDZuI8AeYLdwFlswVJC0c8KmMwUaym/N39:7V6s6o1VJJWFtq0MRwLyK
- TLSH T1BD927D9AEE2C44E2EE428A34C5D20D47FD33BA91170576DF5334D0256EC67E26A3E22D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\libcrypto-3.dll
- Size 5.0MB
- SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
- MD5 ae5b2e9a3410839b31938f24b6fc5cd8
- SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
- SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
- SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
- TLSH T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\libssl-3.dll
- Size 776KB
- SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
- MD5 8d4805f0651186046c48d3e2356623db
- SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
- SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
- SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
- TLSH T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\psutil\_psutil_windows.pyd
- Size 78KB
- SHA256 2203f592a85b78d4645f49851682f75572b6180e80b898dbc578c49f6f87601e
- MD5 af163176be88c8370d7f710a26c0a746
- SHA1 701866b34397e0463ae0ce0b74c7086894de5aa5
- SHA512 735c5488b8ab3c3e70ccc51ae32636492ab231820b69216bb0d64c7a1ccd976eec78c98453d5db920889683a144ed23969db873f4169469aee73aa787309d56b
- SSDEEP 1536:3CZzwq2+SBRJdpZnJbPoPVM04YnUjHmCHWFtq0CURRKd:yZzkBhpZn4M04qMmNtqnUi
- TLSH T1BA734996B75800F8D917913C9AF25A37EBB2B091132657DF0160D64A0FA3BE36E7DB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\psutil\python3.dll
- Size 69KB
- SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
- MD5 d6dfb6a9518a57e180980f7a07098d7d
- SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
- SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
- SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
- TLSH T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\python313.dll
- Size 5.8MB
- SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
- MD5 7387fe038ea75eb9a57b054fccfe37bf
- SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
- SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
- SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
- TLSH T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\pywintypes313.dll
- Size 142KB
- SHA256 aef8ffb1cd0e922fa1cb67575a05003e21a72ac1b731f192ac5dcef104ab5926
- MD5 6860149eee580cfc51b6726701d752c9
- SHA1 7be2bfba88a7948e3830acec1f2066e5cd1ff03c
- SHA512 20bc6a46ff3962149c59ccd7d20591371ba047d33da77bed826f534613ca4dd44b21796b68b7756b22b3cdd39c911c2b1dceb395cf9e8fb98d6f8de864521ce7
- SSDEEP 3072:rdyqdYmyWa5br4d1qfGHrY/rZ6Yr2laFU4LGUgl4jptIaiTantq6r:r4aYlWa9r61LrY/rPbFU4NgOjptIiTr
- TLSH T1DDE33947374684DAE9669379CDB71A03D7A2B0000711E3CF06A1C28B6FA37E66D3B746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\select.pyd
- Size 31KB
- SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
- MD5 715a098175d3ca1c1da2dc5756b31860
- SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
- SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
- SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
- TLSH T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\servicemanager.pyd
- Size 51KB
- SHA256 8751317c52c107afc51ff697799fd9e059c407fe09b0964f7f4f2360346a2fd2
- MD5 0ac7fb272962aaecd7fd06e7f8743fce
- SHA1 3f153716d43f0deaf748f687bf973e9e365529fb
- SHA512 268aa5bd570d2338b06dadf7918736666a797c9ce08425e0e8d1a23d0cbcce94f78874b26bb76585cea519f2b552f84bc7a964f34b83e38051633e5393805b36
- SSDEEP 1536:tYldu4SMi6x1DDDRuuLCwhaXoCCPsWFtq0xRRK7:tCg4SMVx1DDDEICwhaXoXPBtqAM
- TLSH T18E333A4763A64059F573A638D5F306739A3278811B75A2CF0260C41E3EB2BD47D35BAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\unicodedata.pyd
- Size 695KB
- SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
- MD5 503b3ffa6a5bf45ab34d6d74352f206b
- SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
- SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
- SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
- TLSH T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\vcruntime140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\win32event.pyd
- Size 39KB
- SHA256 f7676632259833374739dfbea0a96f85d3ddc94f44e52a94a2bc3339d2626ab0
- MD5 db700261fcf8e10607bd8be009e58881
- SHA1 d7d6392d20ee748c3621a1ff186ca77513df133f
- SHA512 5d16a486477dde4202cd75461bd6e0297e9351ec05aa0a4499fe632aa3a5a9799642388d357c7366e785f5de8d401cf5e52f6a196c6c2b3d649a8a6c4bd43d4f
- SSDEEP 768:YaWut7Goxs5Llg+Ebc/jhfWddbcrb8l/99mku36U4a4sWFtq03RwLyK8V:Y8Rc/jhfWddbcH8l/99mku36U4a4sWFv
- TLSH T1830328C727685095E967C53CC4961E07EA73B96007A0B3EF0222D51A1FA23E17B3DB8D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\win32service.pyd
- Size 68KB
- SHA256 2444a2a5a1807d971f5a55394f5a21ac3aeb200c07744b67d1a5f0e70b67eff2
- MD5 989b2e59802f94a10691ec348e4072e7
- SHA1 fd8533990541da16e26dcf7c4c1c66008d537a0a
- SHA512 f0f04229b269a05d4b974a7d580c01662b3e8a3bd40fc20c1bc03bf1083319cf511a160ced12c4a911b803a57e42842650a3d1ec1c4bb499174923767a8f9a64
- SSDEEP 1536:Oe7pZxWJERz66jkltv/vN66NuSs7jNKWFtq0NGRRK:HbnW3166oSsvNjtqB
- TLSH T158633A4BA35611E5E826C2BCD5A31F53EA72B804239076CF43D1C2491FA77C47E3AB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\248DDD9FCF61002E219645695E3FFC98_26974883D20C13C202CBE95D0427D0D7
- Size 727B
- SHA256 13d3b57fd18d0371ea890953daa9c4cc007cfc022d5ea5fa9bcd2be21276fea8
- MD5 667e450b126d484fc3030a0a09326b96
- SHA1 f7edac0f2deb3620772f88baa9c5e6e5e37a2b2e
- SHA512 8138e9109e8ce1d26e11914f27c14af7535d64cc7b60976947268fff5189eeee84288c8e0b6a312424870d85d3b686ed6075b52d6f9190bade06432810ca3e0c
- TLSH T161016092501299032E0A489D8DE62E2FF3B1B5A0BFD9CD2F3D7AA1D350D3790519E021
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
- Size 727B
- SHA256 788eba4674436a2eba66c6c7553867183a9d38fed91910df2b4e659a95314374
- MD5 f0296583f576398f3ac7a59cd3c4e000
- SHA1 f52e510556c1da8ea0cee5caa25d3fd9339a9e18
- SHA512 6e3ce3633a071b0cd21cf409467fdc245fa7d1f6daed2ca7a1e89d2f521eff63c430bc7c126060211b7d95b592671a58af733bcbed04ad5eb887e9ef4ad4e0c4
- TLSH T16201D823CD2F097C9C43CC49CAA5C3787B68DC574CCA188FF65038667484A7D9709021
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\248DDD9FCF61002E219645695E3FFC98_26974883D20C13C202CBE95D0427D0D7
- Size 482B
- SHA256 3b2943d21b72dad73b9df9989c5ad0a4f0b4efca830d3ea2594acbaa9f7cb5e3
- MD5 46a81502f74a2d5d37e1e1866c664bda
- SHA1 ba440d46987bf188ca01791e79fede3825d49c0e
- SHA512 838dc5c4962d1b0b24d273a966d38fed9979b4ee53b1fb54c62169b21c7af500b2dbbf155dd38c9d5a035c73c237ef8fe30adcdd936c2ecce89d056a1c034b0c
- TLSH T1D6F0A31C15E1423CE232ED798AF766299C12B1067810C3FD16D6071D5757D01EC71414
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
- Size 478B
- SHA256 69d76d87abd6a3411339dc7469bbe783d170a7b0b53685998157404fabb89e5d
- MD5 4aefa76ef4cda8874db0adba8549d1a6
- SHA1 4c612b127fe27933a5a420d18b5d5aaa18e35d42
- SHA512 f0e7f1d9a97ff4943d495d9070bc3e6a9162bf1aaf03d9197c9cc38c57548ca34d70294f10109d95d0a59ba9f1dfba2805e5e7118ae99fa254c48f67f902f613
- TLSH T179F05C1411F60079D0379C759ED561368E28F1232608DB5431E25711AE01B01CDB205C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSIEB46.tmp
- Size 412KB
- SHA256 ddfcd04f2ef5a87b8732f552460f7491576607d7c674e1783021c09c42279371
- MD5 168c58eda31144be9a857905be57cfb7
- SHA1 31c6e24890d4758e3719b0044e38d0fcd3350c24
- SHA512 fd7c68901ba3c17e8d4ee29b77fec7c5f5acff21d4d0ad8466f83bf3060dea2e594e6e7e0cf3c645c7ecead813a4f6125157f1e8413d811c1174a867c804f974
- SSDEEP 6144:P9n7J9PsUtPDEzbKBYq+dwzO6wgmpm9r6ck+XJzRbc:Fn7J+UdYzbVduYgWmtk+X0
- TLSH T1D6946A29B3E418EDE4B68276C5A78034FF75744D3320D5AE87A8952D2F3B6A070BB705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58e8f6.msi
- Size 9.4MB
- SHA256 e2a34605b9b59bac25a77ee77d0ae62dea9b441a0b2018af8dea570bc40af23f
- MD5 b90046c6b9c86ce594cdd5fbda85fb1b
- SHA1 362014fc69dd463f925ca5f3036a4d24867d10f8
- SHA512 935a575a354f3398c9f4ba20e9e7f5f1586ec8c7fe60a460cfa3ea5817de5dfd0f26839a653bb81a5ec457abe2db39ae4daa141eaf1f5cabd0fdac3bef7deb6b
- SSDEEP 196608:Gp4jpwZRWG9Ob2TsjYzpa/ZUHm3jdgt/vCL9w5cJh83/6:GupwbWhSlSv3xAvo9TJC
- TLSH T1BAA63365B7A515AAE1B282B1C2A78234FF397C4D3720C19F4B65B1580F7A7B030BB716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 08ac2da68953f43f3155e2d7847e6d0fc7712c7c62b60dcb2ed5f16afc442042
- MD5 ca6db98cbc249b483066f370a7a514d0
- SHA1 c247d3a5c31c6bc871b516b4779f42f184da19b7
- SHA512 1f6ed294f0acb9de238c437b004655bb9a68b391e2ab9413562731c8f10bd44bf2b9faf840b68b06c17312bbf57a52e8ac7e44f8f56a0bef1c9c95bfec640757
- SSDEEP 24576:1u8m+1zFdoO/vvTL7W6O/m6u7jkTSlKSGsWtIl71SEKr+9znovlzC8Rxv:L
- TLSH T1C747C32436F92210F7F79E3CA8F46A23493A7D5B9C259E8D05411B4E0921FB1E872F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{ba718129-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{95039b86-d084-4d29-86ea-0d8bee575aa2}_OnDiskSnapshotProp
- Size 6KB
- SHA256 232ec88b50617fadf45f61e6bb99de3b89bb12d8f1b2ffb287342565f8557e16
- MD5 35842ba9db7b2f37d5bce05b2cf7b058
- SHA1 b1dd985d483a8a5923e98a1f5b095a649dc5ee5f
- SHA512 87746ec1941d67a7dc2653d195bdf3eb9f656a2ab0ae5f1f4516e685e2bd3b275af80f266980e0009fd0084503591d65e2fa518b4d6366dd18f48783e679721b
- SSDEEP 96:FHo4YzUvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:K4xb++ZVmN
- TLSH T177D188085AE54311E2F3AB7128F54553A877B811EF33CB8E0298238E6670A10F875F5F
- MD5 SHA1 SHA512 SSDEEP TLSH