gurcu | hxxp://https[:]\/\/evoliongame[.]com\/Evolion%20Launcher[.]exe

Analysis

max time kernel
98s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2023 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://https:\/\/evoliongame.com\/Evolion%20Launcher.exe

Score

10^/10

gurcu stealer

Malware Config

Signatures

Gurcu
Gurcu stealer is a malware written in C#.
stealer gurcu
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Evolion Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	857248.exe

Executes dropped EXE 4 IoCs

pid	Process
5836	Evolion Launcher.exe
5944	Evolion Launcher.exe
2320	857248.exe
6136	Evolion.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\12a3653f-a5d1-42e2-ad37-69f439f1ddd3.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230502062436.pma	setup.exe
File opened for modification	C:\Program Files (x86)\EvolionGame	857248.exe
File created	C:\Program Files (x86)\EvolionGame\__tmp_rar_sfx_access_check_240619812	857248.exe
File created	C:\Program Files (x86)\EvolionGame\Evolion.exe	857248.exe
File opened for modification	C:\Program Files (x86)\EvolionGame\Evolion.exe	857248.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	powershell.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 810662.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4180	powershell.exe
4180	powershell.exe
4336	msedge.exe
4336	msedge.exe
2468	msedge.exe
2468	msedge.exe
4904	identity_helper.exe
4904	identity_helper.exe
5416	msedge.exe
5416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	5944	Evolion Launcher.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3336	2468	msedge.exe	86
PID 2468 wrote to memory of 3336	2468	msedge.exe	86
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4240	2468	msedge.exe	87
PID 2468 wrote to memory of 4336	2468	msedge.exe	88
PID 2468 wrote to memory of 4336	2468	msedge.exe	88
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90
PID 2468 wrote to memory of 748	2468	msedge.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://https:\/\/evoliongame.com\/Evolion%20Launcher.exe
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://https:\/\/evoliongame.com\/Evolion%20Launcher.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7fff3b0f46f8,0x7fff3b0f4708,0x7fff3b0f4718
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x158,0x144,0x140,0x134,0x14c,0x7ff66b745460,0x7ff66b745470,0x7ff66b745480
    3⤵
    PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5416
- C:\Users\Admin\Downloads\Evolion Launcher.exe
  "C:\Users\Admin\Downloads\Evolion Launcher.exe"
  2⤵
  - Executes dropped EXE
  PID:5836
- C:\Users\Admin\Downloads\Evolion Launcher.exe
  "C:\Users\Admin\Downloads\Evolion Launcher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5944
- - C:\Users\Admin\AppData\Local\Temp\857248.exe
    "C:\Users\Admin\AppData\Local\Temp\857248.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2320
  - - C:\Program Files (x86)\EvolionGame\Evolion.exe
      "C:\Program Files (x86)\EvolionGame\Evolion.exe"
      4⤵
      Executes dropped EXE
      PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,13373605445573010911,5298301147844552986,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\EvolionGame\Evolion.exe

Filesize
476.2MB

MD5
a781d1f4edcffa4b0d3ef2d568609e7d

SHA1
dc70df4d3eca98d622e92eb67f299c9a1aa180aa

SHA256
a1774baa7c046bf84cc8a86f3c9e9c0c8d20c6da2e7e751ef56a0cd1d065e06a

SHA512
578fbd7d03dd45d4d33a74c8c744fc1b91e309fd4673ed3c8be9fbbfe533344ea564ccbb51c37b1681430546860339743f7a93b8e3eeeb6af18055cd0aa39580

Download Submit
C:\Program Files (x86)\EvolionGame\Evolion.exe

Filesize
249.1MB

MD5
e4ab2502e0bcb5be2de38bda2a855362

SHA1
657d0d43607a59b8100a6e50cc7811e9715bd4f7

SHA256
70a1fc2f10bc346187054c35d7d62bd90bb90efef190d2d55870b6a0dbbbbea4

SHA512
7570411edabbc5c0eb9df9ae45fcaf371037d306497e02578c39dc2be821680031a54134998529d2d732e9dfddb29ef9e9ff809b91ab4fe0e51893c7a012b7a4

Download Submit
C:\Program Files (x86)\EvolionGame\Evolion.exe

Filesize
248.9MB

MD5
5b62a16e32665ab0b3cd7d5e0b4a3bfc

SHA1
bbf6a47cb94ef77e87441a2de9e98bafcd87a5ca

SHA256
c7eec22916d2c253ea30b930b79559e8dedf02a7d567da306f6ed9d334954d14

SHA512
c0411fa4d8e7c726c8e1cfa6a440ece8847930b7b87680da70f58f36affd6ce90add3f19e9697be0044f4751f1e0bec74ad5f5655b72f04aea2149ef1729facc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
099b4ba2787e99b696fc61528100f83f

SHA1
06e1f8b7391e1d548e49a1022f6ce6e7aa61f292

SHA256
cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8

SHA512
4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c358c24-10ed-4d9c-b608-6f41f872747d.tmp

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
161KB

MD5
4f020318bb92055ba415ec245a4c869c

SHA1
0bb97d09e3fd758853e68398af9e12177c4cac21

SHA256
41f3c9603c902be24cc4ae971fee6dd64deeb52f24e511241941ce209129b313

SHA512
f3b1d19900bdd2edd44d49bca6999cd67b9603c25395789ffdd35cf36d913db041d083f87dc33e8b1ac20fc434a3001996c34dcad5e16b301740e97b38dc6b83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
86a5951de974d15547f42620d2414245

SHA1
2c855e4a5d2df09a0fe48a4b62a5168b77a2fed0

SHA256
200de98171b50efafb1f4d01e78d77f6de96a86d647759523dcc624dd7aea5bb

SHA512
5c73e89d08463b04719a8f7ec224e756a1b7e414f9fb1a44cc1c4e00dca6edf111f87852200c3a87694578ea348b9a059240b36ba3397cbafba04bbe0944dffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9bc5a1d89fc410e5b2a196bdf48df887

SHA1
16dcef0687cd6b05826e61dcfd64ab02c273a7a5

SHA256
b8ef5a4990db6298f64e19c9391fa2a3dc573e31b1805a3f9339e025729a2cde

SHA512
19ae583a5a8b80e196f281369e9ae2f7cb52e6b97567a7ecd92bf6f5a53a6567456f0d1d5f041179a247ec4cfb93eae0fa4b9fc13ddde78a8f1fc73e3b8a4157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
b6bae8820cd8370058c5393411e4a740

SHA1
d1319f88468fa9fecdd9b8ad942fdf55168a280a

SHA256
7e4a03b8aa339d7f8ccfa9b355924d722ed866ce084818e217ef71e661b1d545

SHA512
f8436c9192b76838e1865d341e50c8a83bf080e6c536d89d2696d8ffbb9b44c132f1f61c980d0737ccb1c2e0ba61b19b1655b58e696129fd8c3c18c5d41767ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
532B

MD5
4295d5aa9eb485e3633804ddf24a9633

SHA1
a618c5f3a61cd3ce8b2e4f40054358f5b9da9f80

SHA256
7dd546ddd8457d62d31a05fc58ab713c45d0535ac081fa7e56fc287e9dd2d35d

SHA512
03d079d918c9498a58496b2d8e9faba9ffb1c4fae4a8e87c765517e942cfbf3495783b27d098d3b5460fbddd826c1ce855974fd8a8ade5af5a63530f8876d06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
727bdeb243692f4b530211a82ea3be83

SHA1
417784b36efe8ee3ff868ee292064ebd01614f4c

SHA256
1a5d69101b1c1c221216c5ea5a7a0b03c33630f805ddd5a862b34ae935e49510

SHA512
336cb15b1dd7e2cd9a38f73335d5cda420060afe8532d603ad3b5c96b97486dcf16181aee93a2308253d130cc0a5a341904362808c32f4e4bcd4aa0b1f6e1c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d14fe36b1dbd92f2844d694dd06356d

SHA1
4d571b1f7cbb56233e33e6c7c28bb9391253e0d9

SHA256
7399d9ab3ed414f3bdf6037c9a804fb066a9f889e957987250ab6a968fcbfe1d

SHA512
55d2ceb8290950ac7c8d4497580fa91e6b111db841be5ee9f22f5a35929971f216231b4d94a0a17e624e24c0f046337ff4371cf98f898f67a8f46fd53ada2c04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d24a07d1aba940435bc90fddb6b04cd7

SHA1
0bbcb20ec550346ad95c669583f35d3701303298

SHA256
59ddb919eefdc44caf4a93b9f84a840115037666c24b7a4514cf181e42196561

SHA512
737202a0b6d80ac4af743d6254205059bcc938444691bc376eefdf1a70f50b3beeebf5daf4f254ff87159691fa91b060d35a8555099698c074b2785d40ebb644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2373f210b2260536e03d052141c33684

SHA1
8687ec0b733e9dc50fa4fe6d731d1e9460b43195

SHA256
e3cbb523d74d4f5bc7b44aafb7b14f8909f201a79f858f421cc86a74dde2ecf5

SHA512
6a60d97e3821cbaea4feae0f00bbdd8db38d9858f70d6e7e35e08aad014a1ba4d87b2e5d7f25420a567ad1d8c6bc6d566319bacf2f47930bc3d6a1f22d8c0010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b7ae2712bbf5abf26a2b8fa65a2bad6

SHA1
f8e1452262b440d76edbf582e71492329e7c88bf

SHA256
1cc8175f6007bb2137f3f6f4f9e08bc6638599208872f2e3ef44f36663df777c

SHA512
b623502f106b57934451619b86195677c4e9368570c8ecb9c48986fe021f90506cfef0774afb2dfd8538a221c380d6f3310f5b4f391fb708c7058d0523a65c64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31c9c4b920779f94d143a2624201bfca

SHA1
0306a89dde3e07d2b4c432a22ade7971834679e1

SHA256
0e2f4b2fa1fd29e67ff9454d6456f34a8fcba942a46b13bb7545281aa2921228

SHA512
f0739e857de407daeef514ef4e4c9234d9214145963b27d5e5f36ca0b9883a7764b461c934ad40945fcee70db0bd8a423330094afd976c276b594d8b400d0cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b778a9929ebd2f2c0d58641205501bf2

SHA1
b6e3bae5b2a8a2cf2e5ba7094a4729fde3c26fc5

SHA256
8849c57406f7b35ca281dac23fa49331046b6ba4016b3656f28170ec8de9f5b5

SHA512
e9a95d395a8a0512adfe12bc0beb525f7517ecbc91125bcb291860240deea16f88979277917f16e740112df32089b75af82a41fa40ec2992e8469da00d6212bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3966348bbd403f0d73c498b32b42c474

SHA1
e831a80dc7540db9afced875d230530380ec5119

SHA256
85295f1484a81c8e36f1287dbb3d8c2ff4f80a5b2dc0985b88abcf49850d7542

SHA512
75a7fe567b809507d121ecfccd5cb85d7dc8e64609f916a450345a1ba959f7535767619970de25f9474c498666ad1b08250697222d5696f7a589f663a035c41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
849b621ac7dc79d6ea0934f311680d47

SHA1
b3756f4938c0cfdb605c19c0fe1352267c1c29b7

SHA256
1ca68de46eee6ad17716d7a863862be419b42395a4f41b63a9a1762eaee6564b

SHA512
09dbfcb9b011adc35f27e8081185248843052ba3b66e6de1eaa56735392b5b766dd24674dc3d1d06c16cb792b97ebaf2527dfb5924a51423e9018b7e8e77bc44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9e2e0a837f24e93170eead5fffb911f3

SHA1
a8e0f943d197ed3d0e21743ea614a194d4f3af27

SHA256
6adaba80b916a377e42445ef9abe013e8bb0e651d357135d537230bd27ffc71b

SHA512
e83dafe04dc0848d61f6224c36626a774a08b631172bb66062a472afe78ea7f7f701667fb1fa1007fd408291b8a17a0982fdda1dae58e8dac208318015ae2c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
13b576408eb5b6a44760fc9d437ac07b

SHA1
a598d41731d4a54f81f8a6fe24a7359550c39083

SHA256
33c762bc6797b45775e64feae7f9f6d59b2bdb07f02ea7f7b8703323f32cf9fa

SHA512
3720a36b5f974457fc46336bd6f34d4e66ea41c5165f5b2c7c3cfe75553b5169f5ae4b1ac1defe649d45fc3067e1db6303791097dcded5beaeb8db96bc0d6043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
d4dc072e0d82ed37e06ee23a2612cc5b

SHA1
910f3495aeb118f8c0efaf883370b843dff02e62

SHA256
2147318101c441bebbac2e7cb2fbebbb7077d88f8a5015e6641c2b9cc0b9622d

SHA512
5a2bf8483eb9d303cd5167ce34bd14946c0a225e33a3e292e1ded16ea6b93a6de06580b23142b869cf9450a1de6bb8f9096aad87e5c5e6b0c48107a3e38b9e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
6e5c7fb3d34bb5be451dac76410fe2e8

SHA1
3cb31a2a48b0ce344d1dea0a39b3eda619fa0a85

SHA256
78db44200207ebd9bd8066bc970e76f12793f37e6c5057cca68fe52b7b486cee

SHA512
2b3d8bbe99ebc4d7491ddcfe73b75128c17db01da1dcd16bdc266c78360c46cadc985b5c220d9d9f3325275a3f0afbad1595a8b2302ab14aa2da972cef795b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\857248.exe

Filesize
1.6MB

MD5
370854ad00e3e6db0523be72d3893dca

SHA1
e92eeeaba632ee0c7e6d5f0507e85aa08b10190d

SHA256
0ad38e279f77fa31979f86788245fcf8536e3341d24b56166f64d60daa98343a

SHA512
8ecbb2ade03b5db13c1743a0f50293a665cdf35a7c3c0b6569fa70c0d971938a9d84ca1dc53a5140f8436ccb12873016e5021b592ad1b2b152c6bc0d706c64ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\857248.exe

Filesize
1.6MB

MD5
370854ad00e3e6db0523be72d3893dca

SHA1
e92eeeaba632ee0c7e6d5f0507e85aa08b10190d

SHA256
0ad38e279f77fa31979f86788245fcf8536e3341d24b56166f64d60daa98343a

SHA512
8ecbb2ade03b5db13c1743a0f50293a665cdf35a7c3c0b6569fa70c0d971938a9d84ca1dc53a5140f8436ccb12873016e5021b592ad1b2b152c6bc0d706c64ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\857248.exe

Filesize
1.6MB

MD5
370854ad00e3e6db0523be72d3893dca

SHA1
e92eeeaba632ee0c7e6d5f0507e85aa08b10190d

SHA256
0ad38e279f77fa31979f86788245fcf8536e3341d24b56166f64d60daa98343a

SHA512
8ecbb2ade03b5db13c1743a0f50293a665cdf35a7c3c0b6569fa70c0d971938a9d84ca1dc53a5140f8436ccb12873016e5021b592ad1b2b152c6bc0d706c64ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zzdc1szc.lz1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4bf8d8eba79d77e28021b75c5946c875

SHA1
76bf3072d39696e418b4554759a673bf08ab8c3f

SHA256
819a08cc5dd37bf3780480cfa2d40721e93cba02eb517d7a5edc3562aad5091a

SHA512
fa5287d0157a872096a465831aedf8fc9e96645c7cb601b3f3676efb71349a0073ab1ec5c51eb845322ddde7b61686dd8ce30097b381563dc26d85806a353f26

Download Submit
C:\Users\Admin\Downloads\Evolion Launcher.exe

Filesize
1.4MB

MD5
ebdda35a64fdd77737a3ec887c3c63b9

SHA1
22bed885d16c61ee24a42a704ec1b1174dc1eccb

SHA256
e85101062f748f61e87f91bac8abcaa11b5754fb364b8e99cc67b9e7f0283edc

SHA512
e3cf15ede970349d1f35f3334c4d2bf4c6bf2c9664a704405b22a7f315637942bba64dacff86875343f294891033295666421791b43ff371035ca24d3dbebb0e

Download Submit
C:\Users\Admin\Downloads\Evolion Launcher.exe

Filesize
1.4MB

MD5
ebdda35a64fdd77737a3ec887c3c63b9

SHA1
22bed885d16c61ee24a42a704ec1b1174dc1eccb

SHA256
e85101062f748f61e87f91bac8abcaa11b5754fb364b8e99cc67b9e7f0283edc

SHA512
e3cf15ede970349d1f35f3334c4d2bf4c6bf2c9664a704405b22a7f315637942bba64dacff86875343f294891033295666421791b43ff371035ca24d3dbebb0e

Download Submit
C:\Users\Admin\Downloads\Evolion Launcher.exe

Filesize
1.4MB

MD5
ebdda35a64fdd77737a3ec887c3c63b9

SHA1
22bed885d16c61ee24a42a704ec1b1174dc1eccb

SHA256
e85101062f748f61e87f91bac8abcaa11b5754fb364b8e99cc67b9e7f0283edc

SHA512
e3cf15ede970349d1f35f3334c4d2bf4c6bf2c9664a704405b22a7f315637942bba64dacff86875343f294891033295666421791b43ff371035ca24d3dbebb0e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 810662.crdownload

Filesize
1.4MB

MD5
ebdda35a64fdd77737a3ec887c3c63b9

SHA1
22bed885d16c61ee24a42a704ec1b1174dc1eccb

SHA256
e85101062f748f61e87f91bac8abcaa11b5754fb364b8e99cc67b9e7f0283edc

SHA512
e3cf15ede970349d1f35f3334c4d2bf4c6bf2c9664a704405b22a7f315637942bba64dacff86875343f294891033295666421791b43ff371035ca24d3dbebb0e

Download Submit
memory/4180-142-0x000001D6F1AA0000-0x000001D6F1AC2000-memory.dmp

Filesize
136KB

Download
memory/4180-143-0x000001D6EE5D0000-0x000001D6EE5E0000-memory.dmp

Filesize
64KB

Download
memory/4180-144-0x000001D6EE5D0000-0x000001D6EE5E0000-memory.dmp

Filesize
64KB

Download
memory/5836-487-0x0000000005490000-0x00000000054A0000-memory.dmp

Filesize
64KB

Download
memory/5836-502-0x0000000005490000-0x00000000054A0000-memory.dmp

Filesize
64KB

Download
memory/5836-526-0x0000000005490000-0x00000000054A0000-memory.dmp

Filesize
64KB

Download
memory/5836-507-0x0000000005490000-0x00000000054A0000-memory.dmp

Filesize
64KB

Download
memory/5836-527-0x0000000005490000-0x00000000054A0000-memory.dmp

Filesize
64KB

Download
memory/5836-503-0x0000000005490000-0x00000000054A0000-memory.dmp

Filesize
64KB

Download
memory/5836-486-0x0000000000B40000-0x0000000000CA6000-memory.dmp

Filesize
1.4MB

Download
memory/5944-489-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/5944-500-0x0000000008800000-0x0000000008838000-memory.dmp

Filesize
224KB

Download
memory/5944-501-0x00000000087D0000-0x00000000087DE000-memory.dmp

Filesize
56KB

Download
memory/5944-499-0x0000000008730000-0x0000000008738000-memory.dmp

Filesize
32KB

Download
memory/5944-529-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/5944-517-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/5944-528-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/5944-504-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download