Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 17:44

General

  • Target
    2026-08-18_6a2ab99a8ca1b02415d13b7cb0881020_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  • Size 5.9MB
  • Sample260818-wa727seq6s
  • SHA256 dadf5336ecd933e2318d4fa52bb94337b711df00cd46b95d4bf088e03d0f9cdb
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_6a2ab99a8ca1b02415d13b7cb0881020_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-18_6a2ab99a8ca1b02415d13b7cb0881020_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Windows\system32\reg.exe
      "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:712
    • C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
      "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4744
      • C:\Windows\system32\reg.exe
        "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:4360
      • C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
        "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 4744
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1948
        • C:\Windows\system32\hostname.exe
          "hostname.exe"
          4⤵
            PID:3432
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -NoLogo -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue'; $exe=$env:BRIDGE_TRUST_EXE; $sig=Get-AuthenticodeSignature -LiteralPath $exe; $sigStatus=if($sig){[string]$sig.Status}else{'Unknown'}; $publisher=if($sig -and $sig.SignerCertificate){[string]$sig.SignerCertificate.Subject}else{''}; $mp=Get-MpComputerStatus; $tamper=if($null -ne $mp -and $null -ne $mp.IsTamperProtected){if([bool]$mp.IsTamperProtected){'Enabled'}else{'Disabled'}}else{'Unknown'}; $source='Local'; if(Test-Path 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender'){$source='MDM'}elseif(Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'){$source='Group Policy'}; $onboard=(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' -Name OnboardingState -ErrorAction SilentlyContinue).OnboardingState; if($onboard -eq 1 -and $source -eq 'Local'){$source='Defender for Endpoint'}; $detection='Unknown'; if(Get-Command Get-MpThreatDetection -ErrorAction SilentlyContinue){$matches=@(Get-MpThreatDetection | Where-Object { (($_.Resources | Out-String) -like ('*'+$exe+'*')) });$detection=if($matches.Count -gt 0){'Detection observed'}else{'None observed'}}; [ordered]@{signature_status=$sigStatus;publisher=$publisher;tamper_protection=$tamper;management_source=$source;defender_detection=$detection}|ConvertTo-Json -Compress"
            4⤵
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5844
          • C:\Windows\system32\hostname.exe
            "hostname.exe"
            4⤵
              PID:5944
            • C:\Windows\system32\hostname.exe
              "hostname.exe"
              4⤵
                PID:4068
              • C:\Windows\system32\reg.exe
                "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
                4⤵
                • Adds Run key to start application
                • Modifies registry key
                PID:4792
              • C:\Windows\system32\hostname.exe
                "hostname.exe"
                4⤵
                  PID:2336
                • C:\Windows\system32\hostname.exe
                  "hostname.exe"
                  4⤵
                    PID:3436
                  • C:\Windows\system32\hostname.exe
                    "hostname.exe"
                    4⤵
                      PID:1620
                    • C:\Windows\system32\hostname.exe
                      "hostname.exe"
                      4⤵
                        PID:5380
                      • C:\Windows\system32\hostname.exe
                        "hostname.exe"
                        4⤵
                          PID:5720
                        • C:\Windows\system32\hostname.exe
                          "hostname.exe"
                          4⤵
                            PID:4052
                          • C:\Windows\system32\hostname.exe
                            "hostname.exe"
                            4⤵
                              PID:960
                            • C:\Windows\system32\hostname.exe
                              "hostname.exe"
                              4⤵
                                PID:5920
                              • C:\Windows\system32\hostname.exe
                                "hostname.exe"
                                4⤵
                                  PID:1556

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                bridge-agent.log

                                • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
                                • Size 4KB
                                • SHA256 27281236ebce4a520626bba3cc9ba1dd8150e7ff8c5ad3377f1ad352dea90c1d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                bridge-agent.log

                                • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
                                • Size 1KB
                                • SHA256 f158033185b91a71d79af9f3b699fc4111aed79ca7bbed5dd91fa26d25fcc7a3
                                • MD5 SHA1 SHA512 TLSH

                                bridge-agent.log

                                • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
                                • Size 1KB
                                • SHA256 4e34a1f8a5c1f3075838e6957211b725287585a0561b11c21700011dd459f25f
                                • MD5 SHA1 SHA512 TLSH

                                bridge-agent.log

                                • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
                                • Size 1KB
                                • SHA256 e491be97681d7de0daa362349445a26aacf425797d298d602bc85cdc98d997b4
                                • MD5 SHA1 SHA512 TLSH

                                bridge-agent.log

                                • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
                                • Size 2KB
                                • SHA256 0861b3bf7410f4aeb6a454cf91ca9d56d5a2b217c08bbae4ff37f7ef6643847e
                                • MD5 SHA1 SHA512 TLSH

                                bridge-agent.log

                                • Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
                                • Size 2KB
                                • SHA256 4d84cd6ec57f1003d70a19101788398c4b30e2d4b7c9ec9457f058e906c2a21c
                                • MD5 SHA1 SHA512 TLSH

                                root-ca.crt

                                • Path C:\Users\Admin\AppData\Local\Bridge\root-ca.crt
                                • Size 607B
                                • SHA256 ed55debc90067da4865114e7411471c0d95cba935b8b16b451643fd99d184660
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 fee1418d40b6545d31351ea09f630703ca8f65026a43f310d4ac9b884adca37b
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 8686a82d20a39645cd1beb9dc2092b2ab8749dd527a0c7f9b109fc14a1fad621
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 77c0f33e852494cbf720709048ad166375d8f4ea4f12126de6357d8da051e2da
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 385becdbc25c941fdf040855fe2dfcb744096a18a9f4b58eb36fdb838f610650
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 d294f31ffd836b148f460ae5c3d9856929286a89bde2872a366619a7ea0e1945
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 5d8b56b4e8aaf48930df5748080d7d7da42378aff3d000fc4831330c4a112f8a
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 6bde71216a24d4278e86cfdc17b37f009c3ed5d0acd5b9cf9e01eb5358233095
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 27d5a273efb69259c14fbc016531ce416ef43da8b11fe07e1d3b4402d84dd14c
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 c59e9f4a4587007692ab77d486aee1a43eeac20382e58766559f2dbf94bccc60
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 5e5a28531ef3522767805210d7b9861323c38b3e1804442730096b1f73874656
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 019478bbebb3998652950855217358940b1dcd2746cf245f89a2c012ced7d2c4
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 50284ecc3eae23b11472ff4d7c66dc032f6f2ccac3738a362f0f98b8b4b8b2bb
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 fb735bdf0ac2ac748abc1f4cadb5c65e1137242b7d6286edd76221c3628d92ce
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 d19b092f227feefcb047f4d9d1e1fab023b2e3fcddfa1a6deb17caafe0244a1e
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 6165c2cf4dfbab0e08c041dab65223ca0a837ea31d9efe5b59caa309d217ed7a
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 b57b42c09156b7745b5daa61a6b8fe8e74407325b13438cd52d2222d83c39236
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 458b2b1f7af982366e260e54c32e0fad2d7adc6aea19b43fb5eca96d9e9fc3fb
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 a33ae3614931a12e743e0bc69f2297621f496663fbba9e509e493a8fd1b52f10
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 3f94eebc7745877979959e866815b61d64bb3e86bc5c0b3c9d2cd74dda00a369
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 77054d95143ae23942317f7dd77d5bca721dd539b5137ff4bf38600d771cc751
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 2ced4614af01f4bf67e304f0dbe82fd3c75222086cbf6efd75f26d348b8dfc61
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 b592348d848378cf2f8e2d6fd2819d4e95bf542fbf9f273f60903fa0ebe6e96a
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 c6bf1e17573367dbb037022a69bfa2ac0221a1065257f084a50c253e16202908
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 127577b77fbcee6a0c7d0bcdb12ff4f2d07d9fde91c6d9ec5843e93273e81d63
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 f222dc88fcd9bea4dacfa4b6cab7973adabe1abb11bf62ecc0262467a63a143d
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 ac20e5530f155f0633c815935c866898f27df0ad856478e6195bc9f854f0f67f
                                • MD5 SHA1 SHA512 TLSH

                                runtime.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
                                • Size 120B
                                • SHA256 59ff2f58e1f654be264e976b21c4e598a7652a4a734d053ef9d65f725942e06b
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 4d41227a2445b0a9f48616a1218dda6fad5849daf0cfd8070306c0b9eb0043fe
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 922007698d715754103810afefbc1531d3d26b24b4ec3bfb4a08e9b2649ea549
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 fb66eb47266f6930bec7bcc6d974c2784e5f874cca91cbf2c733b8fa186a9bdd
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 843c1234e31a74afdf394547dbed74d47de407d38852d5352560fd6dd6d37e35
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 fd38af7b8971c6a5450a21b2d17ccc214d756ef8cbac9eed8fa00d0eb288dca0
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 3ef351fc01e2ca0178c20b8493c0f5c8180ac093076edbf38e9f55a4d2e9b311
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 126b99633829e75b6601e272de3826e908509f436f35198958f4cd41898043aa
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 57772a7cf2e8ad89e3c018264a860397fe9445c4b8691a700fe8e7a79c092997
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 d3a73c180a51df1b59d8d9f3867d8e3f518f6c03e5720f6ba79ce5d08e98e8a1
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 b1fb1c15f3977764702c4b5b11324f3c16e796ec20eba48a6cf632291d2dcbe1
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 eb210e0535c03ae393503edb578d20db98eb77ab3c7ef89fcacffa36596040f8
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 c890190a7825b0e711c4f735fb5277023a21d0a35f585bf32546ac09faadcd22
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 244b9e9277b2ac9c7e0e6731ca85c3c5c1617e1e5827da55aa0955732804d479
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 5a6f2f1b65e1d6c7bdb6bfe87c0bb9fe44b278816f32c41ec5ee96eeff5a62c2
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 efdc09dd06a88db31fbf29c4f79de7e3a1cfec7092b7e6d8fb2835550ff0278e
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 de7e4b24cfe80509cd223c0eb43f7ff68773545f148858c7a007091e82effbf5
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 90859dbe09a0d3e0c2382273cfae1b720e999e1fe5acb430981ee467e07577d2
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 674b4bb9f95b1fa746537448e24aff694cf374db3302cce72ffd2e31dbfa3bf1
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 f60e5138c7560afba17f3dee15c0dcf142fc167c1198a897f2d4787d906b2d43
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 3f5d915ec4d91de6c6c911fcf092747fac6b7d0c2c57b462b2fb4d198d65e07c
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 b9a0e366669d7e5371a02b1aff66957a9dbebac6463fb67227f17ef511f44e31
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 ab0ebcd717aa9bdebfff4769d9b73d24cc488152fc65aa53b4d4c711ef556d64
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 52b311cdb792ba6ab3b963ef1ce91e64625e0bb1c38dc3fdd1473de991d08df5
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 85aeaaf6dfa73718fdb84e3b5b81dbffcfd5d19fdb160f387e5e6db4133b0607
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 f990fc52dde971ad108a1c211c85ccc9351e6f9ba7becd13bdbcf51befdf6f51
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 e2efee4a15315bae372021891d88c0bd7916c02a42d606af5362fc8847c3d37b
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 1ca44b48c1a16cf19d3907c33487e94652648a72a926d5f3845d0ec45cd0f8bf
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 38ec62ac4b503f272b7f876d5f5d3fd31a52507846a35dc48e90ae2b4eb46648
                                • MD5 SHA1 SHA512 TLSH

                                supervisor.heartbeat.json

                                • Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
                                • Size 123B
                                • SHA256 8735aafc794e2efe6355b19f156f4d3110346341bc82fa487996388422313a17
                                • MD5 SHA1 SHA512 TLSH

                                BridgeAgent.exe

                                • Path C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
                                • Size 5.9MB
                                • SHA256 dadf5336ecd933e2318d4fa52bb94337b711df00cd46b95d4bf088e03d0f9cdb
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                memory/5844-94-0x000001EA7DD30000-0x000001EA7DD3A000-memory.dmp

                                memory/5844-95-0x000001EA7DDA0000-0x000001EA7DDBE000-memory.dmp

                                memory/5844-92-0x000001EA184D0000-0x000001EA184EE000-memory.dmp

                                memory/5844-96-0x000001EA7FCA0000-0x000001EA7FE62000-memory.dmp

                                memory/5844-93-0x000001EA18780000-0x000001EA18832000-memory.dmp

                                memory/5844-87-0x000001EA7DD50000-0x000001EA7DD72000-memory.dmp

                                memory/5844-97-0x000001EA18FC0000-0x000001EA194E8000-memory.dmp