Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
Fileshared.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fileshared.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target Fileshared.msi
- Size 9.4MB
- Sample261002-wwxtcsvbmb
- SHA256 e2a34605b9b59bac25a77ee77d0ae62dea9b441a0b2018af8dea570bc40af23f
- MD5 b90046c6b9c86ce594cdd5fbda85fb1b
- SHA1 362014fc69dd463f925ca5f3036a4d24867d10f8
- SHA512 935a575a354f3398c9f4ba20e9e7f5f1586ec8c7fe60a460cfa3ea5817de5dfd0f26839a653bb81a5ec457abe2db39ae4daa141eaf1f5cabd0fdac3bef7deb6b
- SSDEEP 196608:Gp4jpwZRWG9Ob2TsjYzpa/ZUHm3jdgt/vCL9w5cJh83/6:GupwbWhSlSv3xAvo9TJC
- TLSH T1BAA63365B7A515AAE1B282B1C2A78234FF397C4D3720C19F4B65B1580F7A7B030BB716
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5924 OpsBridgeAgent.exe - Loads dropped DLL 32 IoCs
pid Process 2636 MsiExec.exe 6036 MsiExec.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 2976 msiexec.exe - Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in Program Files directory 36 IoCs
description ioc Process File created C:\Program Files\OpsBridge\_ctypes.pyd msiexec.exe File created C:\Program Files\OpsBridge\pyexpat.pyd msiexec.exe File created C:\Program Files\OpsBridge\servicemanager.pyd msiexec.exe File created C:\Program Files\OpsBridge\vcruntime140_1.dll msiexec.exe File created C:\Program Files\OpsBridge\certifi\cacert.pem msiexec.exe File created C:\Program Files\OpsBridge\_decimal.pyd msiexec.exe File created C:\Program Files\OpsBridge\libcrypto-3.dll msiexec.exe File created C:\Program Files\OpsBridge\charset_normalizer\md.pyd msiexec.exe File created C:\Program Files\OpsBridge\charset_normalizer\md__mypyc.pyd msiexec.exe File created C:\Program Files\OpsBridge\_bz2.pyd msiexec.exe File created C:\Program Files\OpsBridge\_hashlib.pyd msiexec.exe File created C:\Program Files\OpsBridge\_queue.pyd msiexec.exe File created C:\Program Files\OpsBridge\_win32sysloader.pyd msiexec.exe File created C:\Program Files\OpsBridge\pywintypes313.dll msiexec.exe File created C:\Program Files\OpsBridge\unicodedata.pyd msiexec.exe File created C:\Program Files\OpsBridge\psutil\python3.dll msiexec.exe File created C:\Program Files\OpsBridge\libffi-8.dll msiexec.exe File created C:\Program Files\OpsBridge\libssl-3.dll msiexec.exe File created C:\Program Files\OpsBridge\pythoncom313.dll msiexec.exe File created C:\Program Files\OpsBridge\select.pyd msiexec.exe File created C:\Program Files\OpsBridge\win32service.pyd msiexec.exe File created C:\Program Files\OpsBridge\OpsBridgeAgent.exe msiexec.exe File created C:\Program Files\OpsBridge\_lzma.pyd msiexec.exe File created C:\Program Files\OpsBridge\_socket.pyd msiexec.exe File created C:\Program Files\OpsBridge\_wmi.pyd msiexec.exe File created C:\Program Files\OpsBridge\python3.dll msiexec.exe File created C:\Program Files\OpsBridge\python313.dll msiexec.exe File created C:\Program Files\OpsBridge\psutil\_psutil_windows.pyd msiexec.exe File created C:\Program Files\OpsBridge\_ssl.pyd msiexec.exe File created C:\Program Files\OpsBridge\perfmon.pyd msiexec.exe File created C:\Program Files\OpsBridge\win32api.pyd msiexec.exe File created C:\Program Files\OpsBridge\win32evtlog.pyd msiexec.exe File created C:\Program Files\OpsBridge\_elementtree.pyd msiexec.exe File created C:\Program Files\OpsBridge\vcruntime140.dll msiexec.exe File created C:\Program Files\OpsBridge\charset_normalizer\python3.dll msiexec.exe File created C:\Program Files\OpsBridge\win32event.pyd msiexec.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{1E35E1FA-B57D-446F-9722-D1555C49F8B1}\OpsBridgeIcon.ico msiexec.exe File created C:\Windows\SystemTemp\~DFF58CD942DA339DB5.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF12C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF16C.tmp msiexec.exe File created C:\Windows\Installer\e59eaa6.msi msiexec.exe File created C:\Windows\Installer\{1E35E1FA-B57D-446F-9722-D1555C49F8B1}\OpsBridgeIcon.ico msiexec.exe File created C:\Windows\SystemTemp\~DF8F1C346C3EF5E889.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFE728F1905A5ABC2D.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{1E35E1FA-B57D-446F-9722-D1555C49F8B1} msiexec.exe File created C:\Windows\Installer\wix{1E35E1FA-B57D-446F-9722-D1555C49F8B1}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e59eaa4.msi msiexec.exe File opened for modification C:\Windows\Installer\e59eaa4.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFBED980B0D52FF1FD.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF6EB.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2976 msiexec.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname OpsBridgeAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain OpsBridgeAgent.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" OpsBridgeAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" OpsBridgeAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E OpsBridgeAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" OpsBridgeAgent.exe - Modifies registry class 23 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\Version = "50397185" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AF1E53E1D75BF64479221D55C5948F1B\Complete msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\PackageName = "Fileshared.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\ProductName = "OpsBridge Service" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\PackageCode = "22F3D7FD9424F5E4CA19E59492E896C0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\ProductIcon = "C:\\Windows\\Installer\\{1E35E1FA-B57D-446F-9722-D1555C49F8B1}\\OpsBridgeIcon.ico" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E542C572D694D143B89E823897480C8\AF1E53E1D75BF64479221D55C5948F1B msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AF1E53E1D75BF64479221D55C5948F1B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF1E53E1D75BF64479221D55C5948F1B msiexec.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1624 msiexec.exe 1624 msiexec.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe 5924 OpsBridgeAgent.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2976 msiexec.exe Token: SeIncreaseQuotaPrivilege 2976 msiexec.exe Token: SeSecurityPrivilege 1624 msiexec.exe Token: SeCreateTokenPrivilege 2976 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2976 msiexec.exe Token: SeLockMemoryPrivilege 2976 msiexec.exe Token: SeIncreaseQuotaPrivilege 2976 msiexec.exe Token: SeMachineAccountPrivilege 2976 msiexec.exe Token: SeTcbPrivilege 2976 msiexec.exe Token: SeSecurityPrivilege 2976 msiexec.exe Token: SeTakeOwnershipPrivilege 2976 msiexec.exe Token: SeLoadDriverPrivilege 2976 msiexec.exe Token: SeSystemProfilePrivilege 2976 msiexec.exe Token: SeSystemtimePrivilege 2976 msiexec.exe Token: SeProfSingleProcessPrivilege 2976 msiexec.exe Token: SeIncBasePriorityPrivilege 2976 msiexec.exe Token: SeCreatePagefilePrivilege 2976 msiexec.exe Token: SeCreatePermanentPrivilege 2976 msiexec.exe Token: SeBackupPrivilege 2976 msiexec.exe Token: SeRestorePrivilege 2976 msiexec.exe Token: SeShutdownPrivilege 2976 msiexec.exe Token: SeDebugPrivilege 2976 msiexec.exe Token: SeAuditPrivilege 2976 msiexec.exe Token: SeSystemEnvironmentPrivilege 2976 msiexec.exe Token: SeChangeNotifyPrivilege 2976 msiexec.exe Token: SeRemoteShutdownPrivilege 2976 msiexec.exe Token: SeUndockPrivilege 2976 msiexec.exe Token: SeSyncAgentPrivilege 2976 msiexec.exe Token: SeEnableDelegationPrivilege 2976 msiexec.exe Token: SeManageVolumePrivilege 2976 msiexec.exe Token: SeImpersonatePrivilege 2976 msiexec.exe Token: SeCreateGlobalPrivilege 2976 msiexec.exe Token: SeBackupPrivilege 3336 vssvc.exe Token: SeRestorePrivilege 3336 vssvc.exe Token: SeAuditPrivilege 3336 vssvc.exe Token: SeBackupPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeShutdownPrivilege 6036 MsiExec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe Token: SeRestorePrivilege 1624 msiexec.exe Token: SeTakeOwnershipPrivilege 1624 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2976 msiexec.exe 2976 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2976 msiexec.exe 1624 msiexec.exe 2636 MsiExec.exe 6036 MsiExec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1624 wrote to memory of 5568 1624 msiexec.exe 93 PID 1624 wrote to memory of 2636 1624 msiexec.exe 95 PID 1624 wrote to memory of 6036 1624 msiexec.exe 96 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Fileshared.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2976
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5568
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 87707A555C44171AD52D5007EDC5DE3B2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2636
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding B6598FE7375A4359BC6E211D07B7FE25 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6036
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
C:\Program Files\OpsBridge\OpsBridgeAgent.exe"C:\Program Files\OpsBridge\OpsBridgeAgent.exe" --service1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5924
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59eaa5.rbs
- Size 426KB
- SHA256 58b58a24d2f75069579e174f6c1595c4197f50110403022e8006a1e8a96ea46f
- MD5 d5eb9cd7bafca17f80a8e0ef0a7657de
- SHA1 ee10c0b025a5045dc77cc5b01a6128d20556d71f
- SHA512 b385a2fe2f6df82e33e289b0989b9595cc7c787180f4e434c029bd76385575c3e75164675e87bedbcedf037b3ff307c4866e9fa09eafa4de75b36c06129730e0
- SSDEEP 6144:T9n7J9PsUtPDEzbKBYq+dwzO6wgmpm9r6ck+XJzRbv:Zn7J+UdYzbVduYgWmtk+Xn
- TLSH T1AD946B29B3E418EDE4B78272C5978134FF75744D332096AE47A8942D2F3B6A470BB706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\_ctypes.pyd
- Size 130KB
- SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
- MD5 29873384e13b0a78ee9857604161514b
- SHA1 110f60f74b06b3972acd5908937a40e078636479
- SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
- SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
- TLSH T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\_hashlib.pyd
- Size 63KB
- SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
- MD5 3e540ef568215561590df215801b0f59
- SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
- SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
- SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
- TLSH T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\_lzma.pyd
- Size 155KB
- SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
- MD5 d63e2e743ea103626d33b3c1d882f419
- SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
- SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
- SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
- TLSH T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\_socket.pyd
- Size 83KB
- SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
- MD5 566cb4d39b700c19dbd7175bd4f2b649
- SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
- SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
- SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
- TLSH T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\_ssl.pyd
- Size 177KB
- SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
- MD5 689f1abac772c9e4c2d3bad3758cb398
- SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
- SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
- SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
- TLSH T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\charset_normalizer\md__mypyc.pyd
- Size 133KB
- SHA256 9766b5875c44e9cf8c2b60ff86445d27625396a8f6a940ebed99f6ed83a4d327
- MD5 9b6a61b0cac43b16b87d75ccd50b2bbc
- SHA1 99247d72c5f878df693e1c3f1e84bb88b0b14720
- SHA512 22e135b39be9dae3d5903f54d1695c64299d44132eead4536bf8493b10db74c71a833f527491e1f24d9b7526a9760eba14ec67b74cbb7daf07c97b238f9bf9b7
- SSDEEP 3072:8dOHcsVOUm2jVPoV9wsBOYtvsHgFXYwbOUwktq5g:Z8frBntIwbOmAg
- TLSH T1C1D31967529500B7CA634179CCB7A513DBE1B5510B3263CF04A4C69A6F037E6AEBEB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\libcrypto-3.dll
- Size 5.0MB
- SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
- MD5 ae5b2e9a3410839b31938f24b6fc5cd8
- SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
- SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
- SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
- TLSH T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\libssl-3.dll
- Size 776KB
- SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
- MD5 8d4805f0651186046c48d3e2356623db
- SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
- SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
- SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
- TLSH T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\OPSBRI~1\select.pyd
- Size 31KB
- SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
- MD5 715a098175d3ca1c1da2dc5756b31860
- SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
- SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
- SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
- TLSH T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\OpsBridgeAgent.exe
- Size 15.4MB
- SHA256 fb41c882a4eb7b430712f76d68c24705a3b717f8e2bbeeadb396c4c9e9e6de65
- MD5 d23c9f5c7da3188c644f86695cbfebda
- SHA1 cec88228edab950464b976398e5fc2b60f44ffcc
- SHA512 8ac3072526a855ca0a938f3edb3bc1b48b553e91dcb71ccd504735dce4483580a3ba82aa12d2b64a25052d2ac20bab60f5f1668f0e82c5e64913d862585dfb55
- SSDEEP 98304:mhLDpisuDD6kyQQN6+T+FJOoft0kC52KzUE8mcwkAYhMZ6IW9+GQ9XkK0dLqDLQF:k56P8WgXcYtMojKLdVmiYq
- TLSH T14EF66B072670A416FE38D0B88D56C8F2573AB99F8610B5B3369D45752BD2C632FBC89C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_bz2.pyd
- Size 83KB
- SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
- MD5 684d656aada9f7d74f5a5bdcf16d0edb
- SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
- SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
- SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
- TLSH T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_queue.pyd
- Size 34KB
- SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
- MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
- SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
- SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
- SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
- TLSH T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_win32sysloader.pyd
- Size 25KB
- SHA256 d85da81d8620334656d9dbb7638f35ab0b93f2a2d21a2a4830a7d947ddb32fef
- MD5 ad148c5dbeb5ae9b8bc5bf24380dbdb7
- SHA1 6ca22a04c0715c4ced717a1405e6a242787200af
- SHA512 d09384499c13b7989fddaa020e3c9c1b1f030fce1df544ce2ecbe7a08bf6558fdcfdb56258f3fd870493710267da5d1a7459e1c76aff57cb19c7ab8a67331a64
- SSDEEP 768:k+d28Hkwlyx3s/Dv97/vWFtq0T0RwLyKv:74Gkd3sLv9/vWFtq0T0RRKv
- TLSH T1B7B26B83BB5980E6E4B3C63CC4F31B57AD37B9A42721539F02A291151D963D07F2E6AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\_wmi.pyd
- Size 38KB
- SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
- MD5 47e6fd132f44a4feb595bd0fda3c4e1c
- SHA1 37c6c2c1ff309db7273afc9324a37b716c5cbfdb
- SHA512 69c031d4ff2dac70739f9c188fca3c6969304f22782adf5a9c0ca303a3a712630541bda888ef25d3252b46d43df56f6e7e03c83d331840088c4224d1a1a512c4
- SSDEEP 768:nEkKVVUWO0X1ctqDFIgLi6OytxJEKrLy2Ip4RsCxf1mljr8VMOj:nE9v3JctqDFIgLi1ytH/9R1fI38VMi
- TLSH T1AC037D8AE2640046E663DAB5C9A6CE53F571B7C36B11D38F365582990F233C0E73A336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\charset_normalizer\md.pyd
- Size 20KB
- SHA256 b3be8a8abd07fd1d0b1ba27ee42d2c705851cc2f4ab31512541a50b5a9a9ecd1
- MD5 f3d0e88c6cace726bff103e64208c747
- SHA1 86771b0a7f80085bbeb1dee9f239a2d40cf0f511
- SHA512 1f3dc0bcdad4ec556b2fc54eea81e560d4c302f944085f0bcd0864446d42a79f0810ee900922aae9f62598dac950c9ec137af2cc97a89f02522ed521a13f8e85
- SSDEEP 384:7Vx4m446oDZuI8AeYLdwFlswVJC0c8KmMwUaym/N39:7V6s6o1VJJWFtq0MRwLyK
- TLSH T1BD927D9AEE2C44E2EE428A34C5D20D47FD33BA91170576DF5334D0256EC67E26A3E22D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\psutil\_psutil_windows.pyd
- Size 78KB
- SHA256 2203f592a85b78d4645f49851682f75572b6180e80b898dbc578c49f6f87601e
- MD5 af163176be88c8370d7f710a26c0a746
- SHA1 701866b34397e0463ae0ce0b74c7086894de5aa5
- SHA512 735c5488b8ab3c3e70ccc51ae32636492ab231820b69216bb0d64c7a1ccd976eec78c98453d5db920889683a144ed23969db873f4169469aee73aa787309d56b
- SSDEEP 1536:3CZzwq2+SBRJdpZnJbPoPVM04YnUjHmCHWFtq0CURRKd:yZzkBhpZn4M04qMmNtqnUi
- TLSH T1BA734996B75800F8D917913C9AF25A37EBB2B091132657DF0160D64A0FA3BE36E7DB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\psutil\python3.dll
- Size 69KB
- SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
- MD5 d6dfb6a9518a57e180980f7a07098d7d
- SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
- SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
- SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
- TLSH T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\python313.dll
- Size 5.8MB
- SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
- MD5 7387fe038ea75eb9a57b054fccfe37bf
- SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
- SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
- SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
- TLSH T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\pywintypes313.dll
- Size 142KB
- SHA256 aef8ffb1cd0e922fa1cb67575a05003e21a72ac1b731f192ac5dcef104ab5926
- MD5 6860149eee580cfc51b6726701d752c9
- SHA1 7be2bfba88a7948e3830acec1f2066e5cd1ff03c
- SHA512 20bc6a46ff3962149c59ccd7d20591371ba047d33da77bed826f534613ca4dd44b21796b68b7756b22b3cdd39c911c2b1dceb395cf9e8fb98d6f8de864521ce7
- SSDEEP 3072:rdyqdYmyWa5br4d1qfGHrY/rZ6Yr2laFU4LGUgl4jptIaiTantq6r:r4aYlWa9r61LrY/rPbFU4NgOjptIiTr
- TLSH T1DDE33947374684DAE9669379CDB71A03D7A2B0000711E3CF06A1C28B6FA37E66D3B746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\servicemanager.pyd
- Size 51KB
- SHA256 8751317c52c107afc51ff697799fd9e059c407fe09b0964f7f4f2360346a2fd2
- MD5 0ac7fb272962aaecd7fd06e7f8743fce
- SHA1 3f153716d43f0deaf748f687bf973e9e365529fb
- SHA512 268aa5bd570d2338b06dadf7918736666a797c9ce08425e0e8d1a23d0cbcce94f78874b26bb76585cea519f2b552f84bc7a964f34b83e38051633e5393805b36
- SSDEEP 1536:tYldu4SMi6x1DDDRuuLCwhaXoCCPsWFtq0xRRK7:tCg4SMVx1DDDEICwhaXoXPBtqAM
- TLSH T18E333A4763A64059F573A638D5F306739A3278811B75A2CF0260C41E3EB2BD47D35BAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\unicodedata.pyd
- Size 695KB
- SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
- MD5 503b3ffa6a5bf45ab34d6d74352f206b
- SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
- SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
- SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
- TLSH T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\vcruntime140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\win32api.pyd
- Size 145KB
- SHA256 ec063aa87931a7b0652bc4296f6ac84619326b8cbee839ddadf0ebc9bc01632e
- MD5 31c59c22aeee18acb8a60225f90952e5
- SHA1 e489c41b5ec1b490c2046e7e5fe1327f1c2adcc9
- SHA512 754f04449e64f524cfc442071f317a421197dd978e5496a4dd3b2cc9c5647c8849a6bfde61bfb25ae8042bb6cebd3776d7ce5cccf822347ba3c3d9e618199b48
- SSDEEP 3072:t7AK00RjZk+uEIvPlRVlhLaN/PSexhlT9qTmP9bDm/GgUXJkeMtq75:JAF0fu73lRVsPSexhbqyvcGg0GO5
- TLSH T103E31783B35410D6D86AA37CC1675E23DB72B8240725A7CF06A0C28A1F63BE97D3D795
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\win32event.pyd
- Size 39KB
- SHA256 f7676632259833374739dfbea0a96f85d3ddc94f44e52a94a2bc3339d2626ab0
- MD5 db700261fcf8e10607bd8be009e58881
- SHA1 d7d6392d20ee748c3621a1ff186ca77513df133f
- SHA512 5d16a486477dde4202cd75461bd6e0297e9351ec05aa0a4499fe632aa3a5a9799642388d357c7366e785f5de8d401cf5e52f6a196c6c2b3d649a8a6c4bd43d4f
- SSDEEP 768:YaWut7Goxs5Llg+Ebc/jhfWddbcrb8l/99mku36U4a4sWFtq03RwLyK8V:Y8Rc/jhfWddbcH8l/99mku36U4a4sWFv
- TLSH T1830328C727685095E967C53CC4961E07EA73B96007A0B3EF0222D51A1FA23E17B3DB8D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\OpsBridge\win32service.pyd
- Size 68KB
- SHA256 2444a2a5a1807d971f5a55394f5a21ac3aeb200c07744b67d1a5f0e70b67eff2
- MD5 989b2e59802f94a10691ec348e4072e7
- SHA1 fd8533990541da16e26dcf7c4c1c66008d537a0a
- SHA512 f0f04229b269a05d4b974a7d580c01662b3e8a3bd40fc20c1bc03bf1083319cf511a160ced12c4a911b803a57e42842650a3d1ec1c4bb499174923767a8f9a64
- SSDEEP 1536:Oe7pZxWJERz66jkltv/vN66NuSs7jNKWFtq0NGRRK:HbnW3166oSsvNjtqB
- TLSH T158633A4BA35611E5E826C2BCD5A31F53EA72B804239076CF43D1C2491FA77C47E3AB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF16C.tmp
- Size 412KB
- SHA256 ddfcd04f2ef5a87b8732f552460f7491576607d7c674e1783021c09c42279371
- MD5 168c58eda31144be9a857905be57cfb7
- SHA1 31c6e24890d4758e3719b0044e38d0fcd3350c24
- SHA512 fd7c68901ba3c17e8d4ee29b77fec7c5f5acff21d4d0ad8466f83bf3060dea2e594e6e7e0cf3c645c7ecead813a4f6125157f1e8413d811c1174a867c804f974
- SSDEEP 6144:P9n7J9PsUtPDEzbKBYq+dwzO6wgmpm9r6ck+XJzRbc:Fn7J+UdYzbVduYgWmtk+X0
- TLSH T1D6946A29B3E418EDE4B68276C5A78034FF75744D3320D5AE87A8952D2F3B6A070BB705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59eaa6.msi
- Size 9.4MB
- SHA256 e2a34605b9b59bac25a77ee77d0ae62dea9b441a0b2018af8dea570bc40af23f
- MD5 b90046c6b9c86ce594cdd5fbda85fb1b
- SHA1 362014fc69dd463f925ca5f3036a4d24867d10f8
- SHA512 935a575a354f3398c9f4ba20e9e7f5f1586ec8c7fe60a460cfa3ea5817de5dfd0f26839a653bb81a5ec457abe2db39ae4daa141eaf1f5cabd0fdac3bef7deb6b
- SSDEEP 196608:Gp4jpwZRWG9Ob2TsjYzpa/ZUHm3jdgt/vCL9w5cJh83/6:GupwbWhSlSv3xAvo9TJC
- TLSH T1BAA63365B7A515AAE1B282B1C2A78234FF397C4D3720C19F4B65B1580F7A7B030BB716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b76704bb-9e90-4a93-bf45-778a4cb90e7b}_OnDiskSnapshotProp
- Size 6KB
- SHA256 a1cbeadadbdefbd62cafa306aac76623b292b01d342e74a61c9d82d09b126d9f
- MD5 51c6daf744666ed4be32982f6e0b83ce
- SHA1 6c822e64b4ecaf58a74f7319a28c0eb6bfec4480
- SHA512 4401a2f913d719e5369886a6f0b7aa3e6f77ef51ddd6069de3f9519b53838f2ba2a7058024cc06cf308d112717ffd41fc80a8f3705715a179718e5941e55bad9
- SSDEEP 96:FSYPTjhvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:EYPlb++uVmN
- TLSH T182D188085AE54711E2F3AB3129F18557A877B811EF33CB8E0198238E6670A10F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH