bridgeagent | 901315b7a1368a1f824330f46afc8a5448eeb08dda2e0d31aea4a89d1731f4a8

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_c531126e755d6a84fd71988296c0bf23_akira_glassworm_icedid_rusty-stealer.exe
Size 7.5MB
Sample261110-mxsrcsh15v
SHA256 901315b7a1368a1f824330f46afc8a5448eeb08dda2e0d31aea4a89d1731f4a8
MD5 c531126e755d6a84fd71988296c0bf23
SHA1 769aaf695f46ce1acf351a427228edba7794a4d1
SHA512 1ba9e01aca377d1c5c279128ab4ab716e4401008b8c2be1fff6e442b0abbe5636239a29f1ae6e9bcaf3b9de11c162a1f10b7824eb325b71ec95ddf9ba3334952
SSDEEP 98304:MFN56U5URbY8J8TAn8C2N/irGLM9n46x:AX6PBdp
TLSH
T112862951BA6B58ACD597C8B483468A239E2130DB0B36B9FF01C486393F69BF05B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery bridgeagent loader persistence

Malware Config

Extracted

Family

bridgeagent

94.26.90.104

Signatures

Family: BridgeAgent,ShadowHVNC
BridgeAgent aka ShadowHVNC is a Windows backdoor and loader written in Rust.
backdoor loader bridgeagent

Detects BridgeAgent aka ShadowHVNC loader 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c486-32.dat	family_bridgeagent

Executes dropped EXE 3 IoCs

pid	Process
3696	BridgeAgent.exe
944	BridgeAgent.exe
4348	BridgeAgent.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Bridge\\BridgeAgent.exe\" --supervisor"	reg.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5472	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BridgeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BridgeAgent.exe

Modifies registry key 1 TTPs 20 IoCs

Modify Registry

T1112

pid	Process
2888	reg.exe
5040	reg.exe
6024	reg.exe
4924	reg.exe
2928	reg.exe
1484	reg.exe
2800	reg.exe
1488	reg.exe
3312	reg.exe
4292	reg.exe
4600	reg.exe
2772	reg.exe
404	reg.exe
4240	reg.exe
4328	reg.exe
1520	reg.exe
5528	reg.exe
6036	reg.exe
3756	reg.exe
1140	reg.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4348	BridgeAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5472	powershell.exe
5472	powershell.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4348	BridgeAgent.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	5472	powershell.exe
Token: SeIncreaseQuotaPrivilege	5472	powershell.exe
Token: SeSecurityPrivilege	5472	powershell.exe
Token: SeTakeOwnershipPrivilege	5472	powershell.exe
Token: SeLoadDriverPrivilege	5472	powershell.exe
Token: SeSystemProfilePrivilege	5472	powershell.exe
Token: SeSystemtimePrivilege	5472	powershell.exe
Token: SeProfSingleProcessPrivilege	5472	powershell.exe
Token: SeIncBasePriorityPrivilege	5472	powershell.exe
Token: SeCreatePagefilePrivilege	5472	powershell.exe
Token: SeBackupPrivilege	5472	powershell.exe
Token: SeRestorePrivilege	5472	powershell.exe
Token: SeShutdownPrivilege	5472	powershell.exe
Token: SeDebugPrivilege	5472	powershell.exe
Token: SeSystemEnvironmentPrivilege	5472	powershell.exe
Token: SeRemoteShutdownPrivilege	5472	powershell.exe
Token: SeUndockPrivilege	5472	powershell.exe
Token: SeManageVolumePrivilege	5472	powershell.exe
Token: 33	5472	powershell.exe
Token: 34	5472	powershell.exe
Token: 35	5472	powershell.exe
Token: 36	5472	powershell.exe
Token: SeIncreaseQuotaPrivilege	5472	powershell.exe
Token: SeSecurityPrivilege	5472	powershell.exe
Token: SeTakeOwnershipPrivilege	5472	powershell.exe
Token: SeLoadDriverPrivilege	5472	powershell.exe
Token: SeSystemProfilePrivilege	5472	powershell.exe
Token: SeSystemtimePrivilege	5472	powershell.exe
Token: SeProfSingleProcessPrivilege	5472	powershell.exe
Token: SeIncBasePriorityPrivilege	5472	powershell.exe
Token: SeCreatePagefilePrivilege	5472	powershell.exe
Token: SeBackupPrivilege	5472	powershell.exe
Token: SeRestorePrivilege	5472	powershell.exe
Token: SeShutdownPrivilege	5472	powershell.exe
Token: SeDebugPrivilege	5472	powershell.exe
Token: SeSystemEnvironmentPrivilege	5472	powershell.exe
Token: SeRemoteShutdownPrivilege	5472	powershell.exe
Token: SeUndockPrivilege	5472	powershell.exe
Token: SeManageVolumePrivilege	5472	powershell.exe
Token: 33	5472	powershell.exe
Token: 34	5472	powershell.exe
Token: 35	5472	powershell.exe
Token: 36	5472	powershell.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe
4348	BridgeAgent.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4240	2904	2026-11-09_c531126e755d6a84fd71988296c0bf23_akira_glassworm_icedid_rusty-stealer.exe	89
PID 2904 wrote to memory of 2888	2904	2026-11-09_c531126e755d6a84fd71988296c0bf23_akira_glassworm_icedid_rusty-stealer.exe	91
PID 2904 wrote to memory of 3312	2904	2026-11-09_c531126e755d6a84fd71988296c0bf23_akira_glassworm_icedid_rusty-stealer.exe	93
PID 2904 wrote to memory of 4292	2904	2026-11-09_c531126e755d6a84fd71988296c0bf23_akira_glassworm_icedid_rusty-stealer.exe	95
PID 2904 wrote to memory of 4328	2904	2026-11-09_c531126e755d6a84fd71988296c0bf23_akira_glassworm_icedid_rusty-stealer.exe	98
PID 2904 wrote to memory of 3696	2904	2026-11-09_c531126e755d6a84fd71988296c0bf23_akira_glassworm_icedid_rusty-stealer.exe	101
PID 3696 wrote to memory of 2800	3696	BridgeAgent.exe	102
PID 3696 wrote to memory of 1520	3696	BridgeAgent.exe	104
PID 3696 wrote to memory of 5528	3696	BridgeAgent.exe	106
PID 3696 wrote to memory of 6024	3696	BridgeAgent.exe	108
PID 3696 wrote to memory of 404	3696	BridgeAgent.exe	110
PID 3696 wrote to memory of 4348	3696	BridgeAgent.exe	112
PID 944 wrote to memory of 4600	944	BridgeAgent.exe	113
PID 944 wrote to memory of 1140	944	BridgeAgent.exe	115
PID 944 wrote to memory of 6036	944	BridgeAgent.exe	117
PID 944 wrote to memory of 3756	944	BridgeAgent.exe	119
PID 944 wrote to memory of 5040	944	BridgeAgent.exe	121
PID 4348 wrote to memory of 3116	4348	BridgeAgent.exe	123
PID 4348 wrote to memory of 5472	4348	BridgeAgent.exe	125
PID 4348 wrote to memory of 2792	4348	BridgeAgent.exe	128
PID 4348 wrote to memory of 4924	4348	BridgeAgent.exe	130
PID 4348 wrote to memory of 2928	4348	BridgeAgent.exe	132
PID 4348 wrote to memory of 1484	4348	BridgeAgent.exe	134
PID 4348 wrote to memory of 1488	4348	BridgeAgent.exe	136
PID 4348 wrote to memory of 2772	4348	BridgeAgent.exe	138
PID 4348 wrote to memory of 2776	4348	BridgeAgent.exe	140
PID 4348 wrote to memory of 3948	4348	BridgeAgent.exe	142
PID 4348 wrote to memory of 4544	4348	BridgeAgent.exe	144
PID 4348 wrote to memory of 3728	4348	BridgeAgent.exe	147
PID 4348 wrote to memory of 3452	4348	BridgeAgent.exe	149
PID 4348 wrote to memory of 2420	4348	BridgeAgent.exe	151
PID 4348 wrote to memory of 5952	4348	BridgeAgent.exe	153

C:\Users\Admin\AppData\Local\Temp\2026-11-09_c531126e755d6a84fd71988296c0bf23_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_c531126e755d6a84fd71988296c0bf23_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\reg.exe
  "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4240
- C:\Windows\system32\reg.exe
  "reg.exe" ADD HKCU\Software\Google\Chrome\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
  2⤵
  - Modifies registry key
  PID:2888
- C:\Windows\system32\reg.exe
  "reg.exe" ADD HKCU\Software\Microsoft\Edge\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
  2⤵
  - Modifies registry key
  PID:3312
- C:\Windows\system32\reg.exe
  "reg.exe" ADD HKCU\Software\Chromium\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
  2⤵
  - Modifies registry key
  PID:4292
- C:\Windows\system32\reg.exe
  "reg.exe" ADD HKCU\Software\Mozilla\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.firefox.json /f
  2⤵
  - Modifies registry key
  PID:4328
- C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
  "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\system32\reg.exe
    "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2800
- - C:\Windows\system32\reg.exe
    "reg.exe" ADD HKCU\Software\Google\Chrome\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
    3⤵
    - Modifies registry key
    PID:1520
- - C:\Windows\system32\reg.exe
    "reg.exe" ADD HKCU\Software\Microsoft\Edge\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
    3⤵
    - Modifies registry key
    PID:5528
- - C:\Windows\system32\reg.exe
    "reg.exe" ADD HKCU\Software\Chromium\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
    3⤵
    - Modifies registry key
    PID:6024
- - C:\Windows\system32\reg.exe
    "reg.exe" ADD HKCU\Software\Mozilla\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.firefox.json /f
    3⤵
    - Modifies registry key
    PID:404
- - C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
    "C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 3696
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:3116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoLogo -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue'; $exe=$env:BRIDGE_TRUST_EXE; $sig=Get-AuthenticodeSignature -LiteralPath $exe; $sigStatus=if($sig){[string]$sig.Status}else{'Unknown'}; $publisher=if($sig -and $sig.SignerCertificate){[string]$sig.SignerCertificate.Subject}else{''}; $mp=Get-MpComputerStatus; $tamper=if($null -ne $mp -and $null -ne $mp.IsTamperProtected){if([bool]$mp.IsTamperProtected){'Enabled'}else{'Disabled'}}else{'Unknown'}; $source='Local'; if(Test-Path 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender'){$source='MDM'}elseif(Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'){$source='Group Policy'}; $onboard=(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' -Name OnboardingState -ErrorAction SilentlyContinue).OnboardingState; if($onboard -eq 1 -and $source -eq 'Local'){$source='Defender for Endpoint'}; $detection='Unknown'; if(Get-Command Get-MpThreatDetection -ErrorAction SilentlyContinue){$matches=@(Get-MpThreatDetection | Where-Object { (($_.Resources | Out-String) -like ('*'+$exe+'*')) });$detection=if($matches.Count -gt 0){'Detection observed'}else{'None observed'}}; [ordered]@{signature_status=$sigStatus;publisher=$publisher;tamper_protection=$tamper;management_source=$source;defender_detection=$detection}|ConvertTo-Json -Compress"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5472
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:2792
  - - C:\Windows\system32\reg.exe
      "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4924
  - - C:\Windows\system32\reg.exe
      "reg.exe" ADD HKCU\Software\Google\Chrome\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
      4⤵
      Modifies registry key
      PID:2928
  - - C:\Windows\system32\reg.exe
      "reg.exe" ADD HKCU\Software\Microsoft\Edge\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
      4⤵
      Modifies registry key
      PID:1484
  - - C:\Windows\system32\reg.exe
      "reg.exe" ADD HKCU\Software\Chromium\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
      4⤵
      Modifies registry key
      PID:1488
  - - C:\Windows\system32\reg.exe
      "reg.exe" ADD HKCU\Software\Mozilla\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.firefox.json /f
      4⤵
      Modifies registry key
      PID:2772
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:2776
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:3948
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:4544
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:3728
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:3452
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:2420
  - - C:\Windows\system32\hostname.exe
      "hostname.exe"
      4⤵
      PID:5952

C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\system32\reg.exe
  "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4600
- C:\Windows\system32\reg.exe
  "reg.exe" ADD HKCU\Software\Google\Chrome\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
  2⤵
  - Modifies registry key
  PID:1140
- C:\Windows\system32\reg.exe
  "reg.exe" ADD HKCU\Software\Microsoft\Edge\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
  2⤵
  - Modifies registry key
  PID:6036
- C:\Windows\system32\reg.exe
  "reg.exe" ADD HKCU\Software\Chromium\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.chromium.json /f
  2⤵
  - Modifies registry key
  PID:3756
- C:\Windows\system32\reg.exe
  "reg.exe" ADD HKCU\Software\Mozilla\NativeMessagingHosts\com.bridge.work_activity /ve /t REG_SZ /d C:\Users\Admin\AppData\Local\Bridge\native-messaging\com.bridge.work_activity.firefox.json /f
  2⤵
  - Modifies registry key
  PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 4KB
SHA256 96e1d21d13c70a088cd3f06dd8120cf6f27b29c312490377d439d3f36af5d6f0
MD5 82b36f8946ff891f3d6048ae0e0712da
SHA1 63c670f14214a255f78ada8b643f53d2e61fece7
SHA512 bcd4fa1bb0c843c6fe371f6327113fd43962b71ba69d09cc4cd261adab9b9d3a2897e414cbb1caf06b934554e73f3571508a56b88e70ba771b753e58bef78629
SSDEEP 96:o7rhNRdjXrsRRd7udcRdO2s4tsDLNr4JXcsfrFr2s4ts34sn5rHwrXuHsENXGsc4:uhDdjYndzdOdtdInjBdtLpQr+MEN9J
TLSH
T1F481CF4479ACC03A26C5412B643EECD6FD74A43DBA951B8CE325F1984182F6DBCDD261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 4KB
SHA256 5c943be60ee339a0d053961a619467809b4b1f222de1bf977b520f68fb29a004
MD5 61233527f1e01a233f4bef4c52e20b2e
SHA1 e7a6658fcba5e436abf50c7ff569103cd07df108
SHA512 a88d6fc1d0779b8b2e28c7fdb2a09c846b46b486982444b1c9f8940ecb129373a3ef1783061ca5427f490f6feaca05ef99441e9be03e0f17f0f8bf0a17373a85
SSDEEP 96:o7rhNRdjXrsRRd7udcRdO2s4tsDLNr4JXcsfrFr2s4ts34sn5rHwrXuHsENXGscP:uhDdjYndzdOdtdInjBdtLpQr+MEN9GJ
TLSH
T1A491CE4479ACC03726C5012B643EECD6FD78643DAA951F8CA325F19C8181F6DBCDD261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 4KB
SHA256 dd3f52459e0556fdc9a5e18a0932709a5b21a5cc4a438088e9ddcf055bcea5c7
MD5 1e3e25009bcbbf41870a5e6230a41689
SHA1 a776602064b270faffcc60f15d9f82a22933766a
SHA512 77cb53aae2fc5c2b9201adfe55fec86c029343a1c06a5928056ef52f3e6780ddca6aea13a84b637873dbb9eee592a6ab91385d9a21df46a1d3ab7d2a2e29e1bc
SSDEEP 96:o7rhNRdjXrsRRd7udcRdO2s4tsDLNr4JXcsfrFr2s4ts34sn5rHwrXuHsENXGsco:uhDdjYndzdOdtdInjBdtLpQr+MEN9GHi
TLSH
T124A1CE047AACC03B26C5412B643EECC6FD64643DAA951B9CE325F19C4285F6DBCDE262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 4KB
SHA256 47d3dfa8c4a251a658eb447461988b1fe513dca31adf13fad2efccf466dba6a0
MD5 3b64b2a30d063626ad7eec8922a95c8f
SHA1 85c9ae0f192a46a14c44e693dc5adfe6a839e7e1
SHA512 2ebf3d15a94594aade0352d9df2fe6d5d90a17b2da34c375704719f79dc77be0c1fe2318f9a74bbaffbf03601b4b03a70ddfb2a15ebfa815f2f79ddc4c3c071b
SSDEEP 96:o7rhNRdjXrsRRd7udcRdO2s4tsDLNr4JXcsfrFr2s4ts34sn5rHwrXuHsENXGsc9:uhDdjYndzdOdtdInjBdtLpQr+MEN9GHj
TLSH
T11FA1DF0479ACC03B26C5012B643EECC6FD68643DA6952F8CE325F19C4285F6DBCDE262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 1KB
SHA256 f8579b62c4b34615beed4673705be351e86fe082dd33acdc3ddc1413a7b190ad
MD5 8af1ecbadc82c5ced905a9739811192f
SHA1 16e2451ac9f1a0b9a11358c0534bcc3f7ab5feac
SHA512 6e8fdc910101f2725fbd1856b4375f2d233308fe0185183eaea5df11f3208435424832a79c7d570ec30ccf56c8df3206b21a62ba8641d20dfac510d2e043ee18
TLSH
T12221D294719DC13713C5112B543EECAEED62543CFF961B5893A6C49D8191F1FBCC9260
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 1KB
SHA256 c58b1443646ef00bd37e39383a2982be2d958b062ee66cc11be9cc321a9bc1ab
MD5 bfa04fd32a48e3b7663749fda019c05d
SHA1 fcbfe2f7cf754e27cd0d61dbad7b5973b15ca5fe
SHA512 d60fef88591f87cea33dad0155ac4858ce78f4ecadc3624a31d1d44794ee79d26a41f3de48f0335c3ec6ca46138ba3580a1a496b4c8abf7b3ee5faf37e72d01d
TLSH
T1B331105071ADC13B16C5002B643EEC9AFD61A03CFB951BACE366D08C8181F5EB8C9361
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 2KB
SHA256 cf9b40a1afe804ec978c91c4b70920b062379eaa7f4666fcaa0d8bbb81972367
MD5 d54ecbe53077718631ae859cca54b998
SHA1 59c29394866922f74418567edf1240407bc160d7
SHA512 341eceedf84f599c5258b492819790925d67079020a595942c704123f69cdeea9d7d6091dd9e4ae4ad688d32882e7e11b54e90daa8a3511b872c85a2382c3813
TLSH
T1B051DC5075ACC13626C5012B643EECDAFE75643CAB951B9CA366F1888181F2EBCDE261
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 2KB
SHA256 164cd73d295edd2886d254cf9b74c191fa3e2aea240d037b103fb89616c0f4a2
MD5 4210575f29ca6287c9f2aa31f7e0a885
SHA1 c472786836595bd6582d1f56b911c90c46abd2a5
SHA512 d54f65bfd24e1b5f82ff0d1afba3f5bf5c1ef266c9ba8a98feebf9056b2603ee64e424c5ce871c49027269105e41a64bae7270ef553ad3c685f71484ae0eee8a
TLSH
T11051EE5075ACC13627C5012B643EECDAFD75643CAB951B9CA366F1888181F2EBCDD261
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 3KB
SHA256 712eaf4ead0b5d3ee3af4072bbd03f635f2341ec32a4c10833ffb3f91f6b50cd
MD5 3cba003cc5e85bce07dc58db756c9112
SHA1 861a382315ec3e36674a505ac49549a295eb168f
SHA512 e463925eb5e3e25ba48541f4095e145e3127b8a8fd0a38e485598c6239dd32c811332187c6ee550a7958131aa8f83aa81b17787c2831c4f58e8ae48111f84b76
TLSH
T16D71D04479ACC03A26C5012B643EECD6FD65A43CBB951B9CE365F1988182F2DBCDD261
MD5 SHA1 SHA512 TLSH

Submit Download

bridge-agent.log

Path C:\Users\Admin\AppData\Local\Bridge\logs\bridge-agent.log
Size 4KB
SHA256 2b24885be440f7fa3580706b264c15efc7d3b74408d593ccb4b5ad33498c36e2
MD5 2d738d1da86a9869ba269ecc5d99662e
SHA1 33ba8731e365e25370a9d9df7c8e791a617db539
SHA512 66576b007bf3265cd9a99ce7ef5594bf74d83e3141eb35abcaff8243e669a95b698c0a9783506eb91811d676e576919cf1239af07128dddb233cedbaa336c75f
SSDEEP 96:o7rhNRdjXrsRRd7udcRdO2s4tsDLNr4JXcsfrFr2s4ts34sn5rHwrXuHsENXGsc+:uhDdjYndzdOdtdInjBdtLpQr+MEN9h
TLSH
T15981DE4479ACC03A26C5412B643EECD6FD74A43DBB951B8CE325F0988182F2DBCDD261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.com.bridge.work_activity.chromium.json.new-AmJuvjKG

Path C:\Users\Admin\AppData\Local\Bridge\native-messaging\.com.bridge.work_activity.chromium.json.new-AmJuvjKG
Size 258B
SHA256 e44447c440811e0cf30ee46404d95464157dc3da5ccf08c7b50c43f046111441
MD5 290547b748dc394630eb7339de3d87df
SHA1 cf137c57628577cdde6b58a6d65b13f0fac0e23c
SHA512 a347f31f2ed6e1571e9817ba83f79a3ce2736477407b4e4eda3814f17514044c841d24f5e50444fee3a1f508f77a50c50c8442160a13f24d7f63a0fa1840be92
TLSH
T166D095045944B53C9C4B0F2074229E47E16C534DFBC41750FD42431C8B52F944017A3F
MD5 SHA1 SHA512 TLSH

Submit Download

.com.bridge.work_activity.firefox.json.new-yiW1QQZc

Path C:\Users\Admin\AppData\Local\Bridge\native-messaging\.com.bridge.work_activity.firefox.json.new-yiW1QQZc
Size 242B
SHA256 888a4313621908714b42e739ca0203e0bd00c01417131fcc7890df03c7c0794c
MD5 e103a2d78ea5f7f4f357f5dd90fc9bd1
SHA1 e77fcbe9879e30a260c06719b3241f195278ef3c
SHA512 c159196f37c8a908ffe4c2167010c9f41413f544e36cd67a81c90033904b071df8ebedc9350acbb030cb3eb89082382a2209c0d730138264df92ae7c7f4320d3
TLSH
T130D09700681DBE388C8B03345C218E8AE168408DF7C80BA0FE42112CCA54FEC801BE2F
MD5 SHA1 SHA512 TLSH

Submit Download

root-ca.crt

Path C:\Users\Admin\AppData\Local\Bridge\root-ca.crt
Size 623B
SHA256 957e1ad45d3406539e1c84b5a8f5af76aafc758e5f4ad7c2cad74bca1cf2e780
MD5 ce1800df33717ccea6efb438cba5f03d
SHA1 8f15aeb2da1d97e48147fb064e738cc500149b44
SHA512 3e5bffa62faa6cf8eab3c2084b03c5952432a54942f1c23cc16a6869c70729aefc2bd7c93243c99954cc860b4ffef778a4187cd02f0f26748794ad0830040c48
TLSH
T131F0029A9F114D4CF05BE024F8B2E318CD46C1C7A05BF576A57900085144FA05CFE17D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 8b7cb707cf7250d4da746efc8f26a3df27bba8793ac2b42520521e85b555fef6
MD5 a569a6845e72b6e704336e9135b30cc7
SHA1 7557bf0e267c0fe3fda36764fa86756754b781f4
SHA512 1ddd0be2ad9f852a4a5e7282d2a6b6877c94b191aed8621616fb11b49f2dadd46c5ad1a814e37f52521756872a0d0f9ff0aca248c6a5fd8aef047b11f683b9a6
TLSH
T10FB09B36C5578455D4AC26D652655D41834A7445A85145546519CD00461B505568310D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 f369aa95b72ed8542f8ea02306336558cef3c3ea4768b0ae12938799a5668cf3
MD5 28f0979ad3d0d65d70d353d8dc2740d1
SHA1 aa2a8f0e462cec784d2bf399dab27c13f5736654
SHA512 676715cec859c8fb16f538fbefafb702502e421260e6cb7feb3b62b5b9ac6e7e9db0bd8b5f049bf63167c2acf21628ecfcfe8b290292c903dc0c3ee2edf31650
TLSH
T1BAB0223AC0AB8880C8BC22E222A22C02820A3082A8220220AA08CA00022AA0A228300C
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 eaa3d995d11bb0cd6c89badee5685f10cf6f31ea0d3c9e8bbb60431bb78b75a5
MD5 a4c4e701320f85201eff8bce32800ea3
SHA1 e950474510f05d95503bffe9a7a86f5ae62301f9
SHA512 16a1ddc59a3b17f0c7c017adabfd826e851c80c25dd8d5aae69410f81b60db99cd15f579bb40b57128d0b932ca6a5ab781f1f01e7c26c56777e226915a2a9729
TLSH
T1D8B02B36C0538841C4FC22D11265180182093041A8120150A509C400431B605118300C
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 d035f64a9ee7dcd0c1b9e73ee95451652aca8de2adb237e1c44690f365972068
MD5 7d477a71caf0d30e6965da63bcee2b11
SHA1 5a99ce9b4f328df585b617729bcd26ea84ca578a
SHA512 c22726e4bd4e8ac2b1473ce0114bf4ef8b1884bcdefba9e800c8705b79af856beece517a134d8ef806be4718832e22933f749ea18669b5196d20f4d4c3265239
TLSH
T1C3B0923AC9A78896D8EC36E662A56942834A7486A8624664A919C900472AA0A629310D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 53ac5328979582e2493b569ae6c609bee40a49859f6e593c5a21397e6d3ec914
MD5 597a077751fc3a705443c33ff37b826f
SHA1 b3c8608687d22b9b5918401d58e43bcf83709130
SHA512 5f754cc35c74398165cf9e805d876be241f8997dd8ba54067ebae7359bd5d0a5e9d52d29b74f1615c2ad4bd5ab82ffffa3cf2780bd8d6e96540760e6f69b09ba
TLSH
T1CFB09B36D5578455D4FD26D55265694182497445A8514554651DC9004766506518310D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 1b10e5edf7c2de9605b0f4c3e9e9e2ecf15618ad28651cc41999c3715bddc148
MD5 02b84843af50025ad7b3a0a08749cb0e
SHA1 8ea19ba430b1fc37517352760d598ee28abab0a0
SHA512 7984f7d3bbf1f11f6d441421f6b832836b23553c3eff1730a15d80bfab63e79e3f8c4137e40dbfc51dac3ae3243e17e76300f57eae457b9195c713ffdcf4cdf2
TLSH
T118B02B36C0938840C4FC22D11265184182093441E81241206A08C4000216615118300C
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 5e6c9f28be822a39a4a5978666498d355a70eb3eeb0268c2dbff9123640e2dc4
MD5 a2cd5408de9fb888b7a13bfeb2ac011e
SHA1 9145e61c011ec688babf5105fa9406349ea5a783
SHA512 6fd7a4b386823c3c3851e3385694737105bc32c0d79520342e0aba76f0ea6644f5d9c8cd970dcc87dc7ef01c2b8f549da2e4dba25ac617b02e79bfc72e2b5464
TLSH
T174B02B36C0538444C4FC22D112A1580182093041B81181146608C5004226505118300C
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 d873ba99d422cb1e8c83bb8eec64a155f268dd52cda55c7a02c7dc141814e4d8
MD5 19347a4c966fe205a0379ba6e0a3a670
SHA1 41168cd04dedc42067f445d7a7e6727d88dbfd6f
SHA512 a20e65f3a8ace98a2199e0ded129a0be127ac8118414fc880f426ce4034f2d01e164ccbc463f54ffcf0f9acaf82158aac374b14d36565477cbc4b075a0db8839
TLSH
T1F4B0123BC5A7C8A5D8FC37E763B66D42C34E7486FC624664BA1DC940472BA0A62C310D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 fa9df3e6fce2e8c3370fd38865ec9fcbae26fa5c676b928ecd6f9593ead257db
MD5 21b85cdabc1b100ecdf8a8d3d420eace
SHA1 5e645c7b399f49723a02516f82e524d150f04d10
SHA512 6d2aa4c4ac959822fb070a1c237b5690afa457bd2dfefe24119ea6e79ccd37bba731bd8f052aaaaf94423975b0d9034969f977f09161fc7e0937f8956bdb46fb
TLSH
T177B09B36C5578855D4AC26D552655941934A7446A8624554651DD9004716605558310D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 fbef0d2cfad7171178e105025403b2f5892f1a9b2ce0c82180ffc85cb495e3ef
MD5 e2b3ae00c5a4ef5bc1cc9071159babfb
SHA1 0c7e3f8ccaee3348c3855f6efd82cdb156fc711e
SHA512 a91121264e9fe8039df17556cd8032fd86d73acdeceb42c7878846181a3f200fb4965c7d4b93a900fac0e41474fab13cb6c17a76d2e2d3c0559730659fe20621
TLSH
T1B8B02B36C4538854C4AC22D512601C0183093041AC2201106418C4000226505128300C
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 8ef95d2c5967212aecf554913ca2ce771a61c4ef289c03ccb360a1c8d7f925bd
MD5 25e218951e3682e345e00a70dc3edbf5
SHA1 c0c658ecb84cea9fd150b9246541d597ad4955b7
SHA512 d67a23e053202c6ac82070846816ecee75122d4d06f4d59ce509b2cdf5caa5ec998a220efda5e5fb2f03474761512546db98f7f741ddc3f9bdab0fc47ae1d4bd
TLSH
T16DB0223AC0A38880C8AC22EA22A02C02C30A3082AC220220AA08C800022AA0A228300C
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 b68ce0abecf0b66270d0ad5cfef7cd0e227363f45fec5b1125f6d37463531e27
MD5 228bff6ffbdb07e7bedcbe13cc3fe5d3
SHA1 5a1a9a6de758275f25ccd6d3d143c27a36670a41
SHA512 2093db2a6eace46c0c0ff0a2341948d848a82db2aa16674942ea86f06d0861e6938cb58684abe43b15184ca8dd6e04993f4ad4954017f247f6f6c562cfe891ab
TLSH
T148B0923AC9A79895D8EC26E662B56942834A7486E8A24664A919D900462AA0AA28320D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 ce7f0e93b04f3a13a5f2a4bf94a09ba056d49c1858a16a02f5a162f1ef7c1791
MD5 4a0df43e25e5b37842bb0b24b6ce21ce
SHA1 56a0be36427c6d8e40eee72e21e6a9906815fd1c
SHA512 e66edc098c26d1760366944298f572032656895be232f2ff8c3dc3a6fd82f6077e0fe0cb9f200c303a74b5ecfe47c343c71ec865c697531e469f746def04919f
TLSH
T13DB01437C557C455D4FC37D753757D41C34D7445FC514554751DC504471750551C310D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 118afef1fbcbd17bbe1a1cc264ef50d8d82d5a4332e4acbb8d97972a389a0412
MD5 dde72e2cbb9af479dc845c111fafb3d5
SHA1 c5ba595159d72ba03ce0c060789dc0ebb9e38a42
SHA512 47d1a7ae598c212ef3cdc7808e1d91eff2153c761fdac75e8a3d4b7e2efd741b55870c5661f2835bfc3801bd865da9626903c6a0bae288ae99ada6d0b98e34ac
TLSH
T13BB0923AC9AB8896D8AC26E662A56942834A7486A8A24664A91DC940572AA0A628310D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 56b0e1634dba0d98860c06310462e7a334ce3b74d7bf8e62149187a464c118b1
MD5 ffe8b702240eb2be7b8c6167a42168c2
SHA1 3db66747c82302c5629407227a0b79dae127f1b4
SHA512 c8e2a6b72646e2fdc6aa5075fd66adc3a4313cceabe12903a330ba092bfe14858d59578bf5734e9dee4a765fff55130e5523c0b881aabeda89018c93a1e5e38d
TLSH
T19DB0923AC5A78895D8BC36E663A5A942C34A7486A8A24665AA19CD00476AA0A628310D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 71cf63fec534ba3180c118dc898ddee0b385da860eafdd2e2a680d7ae9044a49
MD5 6eaf29e9440d5ab1ccbb98341f6dc810
SHA1 bc5ec9b28e3087df97071973e795818ea4206bc1
SHA512 2e7dce679a5433acf8e039fe063a1777f1ec7a46644e04f301d5ad3c7cec11c5d0a8af7ebf2b66dd6c40f98647ba18331047d1e8d50402871e90ddacdae6e550
TLSH
T12DB02B36C4538840C4AC22D15274580183093041A86201106808C8000216505118300C
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 36591fd08b84472192e326d5cdd51c3ae394a4176e40524413f790e049e62449
MD5 be76b5ef59f820b35555cb706debce3e
SHA1 484f8aa5bfbde26c29021f7e6da9dd0075661f7d
SHA512 0c787d960a4d4f2268be7c73952d4c55867da8c57237ce000dbc1b6a76aabe69d6a83ae50f8d39c646f3c86b392c1f0b96669e04bd065daa1296b251ab123857
TLSH
T17FB022BAC0A38880C8AC22E222A8A802C30A3082A8220220AA08C800022AA0A228300C
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 8670d395fd4fe5198a5e837a12cb7d8927e50abb716802e0479d3016e6dbc629
MD5 97fdb5ccaa4ee7dbf23e880abaa53f76
SHA1 d268d90bc0f3aa19a1b22ba3e8a80a3a8986a3ed
SHA512 4441dbb705fd067ffb021cafbdebcedcc1a973f825eb97273f1cfa73bd178068c71a162ebb57ca93226178c7f74f8413221c7fba482db6c6f77f4aacd749557e
TLSH
T138B09B36C5578855D4EC26D55275594183497445A8A24554A519C9404617505518310D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 441326173c9d3f5a1c47068cade6d429f43eed00ee5a3a8e861b04a50563a23d
MD5 c323add1ee1e660f9e97a04a6133d053
SHA1 e6218cc97dcefa5f3b392493e8fcc35506210271
SHA512 eef47119a78b7dd7961d3b645efcc5675b4b14b3c0466d25e8f30be42771d9edf156212f525802f6f005bbd595aaef5cdc84a2f32166f304d785e36344a4de91
TLSH
T16BB0223AC0A38880C8BC22E222A02802830A308AE8220220AA08C800022AA0A228320C
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 a3b155568e7d2826fc13874b69a9f0b82d36d2bb053ab31a1d53b8c8b148f52b
MD5 dd6a72fdcdee684d6353c1b4adb0306b
SHA1 3e0e2fa102615b74f20242f39481709e3b5d6637
SHA512 64d7be82b4e5a396b3901ed5dfeb2ec5b54996059a42274cad8b877eb73bd2a5590d9f63649798145a824838c6cb3eb44d2e60ccff33895335dc77d2757e9ed2
TLSH
T1CBB0923AC9A78895D8BC36E663A56942934A7886A8624664AA19C900462AA1A628310D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 eb1db6d4b2234cc2e5b76017c6e5e203fb05c533677d7a5055b9df7641be2cfb
MD5 76dc8441d1c6f1b560e89c5be7bc45d2
SHA1 d15777cc68328ed72f1d077bb792cc12ee24c294
SHA512 d273a48f1cc26762928070131a2fe22ec20d4b0f74bda2f40f24f5228e926c388890fddfa9f38a38edca80e88b0d9323126511737ca0764bbb65562a09f67acf
TLSH
T148B0923AC9A78896D8AC26E662A56D42834A7986A8624664A919C900462AA0A628710E
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 38297722c774cf43fe8009a37f2105c2787e18c4cdddda1238aaeb3c84c731b6
MD5 52a7dd7cb115d6911659fc312d9b0841
SHA1 d136747aa5238aac6d037b7a247b159f53b0e379
SHA512 24a4924761b265e9c10d3ddcb9e3fa67c75426065e6e1f78d443c3bea4c4d802df797513418b07f5af8607012d60e4c59cf4325fab9739030efbad9e0c20faf9
TLSH
T1C5B0923AC5AB8895D8AC26E662B56D42C34A7486A8624A64AA19C900462AA0A62C710D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 7326a7e23de6d0829994afa1ed9c23732b662dc2bc87e2998afcfe2b5859a886
MD5 c438442221fd292452e57fdc259f1e21
SHA1 0cf678dfaf731fbdd61e5a67fdde047b8ada67c7
SHA512 1a0384f499ecd4d2a18b2e8a1c716486a1409599cd20cc3614ec03f862c8e50a5501dc8e151bb0d3905d4a4a4290df0aa90301482f6bf7e56916487bdf8ca9a9
TLSH
T1F5B0123BC5A7C996D8FC3BE763B57D42C34E7486FC624664BA1EC944472BA0A62C310D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\runtime.heartbeat.json
Size 120B
SHA256 5f32d1c54756c3b175a145f463658a979ba39b2931eb7e972afe37ce06729b1a
MD5 bd5bdb921dc60309130b6f934a93e674
SHA1 105cd70e44c58bab7dfffc8f9766f438dd51566a
SHA512 f178591e96a086588e06848184e0e9b282327aa2f5a27aba35fafa0a72023d3c23937cd98f5009e08a3bb38fb76cf2d929d0e2545a29760965c547e7e7a2528a
TLSH
T13DB02B36C4538840D4EC22D512601841830A3441E82201206508C4000216615118300C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 105bfc05c10100666739fe8eb26555b8984e2419de488db380f9932bb122e922
MD5 c3171082cda86a7eb1194808980723ca
SHA1 2785bbce009c1915bdb0731f388b610fc7ee39b2
SHA512 ca5eb7fc228f89e079bd5c6e079b0d0f822752dbead2f882a75c1c394f1ec77bfa944476984cdd1e34384d0609e0705811add8f9552f562730215da6ececbdd8
TLSH
T11BB09222E36F4DBCA86C05A212A8A943835E608A9C564375A908CD00D58B92A968344C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 117B
SHA256 48686910e07dd6a56c0be206d1419841992580dc266c309be46efbaddd129404
MD5 44c13f1a4da7cf17f49865fc4d3961b5
SHA1 5062ce8ec74022689a67a9e07a29b81d64674548
SHA512 9767d65c168529b688629cd70d1458ccc2f1f85ffe513857ad9128c1d01553636543642915fc59156fe4acf6f559966b7ba20d0bd6f1475d8f357850a15fdd16
TLSH
T19AB09223E2AB4CA8883C15A262AD6E02C14E648DAE528664A506D980894A80AD28B00C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 da973c3e01206b173d50c9d3b0e22fe1367597da531536564dc7f652bcfbfe4f
MD5 17ee0b96ed4eac136e390659d1cb201b
SHA1 573e23ae21b78fc6dc76ecf6c03c1b6076a05281
SHA512 54d44d3d72c87294defe7b1f1678326c13d8ce5ec1082b710a894ea6ac3fb985509700545fc02b45285be533564717ab01fbbf3ce7b6f742393444019dff9dd2
TLSH
T1E3B09222E26F49BCA86C01A252A9AD02925DA08AAD518375AA04DE00D59A92A9A8740C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 f2b59b531e44857f889a2b48b4d1c5a061a3b2c039f7b7a48a1c48283bcae649
MD5 ae34f2eb176c1b4424acb391abb0d343
SHA1 a1f598345d964c801472e103aee973474dd43dbd
SHA512 385cd534a70a8dba9b54890d97686d9a80437d97d90c5804547f6b478bbcfeb6c8ed4a7f18a19a4a9855fa72b7b82ee2c7de3c0a7ceabc08174fd4824ecfcbeb
TLSH
T1CDB09222E26F8DB9A86C01A612A8AD02925D608A9C524375A918CD00D68A926978340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 8ca588bbd0f2bda1f8e79e914af5925fe76cabdcb590cf8951766b8e786c0728
MD5 2270cda2a779f33c9c2934b955ab3869
SHA1 3c8c945aab28fe8edcb08715961d0a2c52834a16
SHA512 1db43e1a6f42ce54e94cb88c8d2682f37ca68c0e5a704109086c7251fc3ec098d16ffee96af65e506289bef9c5854acd20d133ce3ce1472708488f8542e12a8e
TLSH
T175B09262E26F4DB9A8AD01E212ADA902925D608A9C528375A905CD00E58A926969340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 c6697f7632afff0779f4d6926b4a5aa7335733ced9faceb905723f447940e055
MD5 60ec0d498792207ea6cb5b145ac4823d
SHA1 583fe7414a08b480d9f0832d2724e5321d9b2c91
SHA512 c0d2eeee0cf0501cd6619f6c3ebc7f48771f336f32fd87f9857f20c1de3f9eea320566b4d481b3226218f985533d757dac16b73615e18aa1aa4bd9628f3e37f4
TLSH
T190B09B22E26F4A79946D019613999902815D60495D5143756609CD01D596516969340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 56b8bac950d38156de4be5ac60ed0c915e3f9b8fded6ac7891076719b80daa28
MD5 dac35cccedbcb2ad35088c08eccf7944
SHA1 931e3d89ea5bf117d1f369975298e276b4d9d248
SHA512 27f39c80f4555595c6e4ba3323f1ad2bfb0527c6dd9a6cd2bf63a2a980ccedecf2f41bc8a6f17839a18b9378fe9b24e8b7316db7d2db31a7f3958258e89b1c12
TLSH
T1C5B09222E2AF4EB8A8AC05A212EDA902825D608AAC528375A905CD50D59A926968340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 d425a0d0d2fb5ae57455ef4a0451384f1955c410022196e6f738490caee07da9
MD5 a3d60deeb5452f918c66ef3e168bfc40
SHA1 b692eb84564c69a0dfafa9c1c63174b6a91de165
SHA512 043952e7a6b6b0eafa3dac77ade516ec9c6df22618392df7329a9257b08d0e2c2183bea96368b51b7392cfcc5cbd359cc8c3c04969efb92d20e564ecc726b65c
TLSH
T1BDB09232E27F49B8A8AC11A212A8A902926D708E9C514379AA04CD04D58A926D69340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 1b9cd3341e0a9cf5aa8cdd9745c3d1cf0da20d43878259d7436f5d4fc8672935
MD5 9564ea31a32253d3cc0972f03eced11f
SHA1 29c20ed049f6768f3da0731f1109e07561aa2080
SHA512 5239f9d08717b56845aed237bfc86cdfa78a8f93df7a5ec3665c3a4e775f4ba6dce29cf682e69e6733560d8f532f37cb92d67cfa1715282bb676403996de3beb
TLSH
T13BB09232E26F49B8A8AC01A212E9A942925D608A9C518379AA04CE00D59A926968340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 409f9f95201766da8c2a108df9eb00e73642a0dc9d9044ed5f0e900b1751aa90
MD5 61e276732e02c6d02cc3aaa01acbeac1
SHA1 e1e5c4aa05ca034b47764873e86b6e68b54ea036
SHA512 39a812be4e360b055bbe1983ae2f0147a7c938b0ec66f3ae7b2e2d9a173e45ac1682968c94bcbd0027d417765ad9a75949534ed7b7d3d24f17d8b3cc9a58a7a8
TLSH
T158B09222E36F49BCA86C01A212A8A902C35E608E9C514775AA04CD00D58B926978344C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 08ced3c91f3cf4d511e9a317cfa4db5c3de065ce1473faa457930951544f6aa7
MD5 c7f524731bada6f030cb8a0b3ad2a163
SHA1 72881e9ebdecd623e391146ad98521f87288d8e8
SHA512 71e46c72a37906af978f0d1ae899ec4b36d6fbe9c84c04faf560f6c2d86e73193c51fe21a3403587c1d70867eefdd98a5936c94efa8c265cd3017db6242d6b72
TLSH
T1F9B09232E2AF4DB8A86C02A212A9A902C25D608A9C514375A914CE04E69A9279A8780C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 0917aa3f1409403384c17d3c014620026ede149dafde4ecd8c49d69b24cb0bca
MD5 2b1b72c2990f03a8bc0b42109739d75a
SHA1 984c28208d26e5a62fec6c6c5535f63b9b51464f
SHA512 b2f5b4c9d8dbc75c49b3a2047d148c17a3a61792ad71d4088f361031e1e3e9d48ce5abfd18b5d94a7b90d7b0752b8a2c29f2b5e1f2eeeead9426543df66c1feb
TLSH
T1F3B09226E27F49B8E86C51A612A8A902D29D608A9C514375AA04DD00D58A926978740C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 4f548d96cff657ee6002fe9d1cc6744497a6d7ba688c45e92ffd81947a6163b0
MD5 29e3e1d3a1c37a512a0d02438836a8ec
SHA1 7c8ec3d1661339832f9b765c81983098a7476d91
SHA512 d9923ae00f379e0e6a367113d86802a54bc48c279f8ed4b338ac379b049dd7de9347ae9eefd423adfefd2b0187be607c0e804c0ccf62bb65db3a86a24eabad5a
TLSH
T176B09226E6BF4DB8A8AC21E212A8A942826D608A9C525375B904CD00D58A926979344C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 d87edb4659966dd2dd543c96c08005526d35283e47b6b73b93754bfe63b5b379
MD5 17282a858dd232fd1f37b96f359f0064
SHA1 19cc89271577d55149e85f342ecb7f1365f6793e
SHA512 08a1bf8279cc57c6a0086464a5f523af8dafb45a3d4969be69613b6aeb009d4c69d43d4960316094538a88948b14e63e26d0527cdb02bf85869294335e6287d8
TLSH
T11DB09222E26F49B8A86C01A212A8AA42825D648E9C554375A904CD50D59A926968340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 944bbe06a79b8587b990dc1315f65ba7f355a2dedfe71a591310ad63ef1ac953
MD5 473c43172cd01fe72c07ce650f5fc330
SHA1 185c515aa5bb7f9443944783ef52a87e850d8508
SHA512 a96fd63e1a7453743a3dc0ae60de919456a9bae568b782402b925021084eb21c401c3c2b9d2d22cf8d954fcc33a56d8793c343480aec3f32a21c65815e148bad
TLSH
T1CBB09222E36F8DB8A86C01A212A9A942826D608A9C524379A904CD40E58A926968340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 4e09ff341b7da370f157fafec931137f9d43ecba14fce2184f49f3df3bc7c689
MD5 cbc013881234ee2b4a4f1cc7e7927332
SHA1 f9960bfb97da4ee97c04fe5c81246a2719fa0503
SHA512 119606abcf1141cc139e06e10dba73b16f65379c88663e67d67dd798ca8256dc6dd9797a11870312f9c835b6b0ddaf0fd836f8939ecde1a837b6ef26e588da67
TLSH
T17CB09232E2AF49B8A8AC01E212A9A902C25E608A98514375AA04CD00DA9A927968340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 83ca53aa811afef5f17c4d3ed65af322f1831dc23ed80830860b013d15002b5b
MD5 f2c2b2ef20cd15532e7746207a34c321
SHA1 099199ef6183869c1810ed51bd90c846fb8093c8
SHA512 bc8d8d36a97eb3868e47ea50cfd186577fd79ed95692467439fa6aefe216e12e21fb52263999733c3f46228d72c224c618ec5fa1b1df8c01da7914f1f945f58a
TLSH
T1E6B09222E26F4DB9A8AC01A213A8AD02C25D648E98514375AA18CD40D99A926968740C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 5b5085817219ba0f4174a11179bb13da9f0fa0984356deee765757eb36cd3d67
MD5 ad2d288ca9bca9187da5c3d4db9a8af4
SHA1 b418c289fca504abc1564d2b07387fe2f0e9dcb5
SHA512 619b3d5cb2a8a72c4959cf8119c7d8bfa534339189b066e76e7cff860aae5451b7adb53c358fecfcfd4c7edf01aad932cb8db8001dad059d2e10d638f85606b5
TLSH
T162B09272E26F49B8A86C01A212A8AE02825D60CA98514375A904CD00D59A9269A8340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 e735e62236620026da0c83f77e7794ffb312e081cd4d1ed9ac32dabda279894c
MD5 7374a1735a9b194f1ff0f443f1d62fb3
SHA1 36097d512c2b6d93f09251d9703655413eb421ac
SHA512 a21ae1ced2050007da3b8fc6c8033d26c44d19a736a46714e905062ea853363a7d3813fde0826cbd2c1dafa4da135cc5635377aa7465aa1ef33591c52940f6ae
TLSH
T1F1B09232E66F4DB8A86C11A212A8AA06825D608A98914379A914CD01D59A926978340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 72be7018260a8eaaf3c15cf48df4a875472e64425bae7c1114af54374e51b20c
MD5 d2f8d4871a2719b86663bee9d50b7504
SHA1 eceedc1232a3f077c444ad6a21d5b81401fbee3b
SHA512 94241dc1acf3ab7ec7e0b5e63572e000817e6260df563ca90eb5aabb89ce0510d2a4d651cac921676f72e5110faa18b34ed11a9d7f0d15115d82a2ddaf84814f
TLSH
T1D6B09222E26F49B9A8AC01A212ACA906925D608A98514375A904CD40E6AA926968388C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 04783fc83512ed8b91cdff1090203a9d406a63a492983700abcc36077a87c179
MD5 747cc52fbbf04f2c98b65fcf0ab532f5
SHA1 1547a5835a4b56dc81a18e68b0b3bf01980a86dd
SHA512 fc2a4114007449201adbbe9dbf7ee8236a9f97bebe4fccb010ece78de10cfdca204e2c28c886008dfcb88716156393286a02f1ef645adac9df62772e30f3f12b
TLSH
T1A7B09262E26F4DB8A86C01A212A8A902925D648A9C515375B914CE00D59A9269B8340C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 6c7f8e861b7748113a0b28db570408c09ea4db10a13aab9e7ddc40a7045b401d
MD5 256ec14d1ef61a070b83f2d0946c626f
SHA1 cd19e031010a4861dc54a0b1223a815caf77ef88
SHA512 e5e57604c452de0253e64765acde3a2a0d2078bdd58fbf3bef947285a2efe2da1cb3d7222ac3988be90de0851070f8cf9a90c42b7898b022e1a57f11177df46b
TLSH
T1D6B09262E26F49B8A86C12A212A8A902825D708A98515375AA04DE00D59A926969344C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 aac2686a371e40ab4ac15193d99324aa58e5b572b15e52ecc8aa35ff451ba4e0
MD5 8fa0e689b3a0689d0912cd6d5f94e11a
SHA1 74baacf04668e3890e1411d065ce61119fb955cf
SHA512 bcb08854f5a0d1918ff935dbec6fdc26e185d8c9ceefd37309dca439429a99997a15cf7a65b3494a113c92614ed6148a976373e0a1d8f865a3a3322fa395c1af
TLSH
T109B09223E26F49B8A86C01A212ACAD02C25D608A98514376A914CD10D59A92A96C740C
MD5 SHA1 SHA512 TLSH

Submit Download

supervisor.heartbeat.json

Path C:\Users\Admin\AppData\Local\Bridge\supervisor.heartbeat.json
Size 123B
SHA256 238d428acf72aa72d217b912e55421b796759aee7a8b18acba16177a66f957ec
MD5 b5f47a87fc4fcf5ee58ec16545be24e4
SHA1 edc1d72eafa8c019e0cab1924adc7ac59c9ecafc
SHA512 f6d78a16c2abb8263107cea3fab9b26de9909ab20be07a63e481025d3e352e7847ca77a901a2d50bf387021da6e56e5f355fc0fe8d50f39515eb39ba5e998b30
TLSH
T1B9B09262E26F4DB9A8AC01A212A8A902826D608E98514375AA14CE00E5AB92A969340D
MD5 SHA1 SHA512 TLSH

Submit Download

BridgeAgent.exe

Path C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe
Size 7.5MB
SHA256 901315b7a1368a1f824330f46afc8a5448eeb08dda2e0d31aea4a89d1731f4a8
MD5 c531126e755d6a84fd71988296c0bf23
SHA1 769aaf695f46ce1acf351a427228edba7794a4d1
SHA512 1ba9e01aca377d1c5c279128ab4ab716e4401008b8c2be1fff6e442b0abbe5636239a29f1ae6e9bcaf3b9de11c162a1f10b7824eb325b71ec95ddf9ba3334952
SSDEEP 98304:MFN56U5URbY8J8TAn8C2N/irGLM9n46x:AX6PBdp
TLSH
T112862951BA6B58ACD597C8B483468A239E2130DB0B36B9FF01C486393F69BF05B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rcmybzpu.h1y.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rcmybzpu.h1y.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5472-147-0x000001F25EBC0000-0x000001F25EBDE000-memory.dmp

Download

memory/5472-152-0x000001F25FC80000-0x000001F2601A8000-memory.dmp

Download

memory/5472-148-0x000001F25EBE0000-0x000001F25EC92000-memory.dmp

Download

memory/5472-143-0x000001F25EB10000-0x000001F25EB32000-memory.dmp

Download

memory/5472-151-0x000001F25F580000-0x000001F25F742000-memory.dmp

Download

memory/5472-149-0x000001F25ECA0000-0x000001F25ECAA000-memory.dmp

Download

memory/5472-150-0x000001F25ECD0000-0x000001F25ECEE000-memory.dmp

Download