Overview

overview

8

Static

static

1

IriunWebcam-2.9.4.exe

windows11-21h2-x64

8

Resubmissions

26/04/2026, 14:37

260426-ry6rtsgw8s

26/04/2026, 14:32

260426-rwbtnsbz9n8

Analysis

  • user interaction
    yes
  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    26/04/2026, 14:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    IriunWebcam-2.9.4.exe
  • Size 4.3MB
  • Sample260426-rwbtnsbz9n
  • SHA256 3236c888cb250e5ea2163cad390d563e197dc1c07f7b46a853ac715e8e867f71
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryinstallerpersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 47 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 60 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\IriunWebcam-2.9.4.exe
    "C:\Users\Admin\AppData\Local\Temp\IriunWebcam-2.9.4.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\Users\Admin\AppData\Local\Temp\is-R5JJA.tmp\IriunWebcam-2.9.4.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-R5JJA.tmp\IriunWebcam-2.9.4.tmp" /SL5="$602EE,3428144,881152,C:\Users\Admin\AppData\Local\Temp\IriunWebcam-2.9.4.exe"
      2⤵
      • Downloads MZ/PE file
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:648
      • C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp\netcorecheck.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp\netcorecheck.exe" Microsoft.WindowsDesktop.App 10.0.5
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4500
      • C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp\dotnet100desktop.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp\dotnet100desktop.exe" /lcid 1033 /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3384
        • C:\Windows\TEMP\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\.ba\wixstdba.exe
          "C:\Windows\TEMP\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{3DD5BD1C-36E3-4AA9-A6CA-0F9825261F8F} {C01D2236-B17F-4E21-AA26-D078F4A54C1C}
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:4732
        • C:\Windows\TEMP\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\.be\windowsdesktop-runtime-10.0.5-win-x86.exe
          "C:\Windows\TEMP\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\.be\windowsdesktop-runtime-10.0.5-win-x86.exe" -q -burn.elevated BurnPipe.{C69D2C40-3BC9-49B8-B981-3408A746BEE0} {86AE3CA0-F0C0-4B5B-803E-D19420451B61} 3384
          4⤵
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4972
      • C:\Program Files (x86)\Iriun Webcam\devcon.exe
        "C:\Program Files (x86)\Iriun Webcam\devcon.exe" remove ROOT\IriunA0
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1440
      • C:\Program Files (x86)\Iriun Webcam\devcon.exe
        "C:\Program Files (x86)\Iriun Webcam\devcon.exe" remove ROOT\IriunA1
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2092
      • C:\Program Files (x86)\Iriun Webcam\devcon.exe
        "C:\Program Files (x86)\Iriun Webcam\devcon.exe" remove ROOT\IriunA2
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2068
      • C:\Program Files (x86)\Iriun Webcam\devcon.exe
        "C:\Program Files (x86)\Iriun Webcam\devcon.exe" remove ROOT\IriunA3
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:680
      • C:\Program Files (x86)\Iriun Webcam\devcon.exe
        "C:\Program Files (x86)\Iriun Webcam\devcon.exe" remove Root\iriunvid
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3648
      • C:\Program Files (x86)\Iriun Webcam\devcon.exe
        "C:\Program Files (x86)\Iriun Webcam\devcon.exe" remove root\Iriunv0
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2936
      • C:\Program Files (x86)\Iriun Webcam\devcon.exe
        "C:\Program Files (x86)\Iriun Webcam\devcon.exe" remove root\Iriunv1
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1228
      • C:\Program Files (x86)\Iriun Webcam\devcon.exe
        "C:\Program Files (x86)\Iriun Webcam\devcon.exe" remove root\Iriunv2
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1992
      • C:\Program Files (x86)\Iriun Webcam\devcon.exe
        "C:\Program Files (x86)\Iriun Webcam\devcon.exe" remove root\Iriunv3
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3828
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /u /s video32.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2796
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /u /s video64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:932
        • C:\Windows\system32\regsvr32.exe
          /u /s video64.dll"
          4⤵
          • Loads dropped DLL
          PID:1412
      • C:\Program Files (x86)\Iriun Webcam\devcon.exe
        "C:\Program Files (x86)\Iriun Webcam\devcon.exe" install iriunaud.inf ROOT\IriunA0
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3948
      • C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp\devgen.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp\devgen.exe" /add /bus ROOT /hardwareid root\IriunV0
        3⤵
        • Executes dropped EXE
        PID:1520
      • C:\Windows\system32\pnputil.exe
        "C:\Windows\Sysnative\pnputil.exe" /add-driver iriunv0.inf /install
        3⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        PID:696
      • C:\Program Files (x86)\Iriun Webcam\IriunWebcam.exe
        "C:\Program Files (x86)\Iriun Webcam\IriunWebcam.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3808
        • C:\Program Files (x86)\Iriun Webcam\adb.exe
          adb.exe devices
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4960
          • C:\Program Files (x86)\Iriun Webcam\adb.exe
            adb -L tcp:5037 fork-server server --reply-fd 596
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3160
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F1536DCA249C4AF2752055E87C4643B8
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5080
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4DC995BBCED18A1111C3841757DE90EC
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3140
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E1B22922816197AF8142A7A9AA351373
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2556
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A157D15A1A3E8BCBD720E8A185664F0F
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:428
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1FBC649DD458C3B37E6EFB3955F30ADA
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2168
  • C:\ProgramData\Package Cache\{9115642D-607F-4AB3-A613-67987F674692}\windowsdesktop-runtime-10.0.5-win-x86.exe
    "C:\ProgramData\Package Cache\{9115642D-607F-4AB3-A613-67987F674692}\windowsdesktop-runtime-10.0.5-win-x86.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:392
    • C:\ProgramData\Package Cache\{9115642D-607F-4AB3-A613-67987F674692}\windowsdesktop-runtime-10.0.5-win-x86.exe
      "C:\ProgramData\Package Cache\{9115642D-607F-4AB3-A613-67987F674692}\windowsdesktop-runtime-10.0.5-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.5_(x86)_20260426153425.log" /passive /lcid 1033 /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Windows\TEMP\{A3BED135-213A-41B7-BAC1-8DB24C38A4B0}\.ba\wixstdba.exe
        "C:\Windows\TEMP\{A3BED135-213A-41B7-BAC1-8DB24C38A4B0}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{5250A421-3CA7-4EB4-BB9C-09701F30F8A4} {99D4862C-584A-4461-A2AA-A1E42BD8F43A}
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:1700
      • C:\ProgramData\Package Cache\{9115642D-607F-4AB3-A613-67987F674692}\windowsdesktop-runtime-10.0.5-win-x86.exe
        "C:\ProgramData\Package Cache\{9115642D-607F-4AB3-A613-67987F674692}\windowsdesktop-runtime-10.0.5-win-x86.exe" -q -burn.elevated BurnPipe.{07CD52E9-0956-46E7-B8C6-EAF94715BC5C} {87697C1B-C2EE-489A-A412-63F23713B6BF} 2084
        3⤵
        • Adds Run key to start application
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3260
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of WriteProcessMemory
    PID:732
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ecaa03e7-098d-1f46-9aa3-9d0fde735dc5}\iriunaud.inf" "9" "49f3306f3" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "c:\users\admin\appdata\local\temp\is-gtlkc.tmp"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4440
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca115a9e2d13:IRIUNA0:1.2.0.0:root\iriuna0," "49f3306f3" "0000000000000154" "5416"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      PID:660
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{97993503-df38-dd48-a02c-6dd8496bbcef}\iriunv0.inf" "9" "4e904782f" "000000000000010C" "WinSta0\Default" "0000000000000178" "208" "C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2508
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "1" "ROOT\DEVGEN\{001EB5E3-806A-C640-AB23-EA81BB7BB02C}" "C:\Windows\System32\DriverStore\FileRepository\iriunv0.inf_amd64_a1ba3415e39b801b\iriunv0.inf" "oem4.inf:*:*:1.8.3.0:root\IriunV0," "4e904782f" "0000000000000154" "5416"
      2⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4864
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k CameraMonitor
    1⤵
    • Loads dropped DLL
    PID:2516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e594dea.rbs
        • Path C:\Config.Msi\e594dea.rbs
        • Size 10KB
        • SHA256 4ed1818b6272c955175ee5735d1e2a45d92031fb561d573c998cf3eaa72414b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e594def.rbs
        • Path C:\Config.Msi\e594def.rbs
        • Size 8KB
        • SHA256 67bc87c2c3d3d655c34f760551c02ffcef72dfec516d1af7db14c95e26fd6ae6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e594df4.rbs
        • Path C:\Config.Msi\e594df4.rbs
        • Size 49KB
        • SHA256 b6ffb4f8b3b777217ff6805ce218b7f5fb6ba907decc28fac9a1d30a9ce68b5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e594df9.rbs
        • Path C:\Config.Msi\e594df9.rbs
        • Size 72KB
        • SHA256 f476da7a855c90b1cc26bd26f6c81f3bfc9636813355b15cd9eb62fbb2b5e9bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e594dfd.rbs
        • Path C:\Config.Msi\e594dfd.rbs
        • Size 3KB
        • SHA256 e05b97ae700984eb925ea33166add50195f10751b82fb05f856911e0c521670d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        IriunWebcam.exe
        • Path C:\Program Files (x86)\Iriun Webcam\IriunWebcam.exe
        • Size 196KB
        • SHA256 7a40eb91b88a2c9998bb5c9e3b53fa3a6debee8ea6d11563dbdc909467ae4b90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        devcon.exe
        • Path C:\Program Files (x86)\Iriun Webcam\devcon.exe
        • Size 117KB
        • SHA256 8b9bf2c01136e203732dda5232924aff40ae67d6168d05ca80efd19902cb8fc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LICENSE.txt
        • Path C:\Program Files (x86)\dotnet\LICENSE.txt
        • Size 9KB
        • SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ThirdPartyNotices.txt
        • Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
        • Size 77KB
        • SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files (x86)\dotnet\dotnet.exe
        • Size 141KB
        • SHA256 47bffbee92300569c9129af5fcb3fba95a273d414ea970dabd4cc8e588af2a04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft Windows Desktop Runtime 10.0.5 (x86).swidtag
        • Path C:\Program Files (x86)\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.5 (x86).swidtag
        • Size 488B
        • SHA256 aee4b8ba8ecb2c21f0dbe8c4e282088c6e2cc29832d16231c07c150d7483f305
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        state.rsm
        • Path C:\ProgramData\Package Cache\{9115642D-607F-4AB3-A613-67987F674692}\state.rsm
        • Size 1KB
        • SHA256 7bf5bf81470cc27dc93c6b902bdf5fe5e78af612af125188d72d6c7277e368ad
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        state.rsm
        • Path C:\ProgramData\Package Cache\{9115642D-607F-4AB3-A613-67987F674692}\state.rsm
        • Size 1KB
        • SHA256 a5099c37c364c5553b19ccab439b38f4064aed215f0362b08e3ebafd6f17c4be
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        state.rsm
        • Path C:\ProgramData\Package Cache\{9115642D-607F-4AB3-A613-67987F674692}\state.rsm
        • Size 1KB
        • SHA256 d5a34ff1c94f1637db6ef571df61b519c041af68f8f6eb9251ab2b6c8c6ffd72
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft_Windows_Desktop_Runtime_10.0.5_(x86)_20260426153425_000_DotNetHost.log
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.5_(x86)_20260426153425_000_DotNetHost.log
        • Size 3KB
        • SHA256 167a981c58aa79c9ed049b5caa31dd7689a442e5fb47408e92f3c9896ce5ec65
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft_Windows_Desktop_Runtime_10.0.5_(x86)_20260426153425_001_DotNetHostFxr.log
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.5_(x86)_20260426153425_001_DotNetHostFxr.log
        • Size 44KB
        • SHA256 9433071f00467078af279fdda05b0305bb4d1b38eb6cd9ef5c38f7133f51da7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft_Windows_Desktop_Runtime_10.0.5_(x86)_20260426153425_002_DotNetRuntime.log
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.5_(x86)_20260426153425_002_DotNetRuntime.log
        • Size 3KB
        • SHA256 d00757fbbdbe7585f82931d83d3475c404e4e6a72d02e83ebd3385dbab2dd5e5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft_Windows_Desktop_Runtime_10.0.5_(x86)_20260426153425_003_WindowsDesktopRuntime.log
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.5_(x86)_20260426153425_003_WindowsDesktopRuntime.log
        • Size 2KB
        • SHA256 a6f77c289812cef8a9b578c6d919ef0a2fa45a457d2f85c6b9fdbdce3a47579c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        devgen.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp\devgen.exe
        • Size 65KB
        • SHA256 f5de902a9025503805adfbb15306e1cb1361774ec4470397d6210ba588b3651b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iriunaud.inf
        • Path C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp\iriunaud.inf
        • Size 7KB
        • SHA256 8e21019c4c8352a24e31af6f7fd1c04b9fc4b2b6a9656f742aeda01008e3af82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        netcorecheck.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp\netcorecheck.exe
        • Size 107KB
        • SHA256 ef10850b31b3dbe9ad6cf8cb55fb1f81a60ea9c5c0694b4b94b283601eb17c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        video32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp\video32.dll
        • Size 314KB
        • SHA256 88b1cd4fde23c0b57cec028b3931858d4ea13f759248b3a16c23c71f2d2f282d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        video64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-GTLKC.tmp\video64.dll
        • Size 392KB
        • SHA256 5fe4b3b4dd524d09fd123e609b0b6a711cb7d2523890d84aac380d32579844d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IriunWebcam-2.9.4.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-R5JJA.tmp\IriunWebcam-2.9.4.tmp
        • Size 3.4MB
        • SHA256 58e9cb38d0a4a1fad20b407525d3bcb1628c0ffae4c0dbaaca7416dbea5e1f5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DotNetHost
        • Path C:\Users\Admin\AppData\Local\Temp\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\DotNetHost
        • Size 900KB
        • SHA256 99ddd721981ea3933f1b570187fcff99eefbbb590877f14b4e04280e928a1180
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DotNetHostFxr
        • Path C:\Users\Admin\AppData\Local\Temp\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\DotNetHostFxr
        • Size 956KB
        • SHA256 9068ad818897828a7d3671738c6a520bb258e2ae5345e113d8ac4a1460310bf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DotNetRuntime
        • Path C:\Users\Admin\AppData\Local\Temp\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\DotNetRuntime
        • Size 26.0MB
        • SHA256 9c727b9dd818b234bb2b467fe3d9966890824219fa9cd31a3a738675f4a236c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WindowsDesktopRuntime
        • Path C:\Users\Admin\AppData\Local\Temp\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\WindowsDesktopRuntime
        • Size 26.7MB
        • SHA256 d36ba9c0f30074d12195b645a281082e81e9e550487627123f9e0c09df5bc0b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Iriunv.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{97993503-df38-dd48-a02c-6dd8496bbcef}\Iriunv.dll
        • Size 131KB
        • SHA256 eda6ffc68402951b37e1bd26b57854bd3a21777bdc5ce48ba04b79ae8be24832
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Iriunv0.cat
        • Path C:\Users\Admin\AppData\Local\Temp\{97993503-df38-dd48-a02c-6dd8496bbcef}\Iriunv0.cat
        • Size 12KB
        • SHA256 be8404feac3b5024a04df2c6a5597f1dc7a1f060ed13c8d04ce6210f8cd34d82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Iriunv0Driver.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{97993503-df38-dd48-a02c-6dd8496bbcef}\Iriunv0Driver.dll
        • Size 36KB
        • SHA256 b85b0301be08aaaa1c11a02ec8f796506d1175d5faa5764b633450d37f3fa5c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iriunv0.inf
        • Path C:\Users\Admin\AppData\Local\Temp\{97993503-df38-dd48-a02c-6dd8496bbcef}\iriunv0.inf
        • Size 7KB
        • SHA256 c14876191d8478c83cf7bc7045b78ba635533bcd11256da729d0bf1d996fbb99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iriuna1.sys
        • Path C:\Users\Admin\AppData\Local\Temp\{ecaa03e7-098d-1f46-9aa3-9d0fde735dc5}\iriuna1.sys
        • Size 40KB
        • SHA256 005f0353c5ece1100e58c342a98a26ca85ee30ecf5f95b277d62d804cae27871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iriuna2.sys
        • Path C:\Users\Admin\AppData\Local\Temp\{ecaa03e7-098d-1f46-9aa3-9d0fde735dc5}\iriuna2.sys
        • Size 40KB
        • SHA256 b8e46251b0cdb551bce5f9d4770b5c61cc6044d27a7ef569d9c918d3e0185048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iriuna3.sys
        • Path C:\Users\Admin\AppData\Local\Temp\{ecaa03e7-098d-1f46-9aa3-9d0fde735dc5}\iriuna3.sys
        • Size 40KB
        • SHA256 c6594b249133719931e406544e6121250861e75ef1b543c5bc87fc5a23a786b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI52AB.tmp
        • Path C:\Windows\Installer\MSI52AB.tmp
        • Size 346KB
        • SHA256 1caa470031f4f3fb53bb38187d522990a3a7423476b1b5aaa27443a3e2fc62c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BootstrapperApplicationData.xml
        • Path C:\Windows\TEMP\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\.ba\BootstrapperApplicationData.xml
        • Size 9KB
        • SHA256 852a4fe1c5b2ad08e9233d547b443e718667cc6296e580f6030b25497aa803f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DotNetLogo_256x.png
        • Path C:\Windows\TEMP\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\.ba\DotNetLogo_256x.png
        • Size 2KB
        • SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dotnet.ico
        • Path C:\Windows\TEMP\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\.ba\dotnet.ico
        • Size 44KB
        • SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\TEMP\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\.ba\thm.wxl
        • Size 7KB
        • SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.xml
        • Path C:\Windows\TEMP\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\.ba\thm.xml
        • Size 11KB
        • SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wixstdba.exe
        • Path C:\Windows\Temp\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\.ba\wixstdba.exe
        • Size 431KB
        • SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windowsdesktop-runtime-10.0.5-win-x86.exe
        • Path C:\Windows\Temp\{163DE4BC-FA45-4A5F-AAAA-6C6ABEF802DC}\.be\windowsdesktop-runtime-10.0.5-win-x86.exe
        • Size 967KB
        • SHA256 a55463d321f8db84fe7f98ca41520ba1e7f879a6e259e8aeae6cddaffd50c611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iriuna0.sys
        • Path \??\c:\users\admin\appdata\local\temp\is-gtlkc.tmp\iriuna0.sys
        • Size 40KB
        • SHA256 7efb11740cc777c77195f8c08feb2a8cdeff12c91e5207f612f16ee4db9fbb34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iriunaud.cat
        • Path \??\c:\users\admin\appdata\local\temp\is-gtlkc.tmp\iriunaud.cat
        • Size 13KB
        • SHA256 9860df3647200e6d1d2bdd886075dd65780cb888269bdcc91ac19b105a500adf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/648-25-0x0000000000410000-0x0000000000783000-memory.dmp
        Download

        memory/648-20-0x0000000000410000-0x0000000000783000-memory.dmp
        Download

        memory/648-1024-0x0000000000410000-0x0000000000783000-memory.dmp
        Download

        memory/648-37-0x0000000000410000-0x0000000000783000-memory.dmp
        Download

        memory/648-5-0x0000000003280000-0x0000000003281000-memory.dmp
        Download

        memory/648-21-0x0000000003280000-0x0000000003281000-memory.dmp
        Download

        memory/648-23-0x0000000000410000-0x0000000000783000-memory.dmp
        Download

        memory/2508-1021-0x00000182C7490000-0x00000182C749C000-memory.dmp
        Download

        memory/2560-795-0x0000019C5C9C0000-0x0000019C5C9CC000-memory.dmp
        Download

        memory/3948-946-0x000002B488870000-0x000002B48887C000-memory.dmp
        Download

        memory/4440-945-0x000002DFD3030000-0x000002DFD303C000-memory.dmp
        Download

        memory/4700-19-0x0000000000430000-0x0000000000517000-memory.dmp
        Download

        memory/4700-1-0x0000000000430000-0x0000000000517000-memory.dmp
        Download

        memory/4700-1025-0x0000000000430000-0x0000000000517000-memory.dmp
        Download

        memory/4972-722-0x0000000000140000-0x0000000000206000-memory.dmp
        Download