6aba832d095cf90906b34335f698bee1debe024ce3422375ee9394aea94dc934

Resubmissions

01/09/2026, 16:25

260901-tww6qade847

18/08/2026, 22:30

260818-2e9pgstthw8

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6aba832d095cf90906b34335f698bee1debe024ce3422375ee9394aea94dc934.exe
Size 5.5MB
Sample260818-2e9pgstthw
SHA256 6aba832d095cf90906b34335f698bee1debe024ce3422375ee9394aea94dc934
MD5 6699cdad824d4e21964db174cb9622d2
SHA1 6d8bf8874c0ac7dddc63370689cab279f92c9d3e
SHA512 35a83d06e9e66675ca46c3a743ac7b3d3673fea95ca3640556484098c913ed099b5ef18552c5f902352bee77e86e9ea3a851d76d54353453ec7af4dff6e1c028
SSDEEP 98304:NjbltFqoOFYQlOdda0WH8JvwvRhCYAvX:3dG/
TLSH
T182464C05BA6B94ACD15BC47483068A639E2170DF1B36BAFF018486783F6ABF15B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3172	powershell.exe
4284	powershell.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4132	netsh.exe
2272	netsh.exe
3116	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
5744	BridgeAgent.exe
1416	BridgeAgent.exe
4332	bridge.exe
1384	bridge.exe
4728	bridge.exe
2996	bridge.exe
4172	bridge.exe
3192	bridge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\bridge.exe"	bridge.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\bridge.exe"	bridge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RemoteX = "C:\\ProgramData\\Microsoft\\Windows\\bridge.exe"	bridge.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com
3	ip-api.com

Discovers running processes 1 TTPs 8 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
568	tasklist.exe
5444	tasklist.exe
2700	tasklist.exe
5240	tasklist.exe
5504	tasklist.exe
1112	tasklist.exe
3032	tasklist.exe
3376	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4064	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4888	chrome.exe
912	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	35	Go-http-client/1.1
HTTP User-Agent header	70	Go-http-client/1.1

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315659096058159"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry key 1 TTPs 11 IoCs

Modify Registry

T1112

pid	Process
692	reg.exe
5992	reg.exe
5856	reg.exe
3548	reg.exe
5428	reg.exe
1392	reg.exe
3520	reg.exe
5740	reg.exe
6040	reg.exe
5680	reg.exe
2876	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2616	schtasks.exe
2632	schtasks.exe
5468	schtasks.exe
4052	schtasks.exe
1344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4064	powershell.exe
4064	powershell.exe
4064	powershell.exe
4332	bridge.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
4284	powershell.exe
4284	powershell.exe
4284	powershell.exe
1652	chrome.exe
1652	chrome.exe
1836	chrome.exe
1836	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeIncreaseQuotaPrivilege	4064	powershell.exe
Token: SeSecurityPrivilege	4064	powershell.exe
Token: SeTakeOwnershipPrivilege	4064	powershell.exe
Token: SeLoadDriverPrivilege	4064	powershell.exe
Token: SeSystemProfilePrivilege	4064	powershell.exe
Token: SeSystemtimePrivilege	4064	powershell.exe
Token: SeProfSingleProcessPrivilege	4064	powershell.exe
Token: SeIncBasePriorityPrivilege	4064	powershell.exe
Token: SeCreatePagefilePrivilege	4064	powershell.exe
Token: SeBackupPrivilege	4064	powershell.exe
Token: SeRestorePrivilege	4064	powershell.exe
Token: SeShutdownPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeSystemEnvironmentPrivilege	4064	powershell.exe
Token: SeRemoteShutdownPrivilege	4064	powershell.exe
Token: SeUndockPrivilege	4064	powershell.exe
Token: SeManageVolumePrivilege	4064	powershell.exe
Token: 33	4064	powershell.exe
Token: 34	4064	powershell.exe
Token: 35	4064	powershell.exe
Token: 36	4064	powershell.exe
Token: SeIncreaseQuotaPrivilege	4064	powershell.exe
Token: SeSecurityPrivilege	4064	powershell.exe
Token: SeTakeOwnershipPrivilege	4064	powershell.exe
Token: SeLoadDriverPrivilege	4064	powershell.exe
Token: SeSystemProfilePrivilege	4064	powershell.exe
Token: SeSystemtimePrivilege	4064	powershell.exe
Token: SeProfSingleProcessPrivilege	4064	powershell.exe
Token: SeIncBasePriorityPrivilege	4064	powershell.exe
Token: SeCreatePagefilePrivilege	4064	powershell.exe
Token: SeBackupPrivilege	4064	powershell.exe
Token: SeRestorePrivilege	4064	powershell.exe
Token: SeShutdownPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeSystemEnvironmentPrivilege	4064	powershell.exe
Token: SeRemoteShutdownPrivilege	4064	powershell.exe
Token: SeUndockPrivilege	4064	powershell.exe
Token: SeManageVolumePrivilege	4064	powershell.exe
Token: 33	4064	powershell.exe
Token: 34	4064	powershell.exe
Token: 35	4064	powershell.exe
Token: 36	4064	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeDebugPrivilege	3032	tasklist.exe
Token: SeDebugPrivilege	3376	tasklist.exe
Token: SeDebugPrivilege	568	tasklist.exe
Token: SeDebugPrivilege	5444	tasklist.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe
Token: SeCreatePagefilePrivilege	1652	chrome.exe
Token: SeShutdownPrivilege	1652	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1652	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe
1836	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	bridge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 692	2496	6aba832d095cf90906b34335f698bee1debe024ce3422375ee9394aea94dc934.exe	87
PID 2496 wrote to memory of 5744	2496	6aba832d095cf90906b34335f698bee1debe024ce3422375ee9394aea94dc934.exe	89
PID 5744 wrote to memory of 1392	5744	BridgeAgent.exe	90
PID 5744 wrote to memory of 1416	5744	BridgeAgent.exe	92
PID 1416 wrote to memory of 5356	1416	BridgeAgent.exe	94
PID 1416 wrote to memory of 4064	1416	BridgeAgent.exe	96
PID 1416 wrote to memory of 4868	1416	BridgeAgent.exe	133
PID 1416 wrote to memory of 3520	1416	BridgeAgent.exe	101
PID 1416 wrote to memory of 3464	1416	BridgeAgent.exe	103
PID 1416 wrote to memory of 1176	1416	BridgeAgent.exe	105
PID 1416 wrote to memory of 4104	1416	BridgeAgent.exe	107
PID 1416 wrote to memory of 4332	1416	BridgeAgent.exe	109
PID 4332 wrote to memory of 3172	4332	bridge.exe	111
PID 4332 wrote to memory of 2632	4332	bridge.exe	113
PID 4332 wrote to memory of 5468	4332	bridge.exe	115
PID 4332 wrote to memory of 4052	4332	bridge.exe	117
PID 4332 wrote to memory of 4132	4332	bridge.exe	119
PID 4332 wrote to memory of 4284	4332	bridge.exe	121
PID 4332 wrote to memory of 2272	4332	bridge.exe	127
PID 4332 wrote to memory of 1344	4332	bridge.exe	129
PID 4332 wrote to memory of 2616	4332	bridge.exe	131
PID 4332 wrote to memory of 3116	4332	bridge.exe	139
PID 1416 wrote to memory of 4276	1416	BridgeAgent.exe	141
PID 1416 wrote to memory of 5992	1416	BridgeAgent.exe	143
PID 1416 wrote to memory of 5740	1416	BridgeAgent.exe	145
PID 1416 wrote to memory of 3032	1416	BridgeAgent.exe	147
PID 1416 wrote to memory of 3376	1416	BridgeAgent.exe	150
PID 1416 wrote to memory of 6040	1416	BridgeAgent.exe	152
PID 1416 wrote to memory of 5856	1416	BridgeAgent.exe	154
PID 1416 wrote to memory of 568	1416	BridgeAgent.exe	156
PID 1416 wrote to memory of 5444	1416	BridgeAgent.exe	158
PID 1416 wrote to memory of 1652	1416	BridgeAgent.exe	160
PID 1652 wrote to memory of 5872	1652	chrome.exe	161
PID 1652 wrote to memory of 4888	1652	chrome.exe	162
PID 1652 wrote to memory of 1532	1652	chrome.exe	164
PID 1652 wrote to memory of 1532	1652	chrome.exe	164
PID 1652 wrote to memory of 1356	1652	chrome.exe	163
PID 1652 wrote to memory of 1356	1652	chrome.exe	163
PID 1652 wrote to memory of 4056	1652	chrome.exe	167
PID 1652 wrote to memory of 2784	1652	chrome.exe	166
PID 1652 wrote to memory of 4056	1652	chrome.exe	167
PID 1652 wrote to memory of 2784	1652	chrome.exe	166
PID 1652 wrote to memory of 5680	1652	chrome.exe	168
PID 1652 wrote to memory of 5680	1652	chrome.exe	168
PID 1652 wrote to memory of 4036	1652	chrome.exe	169
PID 1652 wrote to memory of 4036	1652	chrome.exe	169
PID 1652 wrote to memory of 1428	1652	chrome.exe	170
PID 1652 wrote to memory of 3792	1652	chrome.exe	171
PID 1652 wrote to memory of 4172	1652	chrome.exe	172
PID 1652 wrote to memory of 3792	1652	chrome.exe	171
PID 1652 wrote to memory of 4172	1652	chrome.exe	172
PID 1652 wrote to memory of 1892	1652	chrome.exe	175
PID 1652 wrote to memory of 4700	1652	chrome.exe	176
PID 1652 wrote to memory of 1892	1652	chrome.exe	175
PID 1652 wrote to memory of 1176	1652	chrome.exe	177
PID 1652 wrote to memory of 4700	1652	chrome.exe	176
PID 1652 wrote to memory of 1176	1652	chrome.exe	177
PID 1652 wrote to memory of 4040	1652	chrome.exe	179
PID 1652 wrote to memory of 4896	1652	chrome.exe	185
PID 1652 wrote to memory of 4040	1652	chrome.exe	179
PID 1652 wrote to memory of 4896	1652	chrome.exe	185
PID 1652 wrote to memory of 5696	1652	chrome.exe	180
PID 1652 wrote to memory of 5696	1652	chrome.exe	180
PID 1652 wrote to memory of 5836	1652	chrome.exe	181

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6aba832d095cf90906b34335f698bee1debe024ce3422375ee9394aea94dc934.exe
"C:\Users\Admin\AppData\Local\Temp\6aba832d095cf90906b34335f698bee1debe024ce3422375ee9394aea94dc934.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\reg.exe
  "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:692
- C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
  "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\system32\reg.exe
    "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1392
- - C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
    "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 5744
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:5356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoLogo -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue'; $exe=$env:BRIDGE_TRUST_EXE; $sig=Get-AuthenticodeSignature -LiteralPath $exe; $sigStatus=if($sig){[string]$sig.Status}else{'Unknown'}; $publisher=if($sig -and $sig.SignerCertificate){[string]$sig.SignerCertificate.Subject}else{''}; $mp=Get-MpComputerStatus; $tamper=if($null -ne $mp -and $null -ne $mp.IsTamperProtected){if([bool]$mp.IsTamperProtected){'Enabled'}else{'Disabled'}}else{'Unknown'}; $source='Local'; if(Test-Path 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender'){$source='MDM'}elseif(Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'){$source='Group Policy'}; $onboard=(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' -Name OnboardingState -ErrorAction SilentlyContinue).OnboardingState; if($onboard -eq 1 -and $source -eq 'Local'){$source='Defender for Endpoint'}; $detection='Unknown'; if(Get-Command Get-MpThreatDetection -ErrorAction SilentlyContinue){$matches=@(Get-MpThreatDetection | Where-Object { (($_.Resources | Out-String) -like ('*'+$exe+'*')) });$detection=if($matches.Count -gt 0){'Detection observed'}else{'None observed'}}; [ordered]@{signature_status=$sigStatus;publisher=$publisher;tamper_protection=$tamper;management_source=$source;defender_detection=$detection}|ConvertTo-Json -Compress"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4064
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:4868
  - - C:\Windows\system32\reg.exe
      "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3520
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:3464
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:1176
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Bridge\apps\app_bridge_auto\current\bridge.exe
      "C:\Users\Admin\AppData\Local\Bridge\apps\app_bridge_auto\current\bridge.exe"
      4⤵
      Executes dropped EXE
      Registers new Windows logon scripts automatically executed at logon.
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Microsoft\Windows\bridge.exe';$s.WindowStyle=7;$s.Save()"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Creates a file in the Startup directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn MicrosoftWindowsManagementClient /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\bridge.exe\" /sc ONLOGON /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2632
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn MicrosoftWindowsManagementClientBoot /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\bridge.exe\" /sc ONSTART /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5468
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn MicrosoftWindowsManagementClientPerf /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\bridge.exe\" /sc MINUTE /mo 5 /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4052
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule "name=RemoteX Client"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\WindowsSystemComponent.lnk');$s.TargetPath='C:\ProgramData\Microsoft\Windows\bridge.exe';$s.WindowStyle=7;$s.Save()"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4284
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule "name=RemoteX Client" dir=out action=allow program=C:\Users\Admin\AppData\Local\Bridge\apps\app_bridge_auto\current\bridge.exe
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2272
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn MicrosoftWindowsManagementClientSystem /tr \"C:\ProgramData\Microsoft\Windows\bridge.exe\" /sc ONLOGON /ru SYSTEM /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1344
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn MicrosoftWindowsManagementClientSystemBoot /tr \"C:\ProgramData\Microsoft\Windows\bridge.exe\" /sc ONSTART /ru SYSTEM /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2616
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule "name=RemoteX Client In" dir=in action=allow program=C:\Users\Admin\AppData\Local\Bridge\apps\app_bridge_auto\current\bridge.exe
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3116
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:4276
  - - C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" query HKCU\Software\Policies\Google\Chrome /v UserDataDir
      4⤵
      Modifies registry key
      PID:5992
  - - C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" query HKLM\Software\Policies\Google\Chrome /v UserDataDir
      4⤵
      Modifies registry key
      PID:5740
  - - C:\Windows\System32\tasklist.exe
      "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3032
  - - C:\Windows\System32\tasklist.exe
      "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3376
  - - C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" query HKCU\Software\Policies\Google\Chrome /v UserDataDir
      4⤵
      Modifies registry key
      PID:6040
  - - C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" query HKLM\Software\Policies\Google\Chrome /v UserDataDir
      4⤵
      Modifies registry key
      PID:5856
  - - C:\Windows\System32\tasklist.exe
      "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:568
  - - C:\Windows\System32\tasklist.exe
      "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google/Chrome/Application/chrome.exe" "--user-data-dir=C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --profile-directory=Default --no-default-browser-check --new-window --disable-background-mode --disable-gpu --disable-gpu-compositing --disable-direct-composition
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1652
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ff902e2c728,0x7ff902e2c734,0x7ff902e2c740
        5⤵
        
        PID:5872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1908,i,12879710675607493306,14638969960730460050,524288 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4888
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-direct-composition --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1652,i,16611351456881470954,764019314794007749,262144 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
        5⤵
        
        PID:1356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,11408579734014444687,16337262138901877997,524288 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
        5⤵
        
        PID:1532
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,15235948715061235786,5409339110533966462,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:2784
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,15973242888847714938,14025889570038444969,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
        5⤵
        
        PID:4056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,6817027746654240756,14752314937623873340,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
        5⤵
        
        PID:5680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=4784,i,202645498044024706,52730550785717777,524288 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
        5⤵
        
        PID:4036
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,10965971581473946091,4254973783046560233,524288 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
        5⤵
        
        PID:1428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5348,i,5366289744961120845,3171148679750216453,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
        5⤵
        
        PID:3792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5336,i,8210075157306854424,13069896008614916340,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
        5⤵
        
        PID:4172
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5528,i,4748927498634403573,7805978730075240432,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
        5⤵
        
        PID:1892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,2090209819196302015,1690464355322045764,524288 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
        5⤵
        
        PID:4700
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5632,i,739255793568089831,593106861062111705,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
        5⤵
        
        PID:1176
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5712,i,435017965739436017,1374671570831937280,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
        5⤵
        
        PID:4896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5392,i,6016989887301975403,13021689614978825732,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
        5⤵
        
        PID:4040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5476,i,13153066109591781794,10090317348672469207,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
        5⤵
        
        PID:5696
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5996,i,5988752257014295870,17746509425801603633,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
        5⤵
        
        PID:5836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,17973053834231701354,9366792589677210085,524288 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
        5⤵
        
        PID:5504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,4930646355624940593,12553762360358611717,524288 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
        5⤵
        
        PID:4180
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6080,i,16121693970800690529,9539798877868976085,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
        5⤵
        
        PID:5312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5856,i,7134605247710391936,778218009362324939,2097152 --field-trial-handle=2052,i,10087473849095868183,7246371498207632626,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:9
        5⤵
        
        PID:4896
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:3192
  - - C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" query HKCU\Software\Policies\Google\Chrome /v UserDataDir
      4⤵
      Modifies registry key
      PID:5680
  - - C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" query HKLM\Software\Policies\Google\Chrome /v UserDataDir
      4⤵
      Modifies registry key
      PID:2876
  - - C:\Windows\System32\tasklist.exe
      "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2700
  - - C:\Windows\System32\tasklist.exe
      "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5240
  - - C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" query HKCU\Software\Policies\Google\Chrome /v UserDataDir
      4⤵
      Modifies registry key
      PID:3548
  - - C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" query HKLM\Software\Policies\Google\Chrome /v UserDataDir
      4⤵
      Modifies registry key
      PID:5428
  - - C:\Windows\System32\tasklist.exe
      "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5504
  - - C:\Windows\System32\tasklist.exe
      "C:\Windows\System32\tasklist.exe" /FI "IMAGENAME eq chrome.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:1112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google/Chrome/Application/chrome.exe" "--user-data-dir=C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --profile-directory=Default --no-default-browser-check --new-window --disable-background-mode --disable-gpu --disable-gpu-compositing --disable-direct-composition
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:1836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff902e2c728,0x7ff902e2c734,0x7ff902e2c740
        5⤵
        
        PID:1700
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-direct-composition --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1672,i,3021519343080012772,13321588171183905576,262144 --field-trial-handle=2000,i,5577905522722391166,12388124613605319717,262144 --variations-seed-version=20260818-090057.333000-production --mojo-platform-channel-handle=1996 /prefetch:2
        5⤵
        
        PID:5732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,5600629339228528450,8820654885721042316,524288 --field-trial-handle=2000,i,5577905522722391166,12388124613605319717,262144 --variations-seed-version=20260818-090057.333000-production --mojo-platform-channel-handle=2064 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,4083697345693083683,14159424382986667695,524288 --field-trial-handle=2000,i,5577905522722391166,12388124613605319717,262144 --variations-seed-version=20260818-090057.333000-production --mojo-platform-channel-handle=2252 /prefetch:13
        5⤵
        
        PID:1124
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,14508146170460119427,6815142454671493579,2097152 --field-trial-handle=2000,i,5577905522722391166,12388124613605319717,262144 --variations-seed-version=20260818-090057.333000-production --mojo-platform-channel-handle=3160 /prefetch:1
        5⤵
        
        PID:2000
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,14407884254227756028,6194238067059021394,2097152 --field-trial-handle=2000,i,5577905522722391166,12388124613605319717,262144 --variations-seed-version=20260818-090057.333000-production --mojo-platform-channel-handle=3180 /prefetch:1
        5⤵
        
        PID:1748
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,9353279172485926146,3889189786609067603,2097152 --field-trial-handle=2000,i,5577905522722391166,12388124613605319717,262144 --variations-seed-version=20260818-090057.333000-production --mojo-platform-channel-handle=4608 /prefetch:1
        5⤵
        
        PID:2672
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,4363024679714206865,4684477363836109052,524288 --field-trial-handle=2000,i,5577905522722391166,12388124613605319717,262144 --variations-seed-version=20260818-090057.333000-production --mojo-platform-channel-handle=5272 /prefetch:14
        5⤵
        
        PID:4868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5508,i,14156595087734273302,15033321342452333268,2097152 --field-trial-handle=2000,i,5577905522722391166,12388124613605319717,262144 --variations-seed-version=20260818-090057.333000-production --mojo-platform-channel-handle=5532 /prefetch:1
        5⤵
        
        PID:2840
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=260,i,15221104691771396000,12134414122941624822,524288 --field-trial-handle=2000,i,5577905522722391166,12388124613605319717,262144 --variations-seed-version=20260818-090057.333000-production --mojo-platform-channel-handle=5516 /prefetch:14
        5⤵
        
        PID:2416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,16208455475150939208,9339986602354982716,524288 --field-trial-handle=2000,i,5577905522722391166,12388124613605319717,262144 --variations-seed-version=20260818-090057.333000-production --mojo-platform-channel-handle=5356 /prefetch:14
        5⤵
        
        PID:2404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Google/Chrome/User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,9704742336529960314,8857182739549310674,524288 --field-trial-handle=2000,i,5577905522722391166,12388124613605319717,262144 --variations-seed-version=20260818-090057.333000-production --mojo-platform-channel-handle=5776 /prefetch:14
        5⤵
        
        PID:5564
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:5728
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:3592

C:\Users\Admin\AppData\Local\Microsoft\Windows\bridge.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\bridge.exe
1⤵
- Executes dropped EXE
PID:1384

C:\Users\Admin\AppData\Local\Microsoft\Windows\bridge.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\bridge.exe"
1⤵
- Executes dropped EXE
PID:4728

C:\ProgramData\Microsoft\Windows\bridge.exe
C:\ProgramData\Microsoft\Windows\bridge.exe
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2628

C:\ProgramData\Microsoft\Windows\bridge.exe
"C:\ProgramData\Microsoft\Windows\bridge.exe"
1⤵
- Executes dropped EXE
PID:4172

C:\PROGRA~3\MICROS~1\Windows\bridge.exe
C:\PROGRA~3\MICROS~1\Windows\bridge.exe
1⤵
- Executes dropped EXE
PID:3192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bridge.exe

Path C:\Users\Admin\AppData\Local\Bridge\apps\app_bridge_auto\current\bridge.exe
Size 26.6MB
SHA256 e9943392bf5608e7aa5288bdcc39b56989e99af8ba4448d6f502c18f1dd371dc
MD5 5d963600864584870a38d94af38384de
SHA1 5fe40bef1da331b0f7b67523f6e934580dd03bd2
SHA512 574839f5970ae25daf95f7dd31ee0c4e27af37d36ac4e06b37e55139790cdea7737294f2015d6dc3cf409435a3384e04f915cfb1029d8d71e8fce09794b660cb
SSDEEP 196608:SbonrNJ2tNGEc4yH1uYUJB0HXZ97MM6DJMrEHrcBdoJhPaw61Vf:ScrNJ2294yVuYSu7Mx1MrELcBdoHaw
TLSH
T15F574A47F86109E5D0AED175CA269213BB713C994F3063D72B60F7642F36BE0AA7A704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 1KB
SHA256 0d923735a7c15b7f17b6d12114dc28ff6b8c8a03f86d88436edd4fc140a6308c
MD5 3231374d7e916d24414b7f92883e40a0
SHA1 d9235e0c546eb39c39fc555ee2a1e18c0c9e74bf
SHA512 701405a952ae5bb4cba19e5ca5394fdc8c49b4440d43846f18ac4eb83c31f6a82f0aae8ba32e77401c67db331ef7d798c0d876b590996cfcafc829b94795cf3b
TLSH
T1BE1157261CFBA1390C83523B952BEE8ED271752CBFC55F21A3B6C9E412E2D0DD8C6161
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 6KB
SHA256 4c3d9a935abf3ee441d6aa38fcbddedf53c04d5351ceffada1a72000ff135c32
MD5 c1cb14b1b8258bfd566acdfc814c6684
SHA1 a7c9735a31c703db448b2ec059381d1eda1e88df
SHA512 e7d82705a68cf58fe10183172e631b6e8e31d04c0400858819c69e41a374661230263ca33d9763510d89c95f2e4b1dc2d57622cd6b05e675d7044dd8cfe9f591
SSDEEP 96:oWlpOUsW4xicYLBlpmGVsBpsnMlpHFsb89UNViJs95Yml0oUeGKaSj7686MhrmnM:cZV0DF02dlf6mmnqx
TLSH
T129D1C115BCFD60374CC3022BE12BAF5EB621702EBB45DE3267F5985A76E1D0C6886251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 1KB
SHA256 3515975daccdd44d323896741ab3fea846daeb0679c3ffe53470610f31c89222
MD5 db0a9988e8b8e29efbac27d2386edc40
SHA1 cd8eb4d093e0281bd1f8380db270c3529a6388a0
SHA512 ccd57021a574291bdbdeae85fd4dfd5eab76dc909dd64d89db3de65b5598df91adda0adb6a72dff9f524fb1c9ed0b0e795d3a48158b2d2aa85f18b140bf23c4d
TLSH
T12931AC261DFA60350CC3423F952BDF8AE1B1752DFB865F21A3F7CAA452A1D0DD8C6161
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 10KB
SHA256 cb18e90aa8070ced7953b13f4059ae2cab876de8c1b854245764e1890c35cd6a
MD5 c825c391ab1bd67922317c8d2bdd3db0
SHA1 9a92770d380d2c615b2d5cfa8fee6cc66c45a792
SHA512 fa459651d33cac7508c47c1e405953cfbaea709de907a764995de0f8553ac66613df746dda3ff05ca7f216b7e34ad04309dff5357c548b415486b42705d1206e
SSDEEP 192:cZV0DF02dlf6mmnqem9fkRSq0M1ObelJ9KrINwXF:cZV0DF0WwmYqemsS+rlCHXF
TLSH
T1C9220A15BDFC64770CC3022AE06ABF4AB625703F6749DF3367F56996A2E2C0C6D86241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 10KB
SHA256 b8dcaf87ab78a0cc354a26b43d44ff76837d45dac0024e50a3381024bd61a38e
MD5 624b7ebf50ec08d0bf8b099349b20b51
SHA1 db5b8e17cd6b0410188023a8664516b779937605
SHA512 60a30053133a4f1dccb37a4ea4d94ec234793e164beb42cace4a60e7b1f6af48f195234c1d4886fee0b22ed1608eaadd6fd3498f7914362a729242a374f76ee9
SSDEEP 192:cZV0DF02dlf6mmnqem9fkRSq0M1ObelJ9KrINwXR:cZV0DF0WwmYqemsS+rlCHXR
TLSH
T171221915BDFC64770CC3022AE06ABF4AB625703E6749DE3377F56996A2E6C0C6C86241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 10KB
SHA256 87f276e7b182ed12400b53956a485b11e9f618465fdcdfe8e758ef9c205055a2
MD5 034adfcdcddf3a974f9cee884357d3ec
SHA1 391f2c33b3aa8769b5874ccfc8498cbb6688206e
SHA512 96826abeee85567fac5d02ff1a02db300d31abe9cff25dfd16288f3b81fe895a1ade0b9c5c1d975c729c71096e2d0cba985ef0720a544ebb9988709a36720724
SSDEEP 192:cZV0DF02dlf6mmnqem9fkRSq0M1ObelJ9KrINwXoF:cZV0DF0WwmYqemsS+rlCHXoF
TLSH
T1BD221A15BDFC64770CC3022AE06ABF4AB725703E6749DF3367F56996A2E6C0C6C86241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 10KB
SHA256 6a6447bcfd93b356a003944db53fe43daffc9274ff4588096c99a2061d53be67
MD5 4918f1d8519fe816787922abf0f5fe67
SHA1 964eb370970f202ac6535e9f9b74b04ed2e01747
SHA512 ec7c297e9ea06cc91afc67f9cf9df764dac03166e131f63d7a3377d2b3e1958966aed50fd50b715b5ceebd74a9dd76c11395223bfdc254ebf64876e35d2a2a3f
SSDEEP 192:cZV0DF02dlf6mmnqem9fkRSq0M1ObelJ9KrINwXoY:cZV0DF0WwmYqemsS+rlCHXoY
TLSH
T1D8221A15BDFC64770CC3022AE06ABF4AB625703E6749DF3367F56996A2E2C0C6D86241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 682B
SHA256 2467440c6a3b3aadf194525bd3aa33924597842a21240a1d9e646e71664f77c2
MD5 012c9ad78ef0901a7f10232eb0122038
SHA1 09063d4de8e31b54fb99c66472cbfeb8c096a2c5
SHA512 3ee9f9a8f7d77297ec3c46f337a96dcc27dc9958dcf750c51ba918942bf1c92b2df26e23a863813d6cc20052ccf227cd1ed59bd5ce28df3ad80e6ed17c7f4f8a
TLSH
T1B30197251CFBA0390C82427B841BEB8ED571352DFA851F2193B1C99113B1D0CC8C6021
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 2KB
SHA256 cd584c7f31d4dbe2ae8e4aaf847af00a28dd7fb7cd4ea11e92d72006ded561a6
MD5 57b4f2a276a192fdbf239d50bec8a4c4
SHA1 48886b859dfa5507d24c71d15035fed84288e920
SHA512 115e62dd755389eb0e3c8b9dd607e4aee6d36ee9ba5e0b0efe01121b5266e044ccb6d2bb883ed1022a0a0d6d1f57985e48c82fc9fbd041a3886c9e0888f2b916
TLSH
T18851BF166DFE60360CC3432FD51BEF8AF171B12DEB859F3267F389A55291D0D9886021
MD5 SHA1 SHA512 TLSH

Submit Download

root-ca.crt

Path C:\Users\Admin\AppData\Local\Bridge\root-ca.crt
Size 607B
SHA256 b6f03c47a4c482fe1c8ee5db537aafe3932fd12cab592a316b38d49be570494d
MD5 7f65f42ecfb21049f43f8d85f4a209d4
SHA1 3ef5b48b285947b308370cb4b6472dec9cdb5fc7
SHA512 e2546687c3d9d7eb83f5494b02d74e7f1115244bb5ac4eab80a7a21febf4f4e154d7706c64a5482c1be4aad67f0a8f68685618168f4567aed1979641b5504f4d
TLSH
T132F002469E7A659C41F6E1A123A52366A3C1B090A40CB0AF201F0177D717B37D8E81CE
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 b1cbe4652346e03410b2feb005c66a33e4bcfae88d94ed854baa5d423da9ede0
MD5 a156c6d19e3e8d065c7e613e9cc9c789
SHA1 f989be949fac93c8cd76e75bfe27a48d268f991c
SHA512 cb9687aa9d8fb5229a32684f95a449d0ed71966f0abfce245182bf03ec43f577f827dbc2731dd2f43a1b6e99ce8c06099f6f9a373c8a6c2f7faacee513d432e0
TLSH
T1E1B0124AC5A78CE6C4FC13CA32F179CB835E4447A9568F54B52FCC10C916C0E9A8321F
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 6c441f240370c178a8b8d00e3766afebb6a6c432599246238f8f8d62d9231b04
MD5 dfb318ce4f6471f20556dc971ce50719
SHA1 50abb0dfe2adda4fb9ed1a73c11f6d753829c8ac
SHA512 c044495622bc36fed57cc34419847d7ee7c49c3899a9cfae574aeb680ee097e07d9b211aaf0e21fe7199c3c74e7f8f8f868ef0f2ecd683ada8950485d05a9a06
TLSH
T1D2B0128AC5E74CA6C8FC53D632F179CB825E4447A95A8F54B62ECC10C516C0EAE8311F
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 aec9f8750e2d38458a568478e435d303de6ea9777c03e7cdcf70197cc0eb13ba
MD5 540faa6519ef65cb621fef3c146fae74
SHA1 94ebf34a8a46a61156b4cbba719168e5aaaba65b
SHA512 b7886e029b09a4f58fc6eb5c06c07ca6c6a777ce78301b179e3d22cc161d1f0362296456457e1134263a38dd4937e1d4dc437c9da2932e770f873bf0487c0c91
TLSH
T1B3B0124AC5A74CEAC8FC13C622F1788B815E4447A9974F94B51ACC10C556C0E9A4712F
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 0414fd95a6d6d388cb35546689465ad9960a1e5112ca522d951f40f7d2b43811
MD5 f3769c971ee287cfc239d3d18d687236
SHA1 0a352dd79f6bcaa7ba84c34d15c4f8b5c7dd18d8
SHA512 fdd3da3476e03e4d138cb7f1075f8674efd0dde14c794f3223383f45000d459658ed131d78433eb12218c4f7ea55905e32ff41d6db282c85cdb0e1e5e6912351
TLSH
T1DDB0124AC5A74CEAC4FC63C322F178CB815E4487A95A4F94F61DCD10C656C0EAE4311F
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 ec35048f5d7f0d73ad26aeed4ad99d346456ec518d6862d47035183156c980f5
MD5 a9d65c9c5307409d18c488a3d71f5182
SHA1 306ba4074162e88364bcb8a51d4b6faa00d18836
SHA512 65026b536a0986c234a7b37c0923b307d34cc14328bb61224ac8c10656b8e312f82c16c6418908bdefe7f0d81335cf51f0c137382fceef5dbb97688913cde99b
TLSH
T1C0B0924AC5A648A684E813CA62E17DCB829E4446A95A8B54A91988109616E0E9A8711E
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 4ea3ab0492fd49301e798363f99d2cc821e51b99f3e7ef1cd6a280b3aba33e16
MD5 c9a585a564a7174c4bd96d8a7cf94645
SHA1 1f054701ed565bc8f29f32a554b4ed76e1dc3e0d
SHA512 33ac3373b5030bec8e147f62cc3c0e12b162293a62e2c0002ff80baafa2b0a4c8c6d9b55bfd911e2744c34df7b28467859d78b875276a0e528d0f3247a07f21b
TLSH
T17AB0924AC5A64DA684E823D262E1788B815E4447A9964B54A55988108516C0EAA4311E
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 4178635393c3932a45c157dbbf7d9db12f1fd1ae343d5dd8405a4fd109fb7b93
MD5 904c9d0daf548afa13176a4f25928925
SHA1 8e7a6b2c07325d10f2595d668767e5f7af12a892
SHA512 fa3a58d63791895c9d2cd0f14ae0d97c41bf1f010079113eb2f5edd843d6cd7c74aee0e48655442828e62c48c484fd5332472ded7f5f30691b521fadf02c0cb8
TLSH
T1F0B0124BC9A74CAAC4FC13C222F1788B815E444FA9564F94B519CC10C516C0F9A4313F
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 fa8c2c240dd33a831f8af5b4dcbae7422608d157efcb87a7f6b3ea117ec98ba5
MD5 12f0c3af013e2c5090f5a0ebd8458c12
SHA1 e5712900995f3a601d91ce6338153a1cea314006
SHA512 687fa1dd917853a84ac0b719e87a22412f767faccc4a6e4a277339ca80b3b3c2d0f921af8f0c3d955377cae1a8daedeeb02c75b0e15146a33f28bc78ad6cbb4f
TLSH
T196B0929AC5A64CAA85E813C262E17C8B815E444AA9564B94B5198810861AC0E9A4311E
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 87ede670e387f4f157356110a3020f84b7c2e999f769dfe078f1045b5c959e5d
MD5 dcf4d4fd55bab2182f716903c13bf43a
SHA1 4e64fcedbf92efbcd7903b03b0684ed77e50666c
SHA512 6196bb8f4bbf968a5003ed9d681883ac412784907e5c4e7a9f7564face38249ff550946a924b282ad4a0484d740a90a1436895e414bc226eab5f19c47cceb335
TLSH
T1F8B0128AC9F74CB6C4FC13D322F178CB815E4487A9564F54B61ACD10C516C1E9A4312F
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 96722ab76682a4f0a233e457dbef0997aed02767dc931029fbca150116d3a63c
MD5 90b7b0ae2b3b967161678f61b762e8fd
SHA1 1188649dd3d8929314f89ea93bd064c953dea79a
SHA512 c8ab2564a696fcd732de7d04083c0911f71961622f730f54ac865bf47d38be9a7791e65f2d18f4c13267455317b882d457798e6de0e1f7db094d3c836f1f0964
TLSH
T1D7B0124AC5E74CAAD4FC13C232F178CB815FC487AA564F94B619CD10C616C0E9B4312F
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 62caf2d06a59a10727b80640d85b28bca8f0f98353c17269b1aa79944d8df760
MD5 17dbc775c2ac805a13d7a96139853f6c
SHA1 c64af967a791c9f2b2fa74eeb980d0fd7733bc97
SHA512 672c85f3987795a0e6b6ecf816536da6c3bb8548f67d404fbc894b2a51f1fa7dd4210875b51ff5205d835fe7a0ad328fb9eedf1b24b518af96aa42f5b742810a
TLSH
T1AEB0124BC5A78CB6C8FC13C2A3F17C8B815E4447A9574F68B619CC10C516C0E9A4321F
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 59100bae574479ab60f3dc05b14441fb8c55b53906afd4f806ac0597afdef971
MD5 6155fff269defca1974b9ab374f5a8a9
SHA1 96ade47f5e6291d319d913ab5de14581c92e7d29
SHA512 2b25e588ca9f9b43c8783d2f5c1a606aac411184845ed0e0b4d3762613f5b799fc7e7361f98380411290f49f1c75da83622ad443437aa3bc70ae17534b621a83
TLSH
T1E1B0124AC5A78CB7C4FC13C662F17DCF825E4447A95A8F54B529CC10C516C0E9A8711F
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 2553674c43f2f94d09f54abca23dd4490f18986a9c2f42b1dd8a73f20c70543c
MD5 ade40d176a7d486ecb4d9f4bc40893b6
SHA1 c3723cdd966fde05abe7360c20b79e077b2c9117
SHA512 b5f3c6ce8550c27894e8ef62426f33d2b970d63458b80e717920977f882230ea910c2275434e0b891ea8b085b5e9118a4bbc04ac33c40bc4703b0104032defe8
TLSH
T17FB0124AC9A74CA6C4FC13C222F1798B825E444BE9568F54B52ACC50D516C0FAA8312F
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 85f85c0edfd9967adfda62ceaf8b11d90cf74386c9fef3efe08bb3b93b341a25
MD5 a62fdef8da9114a8fa7daba09333a439
SHA1 4741fbe0e5004efd2897a2bf916bc8b81a956933
SHA512 d4d7fc762e5a5720197f1027618ccbe0eaf6c478dcf3696af408b4b756c4a5732621ca9837041a7c495612a8d5b2b0b36db66ebef24d22732c6d6cafd9f43e61
TLSH
T1C1B0124AC5E74CA6C4FC13C222F1788B825E8447A9968F54B52ACC90D616C0E9B8311F
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 825feafa8143ed48daf2d9b782e93402963ed72724a9e688f30dcff67438b815
MD5 6df403b901f86e7421bbaf7f842ac738
SHA1 f455fdc36a6f411acbe7e010b9adba013fc593ca
SHA512 87d23e8aaf4859f4282636bbc95567518a46ad7a05884686df2787276799d1c117827c80bea9e5526445df04fefea50ef1cba6f51dc02ff4fc9d7cfc0102c249
TLSH
T13BB01206E37B8CDDD5FC96DA11FA7907809F448FE9559F14B604C440C42B90ED94300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 22870fdc7d94a19cca31df75a049477eb46043e645061b7983929b1a4cba384c
MD5 590ae065130e9484e9dc881d0af2d951
SHA1 fa1046cce9b166643a79a353196d9827c45b424b
SHA512 a26af21914c2ccd9115e38558cde4ac7f2c9c0b8e34419b4fba0b9652b479f66feda51077d1fbd9ba2128fbc8e3a26f278fb63c21575c935293c5760a0d34523
TLSH
T171B01203E3BB8C9DD5FC97D621FB7906809F848FE9559F14B604C400C92B90ECA4300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 a1651a3ac32a2bb0ea3dc3fdd2c5336b0abd2f93e69ee88372f08eac91559356
MD5 b44034ea1001447401367976aacd4ac4
SHA1 386198888a025dd121fe97285e308b37c8b22a64
SHA512 368b17b02a3ab2cc37c2b1c7bbd6085dc9278e800ed861b08ac719dd209cc0af7c87bc0ee4e2a59aac7d55b2ea63762b0637710f38f08cbf5595765af24bea50
TLSH
T1E4B01202E37B8CAED5FC96D651FAB946809F404FE9599F14B504C401C42B94ED94300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 ffb764985dfc22c83e3bbf34c7ee977e6e1fb14dfaa18082420b0a3acf5f4f84
MD5 5349333654f1d2e29b0f3ace8fbfb3a2
SHA1 578c8bd7288f8523b0d8ade34559394817965285
SHA512 2abb65f73aeb61ce4a36f8b72df9a3c02152aab3d97873aa3a3f77b83412dbabdd1c05c070a44b70f7429343de89bb06505948428f04f74a00d6cc50503aa137
TLSH
T1E3B01202E37B8C9DD5FC96D611FA7906809F448FE9599F14B504C400C42B90ED94300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 58fe77a9fe74c9d26624e3589ab19084c22945dbf7130efa4c70a53fc738ef22
MD5 18606ad67c9786fe4a573d9cec95a4ef
SHA1 698cc7bbe492f7deb3639d3bfc8c35b87074eec9
SHA512 e1bd3ec7490852650275dd9401723136282da118a4eb401c6fa6db449517df9081cdbd9bd8466e3918032dbc30ffed42cecd01fcd26fe93c7a7181c7c284936e
TLSH
T1EDB09223E2AB8CA996A856D651BA6906809E404BA9569B18B504C800D42A90ACA4300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 117B
SHA256 38817434c885ef44439170362d2a058c90514f235c1c4947723a8ece08f6868b
MD5 922ada0588313154ba2dad842da4bf38
SHA1 fdfaf867f7bd61d8741c61ae2d6e6a35d1de189d
SHA512 70305a7308eda608ab54815f8ea3f212995984d6d063d59a66ec38d5bbfb45f3a5ed5701bc1404cb2ecf13e62647c42b8e9ba5148aaf8997bb3817b27049b8aa
TLSH
T1ADB01242E3AB48BC85AC26E291F4BF4280AE804EAA519F94F704C480C91680EC98300F
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 12a6e67366c6b59d99f325ec45858e93cfa705923f1b6012930414adf48ed0b2
MD5 8d37ef57519fd292befbc340157a99e9
SHA1 f13d1044cc50f9d9f796d1f0b478dda6d2c8c1f4
SHA512 428e91c0fe9d38aeb73862cd0e24fdbba96762c60ea8ef4c2418e4dd74fc9fa54a56f7036f981c1070205f6ca769a8b14d431d904ad3f8632fcb03a4cd593a37
TLSH
T177B09202E2AB8CA995A85ADA51BA6946819E414BA9659B14B514C400D82AA0BCA8701E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 7d3336b77ce0df345dcf3cba73896571c2efb080beb8563861d1431d5b679531
MD5 b14ad33ad027d416b32381897e928b96
SHA1 b5189513ddd9e62af257afbfe2b956cc93b523c7
SHA512 8ba9d62c77fb9479bd39cb9978169a75b8e5e2be16e9172c5a472c6a0fd13d684b85619e38c34f562eeaf36816355d07a949e05288b5f88769618d9fbc989ee9
TLSH
T148B0920AE36B8CA995AC56D692BA6906809E424BA9959B28B504D400C82A90AC98300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 d74898b8da715746dc27ee2552e6c90c919f46c0e1814b2e596b9ef82161bb33
MD5 d48ace84e8985b872fdd3bc7053df12d
SHA1 ba3bcb0ae8ec0649ecc55f5c8e98cb9081cf0c05
SHA512 e5ef9a1770618229b9265e8a1d8fe67f19bbaef0f7d8e3bd60cb590cc3e93cfa5c30216984f67a593c04d132e08e7d9b4ba6650a540f149fd2be4a8f2b99c921
TLSH
T1F3B09202E2BB8CADA5A856D611BA690A809E404BA9559F14B608C400C92A90ACA4300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 2621589785101a77074390caadd432dd06ddb134716bef77e4fe651e77fc8ab5
MD5 5c3a706d1150b25f0b35b1097c33d842
SHA1 2dc67b3301a6b7519d79544b88de2564563064b5
SHA512 04a4cc54de014ec64eb0d58cd08db3bc3a76d50149d1746272ea22c1036fdeb9f5961bc5a1e48e1fa4afc09756ee24382059e899fef1617df58b1729a0109241
TLSH
T12EB01202E37B8CEDD5FC96DA12FA790780AF414FE9559F24B504C400C42B90EC98300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 6d2935679c4f2bcdc2f4b4bcceb98f1ea6ba23987a9873563f029dce6e9ef898
MD5 e385b5df335a60cbe327f2bd168e9f66
SHA1 064d67a977dc1931e6894511ac26107efe0be656
SHA512 8afe46a368fa1131527e33ab45d5e75f4088fb02c2bc85888fca50f794ad9d3fb9e88308b31e46e7baf570a59ebf88a26f09c82e254541c2a1225767229943b0
TLSH
T1DDB01206E77B8C9DD5FC5EDA11FA7906809F408FE9959F14B504C801C42B90EC94301E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a46870a4f28554c5509a47642c26ea22c1a78e05fb0f2dc74fed97e95994a6d9
MD5 506af1388af22dbe29616f39ea82bc4f
SHA1 9cff40cb637867de4dc78249328adafda4abf41e
SHA512 866f5b5c612958f2c3ed7dad6f23775e511c08b2d1dea6ee850f4c0aabca1ff7f59dfdc560fb41ed601c52c6436ffef557f055f81a1bd5cd77066bfe003fe327
MD5 SHA1 SHA512

Submit Download

0b1516df-fdf9-4f83-937d-bf8cfb1b0e54.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0b1516df-fdf9-4f83-937d-bf8cfb1b0e54.tmp
Size 414B
SHA256 394017d019ad482a8c8bcfc0c757e78e8f9a2bb068f7d424095e50dfa2587588
MD5 5a05e570d1439278e51e2d5e74d348ab
SHA1 849af7bc58d3317b6acb92cf57188ea41b49476d
SHA512 68218bef084261000b1ffc77f622d64b89876a28d9510cb5a23d0b29704bd870d884b5a6001fa555975ddf3500d70f503f594fa567385aea4825d0716a61ba5e
TLSH
T1E1E0E5AADA22AC2B5CFA171C50580B81E70003572B90890A3B3C440D8FB663A45598AC
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 cbeeeb1a252defc4497e610c7308444d86ac5126d770e44b0027cfa32c130175
MD5 d9dfc2ceef77501719394734238ff102
SHA1 242b3827c29f912665ffe31caa9dc3a1adc868d4
SHA512 f3aad1d6903f72e60924bdbfdf1968c1e8c49b2462efd346b926dfbd2d8f6e03cceb448e8f97b2ae11f0626af2eb9898629c9bff6f088d5b48937dfef88417d3
TLSH
T136D08031104515CFC71409B554710DC298400C3D19306E1B55C8BC54F42BCF0FE120C2
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4cf09b1764f1dafa83f6abdd2d6737a77ffc3dd43bb669974c9d716da5ca64d8
MD5 8b403bfc5ca6ea9fe81bc4805aefcb18
SHA1 c8f3db92a52eae1b9821bf88f8ad312986729a58
SHA512 c1621ec6b1149eced3fabf6a3abe469899258170f19b0bf5bf870dd9afd14bb4ff82599496a779d3b99d8f326235cd5dd75c6c90d027ac3353e0b5966676dc98
SSDEEP 192:wR8maoUv7pAPRp2o9XxHsb+WNnYvnBP/nkwKaHEVyIsnAUge:wR8mZQAXjfwwnBHqage
TLSH
T12342A62EBE14793B6DCAD729FA217A93D7F6102161D42E84EBFC892C15DB5CC212704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a0c6edfdbd7bbbcf6322166bd09336ec6be8175bf7f87d543385a6ec6581ddb4
MD5 77932dde3cf10262e7f7a573e6bf6c11
SHA1 bce6aeecc2b077c9262c951f565f7e898dcd657a
SHA512 1dedb99e2f8aa5d7e19e568c35a742fa89b7644ab1162cfe26bf1bfbdce077a802f29c9060bec46663950b00bbce1b78ed2847bd99f924b9594f2434a820cab2
SSDEEP 192:wR8maoUv78APRp2o9XxHsb+WNnYvnIP/nkwKaHxPyIsnAUge:wR8mZQJXjfwwnIHqale
TLSH
T1FE42952EBE14793B6DCAD629FA217A93D7F6102161D42F84EBFC892C15DB5CC212704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bd33b843c20d58be760e6a0f9a59e7f300b2bab69dcf67b69e8597db541b963a
MD5 fbf2b5e555faabf4faf2f74ba3cbc4d5
SHA1 20d1c50f9e506b381f737204458342f2fb0b99dc
SHA512 f063a79885f826a66068144da2a8d3f5f4c23ae21fbc50fafca7a2b1078d3b3d8514c2553d0077d23c80983333a86fb67b1dbc5463df1cd2eaff99dc5e5268c6
SSDEEP 192:RR8macgv7HAPRp2o9XxHsb+WNnbQ0kP/nkwKaHiVyIsnAUg+aJ:RR8ml8GXjfwc0kHqaC/
TLSH
T1BA52A62EBE10693B6DDAD729FA617A93C7F6102161D42F84EBFC892C14DB5CC611B04B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 213ca5d81d9ec759c4c0500ed77dbe0bef692b47a2e6e2b195ca5f1c2941645d
MD5 8f6d6c100b227074e6ec2b36cd2c07aa
SHA1 205d56fbc95448d54ebd9413460c34fb5a6ae5c4
SHA512 11e35f29bf710e5c0866f3d4502f1e7d083e354ce5016be92814bf1e3deccb8847d81a78a3388b9f0d40bb14880df0a8d1d88eb57da2b85fab8bd43bfc616176
SSDEEP 192:RR8macyv7HAPRp2o9XxHsb+WNnbQ0kP/nkwKaHiVyIsnAUg+aJ:RR8mleGXjfwc0kHqaC/
TLSH
T11052A62DBE10693B6DDAD729FA217A93C7F6102161D42F84EBFC892C14DB5CC611B04B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 17b574b2ce321e0fe60ecd221bdce62b043033f1c74e1863848d8debe53f7332
MD5 90197a8e2f827c05daf59eab20a4f38f
SHA1 708faf09ad600591a228d5adab603d34cc792110
SHA512 ee53264193044dccf3568254aa938cfb79335c29dd25c5ec387700f58ea6a165acf80561ad82f2038fc79c19fe3e5f881b2fd13ddf042886a832e197cdfb8e6e
SSDEEP 384:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTXOD0b+ErU3SnHGSEM8m7:/d0X7KxkXqKf/pUZNCgVLH2Hfgs77O4F
TLSH
T13752F827684D9A3F0FD8D64CDC166F8FADF20156A678092497FA5D0803A97DF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c2e3a5b8ed2ab512d676ac1f7b3331868107f8669a623a83edcf9c63f260fece
MD5 80291142b0d69e3017b57ebc3d39bbc9
SHA1 3ac3207e210fcfc9a85cdffda55b5ad2deb55433
SHA512 294eaf2de31d955c09077411744b53f96738cdcae74cec8803cc180eb94ee5be6edd3d12a6e7f3af4bb91bac48f0f32d3b6292fdf843c9eb1d247254f86c2ccd
TLSH
T11AA0021343E90831CE104174A5312556274B59595A508307549259449D9F0C0C5611C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8b3a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a8b3a.TMP
Size 48B
SHA256 c34edd3b8f97e7fc8c720e111662930ec5a052b8dba2840f3ac493d42cae3ad2
MD5 90684836ef402c1903a96079e2e2db74
SHA1 3a0f15fd1c05c11a570fbdf6b0e3ac298d0165a8
SHA512 8458bb229ef4c5706ff96e6bbcc37f2fc92dbef83e953bf19e2348bf29816d261e12bdfe40cb27e6e44308517526f784f85d7670af21aa5ed56912f756dfa800
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 05533d13cc2fe85aed4755c34e53cf0853b21825b774d7b0eb55243d2b75d21c
MD5 ba0614f72f868de63d2c309f8b62f916
SHA1 45f5e7233a00de8f36dae2c5fd886f1288b22cec
SHA512 fc3b96fd1865a10d00692015e6926475293b07ea8de8da3d8bbea0b1872968a22f880d38b8e3e83794bc2f59ccb1918012b27d9e7d78736574d47164b64663f2
SSDEEP 3072:+6ioLkkOEHiSVfOhU9AWl6rArZv2mikbR82gl:+6iwfOqi+91Nd3it26
TLSH
T108D31377CC545FBD90DF6DCDB2622856C5408BAB9411839952FB2E832109BE8E323CBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ef85a4a53d41033a14872c81a0a7e08e9b9af59d950569ec759d09211e11f3c2
MD5 ab463aedb13f5dd408f0f82665132fdb
SHA1 a4b79cd842c3ad8e3184b76bc04fbfba4aace307
SHA512 1e02b5edc74bf4be06b7b719125c184e9ca4e9cd566303b79be07dea612a799b63bd4cf097745b45338db6d6bacf1826e83c5a07bae5fe23f68ceea32c41c641
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5EmDjB6nGyvn0b4T8IMybJv4a:xC0ITo+TQ0InDUDD9PPb4T8Nybl
TLSH
T19BA1F935A0284DB75476D44AF1626A43CFB9B067E972AFD0EADD0E0D15F70EC1342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 1fc9f94e24a9c0abc6ad8ee009a1edfed2ba7b6e6e8751e80ca78b625a1c38dd
MD5 b50e5730ee866437329a866dd41c0d69
SHA1 f68c1cc89caf03cc4a26820ef449a3fcd6c7d7b3
SHA512 7231dd9e51df4a139454f7dee8d8c233f354037b90475fa19231241dd58ca699c4309ffdcbcd57a39dc3c66849c3c23b67934a51ebea3766f276842873ff7a60
SSDEEP 3072:8aioLkkOEHiSVfOhU9AWl6rArZv2mikbR82gl:8aiwfOqi+91Nd3it26
TLSH
T12CD31377CC545FBD90DF6DCDB2622856C5408BAB9411939952FB2E832109BE8E323CBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 a3432abcf3f89c95a5347c3c6c0461af5a659a4338380e293daf70204877be2f
MD5 2799587a159977797f0f5f6f9dfdebd5
SHA1 9e7072557f3f5b81934d3e69365fc9431a662f4b
SHA512 15a73421ce8414f824e059ef512a20d7e07c84f0c6e10ec4d6779486dab3e76d29231c4f858daf4162b31f898359b66a612732e28faaed07047e85bc46e06929
SSDEEP 3072:UcioLkkOEHiSVfOhU9AWl6rArZv2mikbR82gO:UciwfOqi+91Nd3it23
TLSH
T170D31277CC546F79909F7DCEF2622856C9508BAB9411839942FB2F8721097E4E323CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 c99a75ead27812f48e0954a274aaa595ec407dcad29a54347f72547acfaff825
MD5 bb6e810644f1188031597b53f4d1f5b1
SHA1 8b887a5916d8d3fc29bd4755ff80456404dd3368
SHA512 3794354a09a238d93a73bbff75c6ae25eb181a4edf5d9976c89caff0fcf5ae29c97408c62b9446930ccf58716ea6d57833203f3240ed9fed950aaaae222b36b1
SSDEEP 3072:PcioLkkOEHiSVfOhU9AWl6rArZv2mikbR82gO:PciwfOqi+91Nd3it23
TLSH
T147D31277CC546F79909F7DCEF2622856C9508BAB9011879542FB2F8721097E8E323CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 0a378a620c3116db95f58378edf52f7b90dfe8cad401cefe6b1470bfdb01c8b8
MD5 e9565f431b859425be7f03bd4289d88a
SHA1 5167f58bc217ad7fbb3ad74ee4585bb36479dc98
SHA512 bec36a723b73bc11d5c2f36404d9d8264aea7bbca16f17e35b4c7ccd73879842800a1737cb29f6637fec078883548a3d475e5c8668792be08b3889c7c533901c
SSDEEP 3072:X9ioLkkOEHiSVfOhU9AWl6rArZv2mikbR82gO:X9iwfOqi+91Nd3it23
TLSH
T1E8D31277CC546F79909F7DCEF2622856C9508BAB9010879542FB2F8721097E8E323CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ac3ca3449026422292f58255350cbd51457b29a2720ccaa574ca3adf4b1fc784
MD5 162f83c55c02a7d64ef993263f22a134
SHA1 2c824a4fc873eabc0753f8d7f6c9ee628aa8cd82
SHA512 525842b7c591ec0b17a0da62db3b2acf41c192df3e41e2633cbdacb3dac9fb514a8e6f8a1b615b66ca639afc35a289aaf4d7447d569cda50ec2203ed1383c031
TLSH
T16E31CF2BB3DC8596C899403620CDA85032BA87DB819F9FE77B80D145F43F389CE64794
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cdc8087ef29fde50ed7ae18b07158a083adc9a7cfc1bda452e9136cd8a255b96
MD5 88671009c51ff5bbe064ca6d4645bac1
SHA1 2c35d5837c2c4d5650a986180b9319a094c91dd4
SHA512 6489e9d58b38e66d29865ef27818ad243f35f55687799b0e86d8da8ec5e312cbc92bf81281ff624215262dd6901b6686241daa442f5c78e15c2adb4dd009dbfd
TLSH
T12B117D33F3CC8714DC5A403650CEEC1036B6C7DB409ECE5B6B84D544B42F199CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

BridgeAgent.exe

Path C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
Size 5.5MB
SHA256 6aba832d095cf90906b34335f698bee1debe024ce3422375ee9394aea94dc934
MD5 6699cdad824d4e21964db174cb9622d2
SHA1 6d8bf8874c0ac7dddc63370689cab279f92c9d3e
SHA512 35a83d06e9e66675ca46c3a743ac7b3d3673fea95ca3640556484098c913ed099b5ef18552c5f902352bee77e86e9ea3a851d76d54353453ec7af4dff6e1c028
SSDEEP 98304:NjbltFqoOFYQlOdda0WH8JvwvRhCYAvX:3dG/
TLSH
T182464C05BA6B94ACD15BC47483068A639E2170DF1B36BAFF018486783F6ABF15B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_egyi3xi5.wzm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_egyi3xi5.wzm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1652_991800208\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1384-264-0x00007FF7D9590000-0x00007FF7DB08A000-memory.dmp

Download

memory/2996-312-0x00007FF791FE0000-0x00007FF793ADA000-memory.dmp

Download

memory/3192-322-0x00007FF791FE0000-0x00007FF793ADA000-memory.dmp

Download

memory/4064-104-0x00000264EC7E0000-0x00000264EC7FE000-memory.dmp

Download

memory/4064-97-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-111-0x00000264ECCF0000-0x00000264ECEB2000-memory.dmp

Download

memory/4064-110-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-89-0x00007FF9027EF000-0x00007FF9027F0000-memory.dmp

Download

memory/4064-109-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-108-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-114-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-107-0x00000264ECB40000-0x00000264ECB5E000-memory.dmp

Download

memory/4064-106-0x00000264EC8C0000-0x00000264EC8CA000-memory.dmp

Download

memory/4064-92-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-105-0x00000264EC800000-0x00000264EC8B2000-memory.dmp

Download

memory/4064-101-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-93-0x00000264EC580000-0x00000264EC5A2000-memory.dmp

Download

memory/4064-100-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-99-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-98-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-112-0x00000264ED3F0000-0x00000264ED918000-memory.dmp

Download

memory/4064-94-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-96-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4064-95-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/4172-321-0x00007FF791FE0000-0x00007FF793ADA000-memory.dmp

Download

memory/4332-1003-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-374-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-1110-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-329-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-968-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-979-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-752-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-849-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-864-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-315-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-1030-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-908-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4332-1097-0x00007FF67CC40000-0x00007FF67E73A000-memory.dmp

Download

memory/4728-304-0x00007FF7D9590000-0x00007FF7DB08A000-memory.dmp

Download