bridgeagent | d39be9b1c8bdca49b3d814849ae507df280c6fe967e5c08fadfdc81d6f2f1cbc

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 12.0MB
Sample261002-148caawv8m
SHA256 d39be9b1c8bdca49b3d814849ae507df280c6fe967e5c08fadfdc81d6f2f1cbc
MD5 06d5333f7d48aede561155bc021ebadd
SHA1 b64bc5e7c9b85a2415866a9ad058dbeef93df01d
SHA512 7a013196c12befea39c0f75f130f1540c390b64671ee550990e6737c4886d75389593f8631648a63f4cee195490d293613f8d6b04d4667c1682b8ef1373878bd
SSDEEP 6144:Y0D2u8nLpFNNvvDqz3blJYZYE1jm1euRQzJpGKAx0:uu+K30ZYAmvKF
TLSH
T110C69D19FBA914F9E177C17CC9530905EA72BC460761ABCF23A05AA61F236E09E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution bridgeagent loader persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

bridgeagent

93.152.212.127

Signatures

Family: BridgeAgent,ShadowHVNC
BridgeAgent aka ShadowHVNC is a Windows backdoor and loader written in Rust.
backdoor loader bridgeagent

Detects BridgeAgent aka ShadowHVNC loader 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c5cf-107.dat	family_bridgeagent

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3552	powershell.exe
1600	powershell.exe
1116	powershell.exe
3040	powershell.exe
4636	powershell.exe
1268	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
8	4272	file.exe
9	4272	file.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\gthh\dwm.exe	dwm.exe

Executes dropped EXE 6 IoCs

pid	Process
2044	dwm.exe
5188	BridgeAgent.exe
4300	BridgeAgent.exe
5424	Service.exe
960	helper.exe
1336	lss.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3672	tasklist.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	file.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1268	powershell.exe
5740	netsh.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3360	ipconfig.exe
2808	ipconfig.exe
3184	ipconfig.exe
4124	ipconfig.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
468	reg.exe
5636	reg.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3552	powershell.exe
3552	powershell.exe
1600	powershell.exe
1600	powershell.exe
1116	powershell.exe
1116	powershell.exe
3040	powershell.exe
3040	powershell.exe
1336	lss.exe
1336	lss.exe
4636	powershell.exe
4636	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
4636	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeIncreaseQuotaPrivilege	3552	powershell.exe
Token: SeSecurityPrivilege	3552	powershell.exe
Token: SeTakeOwnershipPrivilege	3552	powershell.exe
Token: SeLoadDriverPrivilege	3552	powershell.exe
Token: SeSystemProfilePrivilege	3552	powershell.exe
Token: SeSystemtimePrivilege	3552	powershell.exe
Token: SeProfSingleProcessPrivilege	3552	powershell.exe
Token: SeIncBasePriorityPrivilege	3552	powershell.exe
Token: SeCreatePagefilePrivilege	3552	powershell.exe
Token: SeBackupPrivilege	3552	powershell.exe
Token: SeRestorePrivilege	3552	powershell.exe
Token: SeShutdownPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeSystemEnvironmentPrivilege	3552	powershell.exe
Token: SeRemoteShutdownPrivilege	3552	powershell.exe
Token: SeUndockPrivilege	3552	powershell.exe
Token: SeManageVolumePrivilege	3552	powershell.exe
Token: 33	3552	powershell.exe
Token: 34	3552	powershell.exe
Token: 35	3552	powershell.exe
Token: 36	3552	powershell.exe
Token: SeIncreaseQuotaPrivilege	3552	powershell.exe
Token: SeSecurityPrivilege	3552	powershell.exe
Token: SeTakeOwnershipPrivilege	3552	powershell.exe
Token: SeLoadDriverPrivilege	3552	powershell.exe
Token: SeSystemProfilePrivilege	3552	powershell.exe
Token: SeSystemtimePrivilege	3552	powershell.exe
Token: SeProfSingleProcessPrivilege	3552	powershell.exe
Token: SeIncBasePriorityPrivilege	3552	powershell.exe
Token: SeCreatePagefilePrivilege	3552	powershell.exe
Token: SeBackupPrivilege	3552	powershell.exe
Token: SeRestorePrivilege	3552	powershell.exe
Token: SeShutdownPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeSystemEnvironmentPrivilege	3552	powershell.exe
Token: SeRemoteShutdownPrivilege	3552	powershell.exe
Token: SeUndockPrivilege	3552	powershell.exe
Token: SeManageVolumePrivilege	3552	powershell.exe
Token: 33	3552	powershell.exe
Token: 34	3552	powershell.exe
Token: 35	3552	powershell.exe
Token: 36	3552	powershell.exe
Token: SeIncreaseQuotaPrivilege	3552	powershell.exe
Token: SeSecurityPrivilege	3552	powershell.exe
Token: SeTakeOwnershipPrivilege	3552	powershell.exe
Token: SeLoadDriverPrivilege	3552	powershell.exe
Token: SeSystemProfilePrivilege	3552	powershell.exe
Token: SeSystemtimePrivilege	3552	powershell.exe
Token: SeProfSingleProcessPrivilege	3552	powershell.exe
Token: SeIncBasePriorityPrivilege	3552	powershell.exe
Token: SeCreatePagefilePrivilege	3552	powershell.exe
Token: SeBackupPrivilege	3552	powershell.exe
Token: SeRestorePrivilege	3552	powershell.exe
Token: SeShutdownPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeSystemEnvironmentPrivilege	3552	powershell.exe
Token: SeRemoteShutdownPrivilege	3552	powershell.exe
Token: SeUndockPrivilege	3552	powershell.exe
Token: SeManageVolumePrivilege	3552	powershell.exe
Token: 33	3552	powershell.exe
Token: 34	3552	powershell.exe
Token: 35	3552	powershell.exe
Token: 36	3552	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3552	4272	file.exe	89
PID 4272 wrote to memory of 1600	4272	file.exe	92
PID 4272 wrote to memory of 1116	4272	file.exe	95
PID 4272 wrote to memory of 3040	4272	file.exe	97
PID 4272 wrote to memory of 2044	4272	file.exe	99
PID 2044 wrote to memory of 468	2044	dwm.exe	100
PID 2044 wrote to memory of 5188	2044	dwm.exe	102
PID 5188 wrote to memory of 5636	5188	BridgeAgent.exe	103
PID 5188 wrote to memory of 4300	5188	BridgeAgent.exe	105
PID 4272 wrote to memory of 5424	4272	file.exe	106
PID 5424 wrote to memory of 3360	5424	Service.exe	107
PID 5424 wrote to memory of 960	5424	Service.exe	109
PID 5424 wrote to memory of 1336	5424	Service.exe	111
PID 5424 wrote to memory of 4196	5424	Service.exe	112
PID 5424 wrote to memory of 1268	5424	Service.exe	113
PID 5424 wrote to memory of 4636	5424	Service.exe	114
PID 5424 wrote to memory of 3672	5424	Service.exe	115
PID 1268 wrote to memory of 5740	1268	powershell.exe	122
PID 960 wrote to memory of 1968	960	helper.exe	123
PID 960 wrote to memory of 1968	960	helper.exe	123
PID 960 wrote to memory of 1992	960	helper.exe	126
PID 960 wrote to memory of 1992	960	helper.exe	126
PID 5424 wrote to memory of 2808	5424	Service.exe	127
PID 5424 wrote to memory of 3184	5424	Service.exe	129
PID 5424 wrote to memory of 4124	5424	Service.exe	131

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\gthh\add_excl.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$p = Get-MpPreference; if ($p.ExclusionPath -contains 'C:\Users\Admin\AppData\Local\gthh') { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$p = Get-MpPreference; if ($p.ExclusionPath -contains 'C:\Users') { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$p = Get-MpPreference; if ($p.ExclusionPath -contains 'C:\ProgramData') { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:3040
- C:\Users\Admin\AppData\Local\gthh\dwm.exe
  "C:\Users\Admin\AppData\Local\gthh\dwm.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\system32\reg.exe
    "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:468
- - C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
    "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Windows\system32\reg.exe
      "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5636
  - - C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
      "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 5188
      4⤵
      Executes dropped EXE
      PID:4300
- C:\Users\Admin\AppData\Local\gthh\Service.exe
  "C:\Users\Admin\AppData\Local\gthh\Service.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\system32\ipconfig.exe
    "ipconfig" /all
    3⤵
    - Gathers network information
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\rxinj_1790979254462098600\helper.exe
    "C:\Users\Admin\AppData\Local\Temp\rxinj_1790979254462098600\helper.exe" -f all
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1992
- - C:\Users\Admin\AppData\Local\Temp\rxlss_1790979254473095300\lss.exe
    "C:\Users\Admin\AppData\Local\Temp\rxlss_1790979254473095300\lss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1336
- - C:\Windows\system32\whoami.exe
    "whoami" /groups
    3⤵
    PID:4196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "netsh wlan show profiles"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:4636
- - C:\Windows\system32\tasklist.exe
    "tasklist"
    3⤵
    - Discovers running processes
    PID:3672
- - C:\Windows\system32\ipconfig.exe
    "ipconfig" /all
    3⤵
    - Gathers network information
    PID:2808
- - C:\Windows\system32\ipconfig.exe
    "ipconfig" /all
    3⤵
    - Gathers network information
    PID:3184
- - C:\Windows\system32\ipconfig.exe
    "ipconfig" /all
    3⤵
    - Gathers network information
    PID:4124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.db

Path C:\Users\Admin\AppData\Local\Bridge\agent.db
Size 60KB
SHA256 529ac8c9fac3c2f02aa1d3b6fa5a851104aee58e33ff44ec04c8d9275fb4f5bb
MD5 c9f5f10e2b61ea423bfcfcea34711668
SHA1 36ea88832b69d4338c81b0d40586fb4640d2b296
SHA512 622ee54727ca243df1df43fd93e12f7cfa6fc8d2ef6512825b02f6a23de0382e676ff9a10862162ae2d48db4d28093b1524f558fcba39697dce6ab1164abea40
SSDEEP 48:TaFI/Esgnr+AiCZzkH96ltr+L7PrP+7vm6prQAVWx2LfCAtd+STeP:2oQiA296ltiLfMppFVWWCsd
TLSH
T1CE53DDDEFF197321CAE601B7E2C106312CBD1F5E4747B6C0BBE910E6A68B602543D85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 311B
SHA256 5e3e4937bc44fef92d281a8a215cea1be6c85a28f1998d98ba0d902dcc982a83
MD5 052e36e1892cc81b841000d399cf5f2b
SHA1 53290a4d1bddf8438faef10038c2615509bc2456
SHA512 4d0772f5b2abdea514dc5638f87b1d31cc72392925a134108e743274e0593b836934b64e9a8ffe89db205c41d0b7168761539df995477c4b1f27a1a7c921d56a
TLSH
T139E0267025ADE0773454032A61382ECE967291F50921998C2654F7162E88C1CEF44406
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 661B
SHA256 768d1be5377da2ba6498b92f246a9fb37c5ba9df3d1ffc4520913b52fbac8bb4
MD5 3f1bc68d04cfacff02e8a1efd0dff86f
SHA1 85b50f43866a6fe44eacd32a860fb9233deb16a9
SHA512 3dd9b066fdb7d0615417278df616460fe456648b9fe2e2bf08f7741507fa1ea66bb2c338d3411d8595b850091ef8d880092148f0533b00011a9880d51eb42f65
TLSH
T1FC017B2425FDC0763494032B153E6DCDE6B2A0ED5D756A8C9324F2155F84D1DEFC1016
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 998B
SHA256 cc317ea4b9b489550d75ce26f0cedffc989ccb63871c7d7bb0804f065c61ef7f
MD5 18845d51fd3387cc3a2907c123e76b26
SHA1 02746373d46ccbe1b189ae1435573bd6d73353dc
SHA512 6c635d60852262975406191d42cba82e9cb2dd8f56a38e4341d10cb86e0b659d6383250463e701f350e4d3ca613555554e2897913d459b76e17bba41b9472ce0
TLSH
T15B11AF2419FEC0B63454432F153E6DC9D6B290EC2D756A4C9339F2185F85E1DEFC1056
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 1KB
SHA256 a6be5abd3a965766ef4c7c311dcd499fb069aa3a21e7a9f74cee73c377a14eaf
MD5 a0a3fe01d14a24af1cf7854f875f6939
SHA1 d620b2b1d89d195822543efa6b61edcf9a44abeb
SHA512 e78b6ac77e743e8e88e6f2c5ca50bf90bba115be624ae4aed03a90b44fd7397437a6cd6bff5b0c58cca45535f886fd46661edb2992f64ced63b7a613365e4770
TLSH
T11721C02419FDC0B63444432F153E6DC9E6B2A0EC2D755A4C533AF3145B89E1DEFC5052
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 1KB
SHA256 590b21e841d84a787c2d609374ead2c818738f81ca8ba161973f84b0937dfb47
MD5 6ae88e5971b2636a574ce45f60269ae0
SHA1 a10d3e368f3e95c9b4a3daf0f02383d81cb5ec1c
SHA512 7284390c31efec67daf27500a882baf5a719d7dc2145c4e79c27664e4d22b894e257ad21adfede602cb86dd7757762ab6cc009435e1d87a9c947c965cce4e085
TLSH
T1C631892019FDC0763894032F153E6DC9E672A0EC29755A4CA33AF3156B89E1DEEC5056
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 1KB
SHA256 d2d1ed28aff0e9ae9484531bc1aba94dd47eb9718750e4f1aa9e3d262f369515
MD5 ba5f8604de7672c59336e6dbdf529a6b
SHA1 f55d0110411ea780a6c300c642a266d3f6da289b
SHA512 62f9789fbdfc54e68a1ee98afc5fde86d1fbc2925275dc849fe7fff81ff65182815c0fbd5dad59fea1bdf15711e9334ef65e97b6ee385e37e9b32031e86a870e
TLSH
T14231EC2019FDC0763884032F253E6DC9E672A0FC29751A4CA32AF3245B88D1DEFC5096
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 2KB
SHA256 a80469832215ec8c8759915781ea797144d4f1b23706a55ab76ead73f1465b67
MD5 da25a20131222af4a0ff885dbe44de69
SHA1 16b740b5a5ba5c3a5c1d1cf1807789b61c13056d
SHA512 755cd038ef81ac7b389c8d7cf7302bd91ffeb4b052471d6856c5bacb68b038affe25e57d7618e0fce456fba0bbcb1fce896638e5efae3445b3436925eb342df2
TLSH
T13651B7242AFDC0363850032F253D6ECAE772E0FD19755A8C672AF2259B88D5DEFC5096
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 3KB
SHA256 6d588d796edec39950af449f4c5ed49d1302c1b8a65334a322289dd9e3156a39
MD5 836d71c33ab2e66cb29edf8ea0c81bec
SHA1 bf4bb7f29200385ba3249ff0bc14bd8f6d2dfb92
SHA512 73481772edef464ddd637e0b5eb08388b686b83b098191b4f9d3c00d6198399a3790c891e530b8edd85ee19dccaa46888b51aceadabd2e882fbc7e88e1e9e35d
TLSH
T1DF51A8242AFEC0373450032E147D6ECAE7B2F0FD19755A8C672AF2255B88C6DEF850A5
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 3KB
SHA256 a88eeee275e5326cf1642d8bf12211fa1bc3ee8e00eae48e1edd24d0c4d6ec85
MD5 775c64fdf44015c0af813329f27d3caf
SHA1 00e71330bef6ecf113339f86c491c932678e9c86
SHA512 1a8d385fcecd82302de9f3687fedda67e06893e0d73128626aa828e695fb231881ee7485c4c15010335168eeb9c167ea392de1bf27034bd2bc47d06707b1147f
TLSH
T11571DA602AFED0373450032E157D6ECAA372F0FD19755A8CA72AF3255B88C6CEF850A5
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 3KB
SHA256 6ed58d4ce795b59314fa43aefad13eb9e8060bb91aded22c940baac748f0a599
MD5 827456ede9e147c151f35a7b7514be09
SHA1 d0106b1357a58b9d1ef5e53799e9f06127d5c3ef
SHA512 e6dbdcbc3eca763c19e81b7ffd81ddfe54a8de8ed76bd8b1232d511aa01d8e2db03b818763d4d1642dafe23af54d21f76ab5924eac0fc345d99683ef34b26f12
TLSH
T13D81AA542AFED0373451031E147C6EDAA372F0FE19715A8C672AF3285B88CACDF850A5
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 4KB
SHA256 e9a0787f291fe68ca6100fb4556cb57e6da3e6bac03311cd2f06966da0a89b17
MD5 15785b02c660ee8dafdc8768b19cec74
SHA1 3350e3024be91e2bc365f78e7fc8f8bfc8fde7c7
SHA512 667f8842d394fadf6edb545fe3fcca0c3323c04290bda822d88a475c8c8f6e02cd785fc95d482a9139e1204d8da7bda62b94dbf4336f3ac4d8674074f547fcfc
SSDEEP 96:ok3IcZus9hv0cELuV13K4DZcsLdsnr3a7Z0su6+BIvUQ:/LNlSmpN
TLSH
T11A91CD542AFED0373461031E547C5DD6A372F0FE1A755A8CA72AF3285B88CACDF850A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 117B
SHA256 200537f0368cf98c86e228a015fc460b38ce2ff469df54934283dbcb4f264c51
MD5 6e0370f8ddc0aad1f71429e97f41c859
SHA1 26eaa81e1b7dd1480622dfd964ec6848ffb74d67
SHA512 27a745f333bdd62293da1e634b8824f9f3b6654b611f50decddeab1cd44c880297e69213dc6b98cfcafaf059bd73f83bff47cf1661900ec212220e753bdd4cdb
TLSH
T13FB09283E36E88F8806835A262A96A02829E4449AD5787AA6906C580855A815A58340D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 9a3f90d69b13332ada9dffbd24bc98235af6698272c4bf32ce642178653beccb
MD5 71631b385447a54186ce45d81b259025
SHA1 673a0581c2a0a5b9a265e5a45416bda2b999f17e
SHA512 af4c2993195ea9392119fb9583c4efe36cb1ef012d6c6de922ea72de852ffb10e509e760a0990428d1198b34c2afcccd86bc825eaf9c4297f5d0bf985fcdb781
TLSH
T10FB09283E32F8DB9C0A8219222E929428B9E4059E8A35A297905C881826E81AA5D300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 6e22fd23354480946a9c0a75245c1d06b7cbe3c0552ba86062b902c1de735397
MD5 35f6114e331954f5068559912e13685e
SHA1 9bc11631cdd8fc172b695da9284de43d4669ac7b
SHA512 d6000b1a4d6414969111482f8f4846bd354bf7e8ee6509f645074b3a0200a4b5722ab1334c75bc7bdbd509d29a5bbf4f20e9dd71de7b46ea25e7d0b13c529c40
TLSH
T1A7B09283E36F8DF9C0A831D222E92942869E408AACA346297D45C48982AA51AA9D300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 436d6c324ac6147b7774b12e2eba8899141d4541eadeb7cc2b42916f4fb8cd60
MD5 9a92bb0fb7bfdc69e72cb00aaff08de6
SHA1 10f7fc27ef0dc458462a38c5239b0c8a45625da6
SHA512 fcaaeccd27cf803ee5cce304cd772c56615236c60352ddfc5627b64d01d71c747363c653c51ab038d498295a57b095e45500d5372e22c72783add97616c528ce
TLSH
T16BB09B43D31F8DF5C458259212D91541879D444998A356157905C445819D41555D300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 8394b59b4e5b061adbe73838a242598bc423924b508aad5c4dff201a83cbd31c
MD5 1ee2cc6663a8c11c1a5cb62348fd45ba
SHA1 d84f8531933901e6804d85f9cb23c8c3a7ad643b
SHA512 be29995a1ccbc0ead73de013134a01f891d91de8a4fa56797a79ca35ca881b8cf695f0c2edbcb54498c1942e587f227f275287ea4626a4352db58e250a3efb26
TLSH
T130B09B43D31F4DB5C055219212D95541865D4449989346157D15C542815D41555D340D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 d329aab544278c9a52c622f5e4729f5510269ea2f3dd33d57b3fc6edfe9d0638
MD5 a5662bca22cc19dbd8a7c3bc81340de6
SHA1 704c17789b40da15162884862d106d39175329ea
SHA512 bb4e7019e920c82115c3ff4d4de0c6e6983f236926ae2e1c57de87456f6e15774048f89102aef7c18041d4efb87132cfe2f8a8a0ff8262a32f7785b469518067
TLSH
T158B09B43D35F4DB5C058259222D91541865D5449989346157915C541815941555D300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 598e4998a698b3bdf954e28d5b8ead60bd937a8e10ad0f01f193996ea91d288d
MD5 9b1c63c1f49e9a9350a28f09301c7285
SHA1 4352ff285d8a4ea991eac024c818cc21ab569379
SHA512 1ad05101645cc1a5ec204ccdcb184ab1cbfd49ae342cd23a443bb3ec1356115e51659825c22465c05ab4e1242fcc58b7a8ff19877913300d79594089878e2117
TLSH
T142B09B83E35F4DB5C058319612E95541865D4049AC9346157905C541815951555D300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 7e0768e41263171af486e8d2adf19bbfb18592cac686e62504d81bc9059e5f10
MD5 2617765b69008ab2d949adafd092d393
SHA1 47c1d96c51fe602b9899374e344f8ec4853aed2d
SHA512 27e8c81ceded3e1a61f910933a8eb538afddba91c3cb8e8cb63416f0584cc4ee23d4493f63e7178dd947b423aacfc95b496f101f2e6382e2684d3cd96fd8ee70
TLSH
T132B09287E32F8EB9C0A8219223E96A42869E404AA8A346297906D481826E41AA5D340D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 45dc33992955e2a55458cb3816d280567cbeaaa4ec28325ba6f27b83ebc24907
MD5 4d3b8b01e4ca05276dfad10d3129cead
SHA1 ed09dd3bc8efafe13e73d27cf44dbc3900263a6b
SHA512 70467c971b308f00d0f0732b95bd68f2568a927d4206bf5066db3fcb52273c10b06cf1fde616f5a3b9d80555b0657659e7667160c88479944aaaee121ae25744
TLSH
T183B09283E32F8DB9C4A8219222E92A43869E404AA8A35629B914D482856A41AA5D340D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 00c84842428b697f24a7ec5e12a32ae8fed53f0ad833c2373fe4f00120001160
MD5 9059adee8ef79efdc4011a0d43da2c93
SHA1 59f9fb6d4aab576614a8e0f0156532e0b5a71060
SHA512 02eb626507045607851904f1b76e01dca692cedfa8bbbd19422d0bd77af370724ea71cea8959e426fdefdf49912b9b6858622f4f08f904f3fb62b3501c874726
TLSH
T173B09283E36F8DB9C0A821D622E96942869E404AACA346297905C58282AA41AA5D700E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 e2780db1bc0b7f4ee839f43dbedab4651e9cd55c8ab46b6ced7a77a77db49333
MD5 de12c818f2e92cbc14137188672083fd
SHA1 de627b320713eed14c5fa11149befef68f9b5354
SHA512 c583a54fc5244b5245e0894480602faabbc24a3ac9e0cda23ed535130066322ed7c7c3fd366017f49b9d8c6a3313033a5bd9f4df1f4153b0f3653cc4617c4fa9
TLSH
T14BB09B83D31F4DB5C054219612D91541865D4049A89346197905C592815D41555D740D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 84a29eb1f5b699265d5e88e4549fe1e76acf97afd6c55b75e68f606eec6ba494
MD5 9ebacab154da12be648ebf8a738fc439
SHA1 349bc9c53554b1b249707ccb017933bbdf7f1340
SHA512 a6c1db30197ba4b6ca9e4796aa26f80693d85f303a1057248a87d3b45318eb883d7cdcdddf29485073062de86e0320b050538ec8b839b8f3da83f9af42bb1803
TLSH
T1BEB09B43E35F4DB5C058119613D95581865D40499C9356157904C541815945555D300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 fbbcd1f110018b78213ebbd8cbb9ee3591d044542a0548e9d76dc0334fa1f340
MD5 06f5e4871206e5a358b6e49a53cb59fe
SHA1 f0a7657eb75bbac5508bd8afb74d6f1d21510475
SHA512 9918765b46c6009fecc7781b75afde75cc53a6be80905bcbd3172797e90ef7ece0c7f123f063a425f0cc271ebd2918b3bc8a0e1f4f48632f1145f77ec8d304f3
TLSH
T1BDB09B43D31F4DB5C054119712D91542866D4059989356157B14C441815941955D340D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 cd43f80ebc6621fb27f3d68688758201b5ae11b14c68a6592f0036eabb2cb64a
MD5 d466bc77c18e367fd203bac79bf05beb
SHA1 0bbe5577330976ea9448b826b205e8f30aaf6da6
SHA512 713dc58effa468b20165aa7df01325eb675d7776aaeeb010dfb0c455b402c41f5bf26e0d32a64e49602bebf1592a64fe6d52bcb0473b6bd5005a7f3daf64b9d5
TLSH
T11BB09283E72F8DB9C0A8219222E92942869E404AACE386297A04C481856A41AA5D300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 b42538cdf43d2639d9a2c2ad11008e90e9d6a51e2d4a1c5183885dc047ce84e2
MD5 19ffa1e115e41a34000ab1a6c72fae61
SHA1 45bf262a4fc012d02f042b36692a8cf3a75820e1
SHA512 7a4202e10a8cc83365b4bb517239d29593ef274c4f2d28948b1ae445e2e423e1a9861562904aca928bcc6b44c96548e6b4d22af701781a748e2915f215ad0e87
TLSH
T105B09283E72F8EF9C0A821D322E92982869E404AACA346297A14C481856A41AA5E340E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 559a5d607f08ba88dd03e13dc064938ccefe0c619bf82fed196153e1554976dd
MD5 f3a9f6ece96348be2e34b9a994e50093
SHA1 5769cd81491a96d2c1310724953b125bdbbaeaa3
SHA512 50f294c0541a9c81f42cd2ad796aa67bd1009c00e783846924c7372b39d442d1e56f399841be818778e9f71d479798f194fc3ecb80bd1f87e708fc53d8113358
TLSH
T188B09B43E32F4DB5C054119212D91541865D404DD89346157914C842815941555D340D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 cd50e9398aa950b7393ab5a4a976d47b157d3bd6a6ea2e5bf7c18806e8e0e01c
MD5 90d28c9c76e89f8814beb8461fd50347
SHA1 0a151c20878268d109bbccf7ec00524060408784
SHA512 31e0a58a811693a83c31572ff4fd608c2a968379d2fe92eb3326e80cee1051df20c9192edd93600105928ed6332153bb0554bf4b928c34d03f9386662874aca1
TLSH
T160B09283E32F8DB9C0A821D222E92942869E444EECA3462A7914C481816A42AA5E300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 0d4c9f1ce1ed5c13504ca660a5a7ef572004b0976ecb88f683ca5e87f62a7e18
MD5 49d7c9d063ea9c663787da3ccb6326f6
SHA1 9f38a85858906bad93bd27f881e92c328a92fa02
SHA512 63ac18ead8ac462209f6c1c017e13fc2c2160ededf6a24dd5f99badb05b8883a37d65fdc57efc4de5b1a80857e5c4b8db8c341e78291aee06124de709e97fd94
TLSH
T166B01443D71FCDF5C05415D313DD1541C75D404DDCD347157D14C441C15D41555D340D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 a69818b392d72a0d39f542939742f4e25916623ba9d729dee03a688fa5547666
MD5 3c9cfc3bddc121280c9f47cea79bfc23
SHA1 da14dcdff5b1a2fd5a07911583a580ddffeb2dd0
SHA512 ed3624a39db3103617fc1f97e0a4e5da5aa5eda17cb416d75b4a8124e19ac8a546b5577dfb912b69bd8663e671af38820930e56a4e1e54db4b71d437003e0c46
TLSH
T191B09B53D71F4DB9C058119212D91541865D40499C974B157904C44181A941555D700D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 9888139a624bedb939d0db56cc0c44e4c67f41c6d9481efe6fc637c8fb0740e4
MD5 bd149cb08795027d9811de4381f16f6d
SHA1 6de752d1ee0d28dc3a301036bba935a3e8a80f30
SHA512 86f63fc8d902aff2abc08deb5ebea04c9c027e9798dbef9a8eb6720c31926a20bea46e8c7ebff8c0fddc9639e0e9898f42985279f293852dabdf0abd6d106fdb
TLSH
T184B09283E72F8EB9C4A8259223E92A42869E404AECA756297914C481916A45AA5D300D
MD5 SHA1 SHA512 TLSH

Submit Download

second[1].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AQUMYOH4\second[1].exe
Size 3.0MB
SHA256 bdd1ac8428211967ac5fd230590c46beb3659d3204bee38a8ef1659d886176fb
MD5 734ed8b5811c89c69b0d8963d3b38bdf
SHA1 efad61bfbd4dce0b75e7b0833cade39d98e021fc
SHA512 4cb2f389427e7be7678e2a41b14f0e3238a30b74fde510f1bfe159e18e81d0a943762dc49138ce2f738e71d0d57f7d9039118fe0ca333f5b28f9134bd760ce30
SSDEEP 49152:qwnpWy90JxLL8Q84QogtTDeaLjqcZz+WvALVPjm2jj0urBT7+fWa:q+Wtzv8bTahPaxAF
TLSH
T1F0E5BE43E69980E8C59BC07CC7279626EA33B88D4B30B6DFA7D40A113E67B905F2D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

one[1].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K8NNS1H4\one[1].exe
Size 7.2MB
SHA256 0b654057aac66c49e8eb909a106df4415a61d8c03cc85e28d261205ff2e212ca
MD5 f652be3df7167712010801d139b7977f
SHA1 ced91767f291191b54ef393c11af7e6032f77821
SHA512 72071dba8ff14446caa16b732e92870d4245d13bb117e47bc506b15a0e7ff2df095dde9b3a30a070a9e987be72ef1cfe2ab7513583f4599179024d1576ffb142
SSDEEP 98304:wH6DG/UCdlw9Ahji5c4LZa/AFptlYstBoqU:c6GUR9tW
TLSH
T1FD762A11BA6F55ACD55BC8B487068A239E2130DB1B3AB9FF018486393F69BF01B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download