Overview

overview

8

Static

static

1

evolis-pre...-2.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    495s
  • max time network
    478s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 17:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    evolis-premium-suite-2.exe
  • Size 210.1MB
  • Sample260925-vrt18ss16j
  • SHA256 25e96dfd9a35db4da1968584dec967bbab7a3b5ce032e74e5e29ccf6133996b1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistencespywaretrojan

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Drops file in System32 directory 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Executes dropped EXE 40 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 19 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 22 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 12 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\evolis-premium-suite-2.exe
    "C:\Users\Admin\AppData\Local\Temp\evolis-premium-suite-2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Users\Admin\AppData\Local\Temp\is-SGLTJ.tmp\evolis-premium-suite-2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-SGLTJ.tmp\evolis-premium-suite-2.tmp" /SL5="$F0042,219921339,157184,C:\Users\Admin\AppData\Local\Temp\evolis-premium-suite-2.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4788
      • C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_drv.exe
        "C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_drv.exe" /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCANCEL /CHECKPRE=yes /INSTYPE=type1
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4220
        • C:\Users\Admin\AppData\Local\Temp\is-KKC6M.tmp\setup_drv.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-KKC6M.tmp\setup_drv.tmp" /SL5="$801F8,8991061,157184,C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_drv.exe" /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCANCEL /CHECKPRE=yes /INSTYPE=type1
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:2512
      • C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_minimal_mode.exe
        "C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_minimal_mode.exe" /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCANCEL /CHECKPRE=yes /INSTYPE=type1
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5940
        • C:\Users\Admin\AppData\Local\Temp\is-UCAPP.tmp\setup_minimal_mode.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-UCAPP.tmp\setup_minimal_mode.tmp" /SL5="$901F8,165229615,157184,C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_minimal_mode.exe" /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCANCEL /CHECKPRE=yes /INSTYPE=type1
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4844
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evomanager.exe
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2456
            • C:\Windows\System32\taskkill.exe
              taskkill /F /IM evomanager.exe
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1508
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evocom.exe
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2904
            • C:\Windows\System32\taskkill.exe
              taskkill /F /IM evocom.exe
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5508
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evosettings.exe
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1068
            • C:\Windows\System32\taskkill.exe
              taskkill /F /IM evosettings.exe
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4556
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evoprn.exe
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2440
            • C:\Windows\System32\taskkill.exe
              taskkill /F /IM evoprn.exe
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4400
      • C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_standard_mode.exe
        "C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_standard_mode.exe" /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCANCEL /CHECKPRE=yes /INSTYPE=type1
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2508
        • C:\Users\Admin\AppData\Local\Temp\is-UCLI5.tmp\setup_standard_mode.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-UCLI5.tmp\setup_standard_mode.tmp" /SL5="$A01F8,46429393,157184,C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_standard_mode.exe" /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOCANCEL /CHECKPRE=yes /INSTYPE=type1
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1516
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evomanager.exe
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2816
            • C:\Windows\System32\taskkill.exe
              taskkill /F /IM evomanager.exe
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2840
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evonotify.exe
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5376
            • C:\Windows\System32\taskkill.exe
              taskkill /F /IM evonotify.exe
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4528
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C "NET STOP "Evolis Services Provider 2""
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1120
            • C:\Windows\System32\net.exe
              NET STOP "Evolis Services Provider 2"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3412
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 STOP "Evolis Services Provider 2"
                7⤵
                  PID:5816
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /C "sc.exe delete "Evolis Services Provider 2""
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1176
              • C:\Windows\System32\sc.exe
                sc.exe delete "Evolis Services Provider 2"
                6⤵
                • Launches sc.exe
                PID:5868
        • C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\fake.exe
          "C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\fake.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1964
          • C:\Users\Admin\AppData\Local\Temp\is-D7963.tmp\fake.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-D7963.tmp\fake.tmp" /SL5="$601E6,157184,157184,C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\fake.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:2796
        • C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_drv.exe
          "C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_drv.exe" /PGFALL=0 /RES=0 /DI=1 /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /SILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /INSTYPE=type1
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2948
          • C:\Users\Admin\AppData\Local\Temp\is-J3DNK.tmp\setup_drv.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-J3DNK.tmp\setup_drv.tmp" /SL5="$70246,8991061,157184,C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_drv.exe" /PGFALL=0 /RES=0 /DI=1 /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /SILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /INSTYPE=type1
            4⤵
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1256
            • C:\Users\Admin\AppData\Local\Temp\is-3QR3R.tmp\fake.exe
              "C:\Users\Admin\AppData\Local\Temp\is-3QR3R.tmp\fake.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2996
              • C:\Users\Admin\AppData\Local\Temp\is-11OJE.tmp\fake.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-11OJE.tmp\fake.tmp" /SL5="$4003E,157184,157184,C:\Users\Admin\AppData\Local\Temp\is-3QR3R.tmp\fake.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:4804
            • C:\Users\Admin\AppData\Local\Temp\is-3QR3R.tmp\EvoCer.exe
              "C:\Users\Admin\AppData\Local\Temp\is-3QR3R.tmp\EvoCer.exe" -add EvoCer.dat
              5⤵
              • Manipulates Digital Signatures
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              PID:5772
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoDIFx.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoDIFx.exe" /p "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf" 20
              5⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Executes dropped EXE
              PID:2040
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 6 EVOLIS_PRIMACY_2\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:3984
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 6 EVOLIS_AGILIA\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:1984
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 6 EVOLIS_EPX300\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:3676
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 6 EVOLIS_EPX200\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:4796
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 6 EVOLIS_ZENIUS_2_CLASSIC\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:3688
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 6 EVOLIS_ZENIUS_2_EXPERT\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:4876
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 6 EVOLIS_EVOBOOT\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:5640
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoDIFx.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoDIFx.exe" /f "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf"
              5⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              PID:2480
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 7 EVOLIS_PRIMACY_2\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf" "Evolis Primacy 2"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:5668
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 7 EVOLIS_AGILIA\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf" "Evolis Agilia"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:3816
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 7 EVOLIS_EPX300\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf" EPX300
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:1712
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 7 EVOLIS_EPX200\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf" EPX200
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:2000
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 7 EVOLIS_ZENIUS_2_CLASSIC\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf" "Evolis Zenius 2 Classic"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:3132
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 7 EVOLIS_ZENIUS_2_EXPERT\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf" "Evolis Zenius 2 Expert"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:756
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe" 7 EVOLIS_EVOBOOT\ "C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf" "Evolis EvoBoot"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:6128
        • C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_minimal_mode.exe
          "C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_minimal_mode.exe" /PGFALL=0 /RES=0 /DI=1 /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /SILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /INSTYPE=type1
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4760
          • C:\Users\Admin\AppData\Local\Temp\is-8NTLR.tmp\setup_minimal_mode.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-8NTLR.tmp\setup_minimal_mode.tmp" /SL5="$80246,165229615,157184,C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_minimal_mode.exe" /PGFALL=0 /RES=0 /DI=1 /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /SILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /INSTYPE=type1
            4⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2780
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evomanager.exe
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:624
              • C:\Windows\System32\taskkill.exe
                taskkill /F /IM evomanager.exe
                6⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2376
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evocom.exe
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2548
              • C:\Windows\System32\taskkill.exe
                taskkill /F /IM evocom.exe
                6⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1796
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evosettings.exe
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3296
              • C:\Windows\System32\taskkill.exe
                taskkill /F /IM evosettings.exe
                6⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2008
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evoprn.exe
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1228
              • C:\Windows\System32\taskkill.exe
                taskkill /F /IM evoprn.exe
                6⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3836
        • C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_standard_mode.exe
          "C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_standard_mode.exe" /PGFALL=0 /RES=0 /DI=1 /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /SILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /INSTYPE=type1 /SPNOT=1
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2040
          • C:\Users\Admin\AppData\Local\Temp\is-KLO32.tmp\setup_standard_mode.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-KLO32.tmp\setup_standard_mode.tmp" /SL5="$B023E,46429393,157184,C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_standard_mode.exe" /PGFALL=0 /RES=0 /DI=1 /LANG=English /DIR="C:\Program Files\Evolis Card Printer 2" /GROUP="Evolis Card Printer 2" /SILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /INSTYPE=type1 /SPNOT=1
            4⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5044
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evomanager.exe
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3984
              • C:\Windows\System32\taskkill.exe
                taskkill /F /IM evomanager.exe
                6⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4316
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /C taskkill /F /IM evonotify.exe
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4980
              • C:\Windows\System32\taskkill.exe
                taskkill /F /IM evonotify.exe
                6⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3164
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /C "NET STOP "Evolis Services Provider 2""
              5⤵
              • Executes a command shell one-liner
              PID:3860
              • C:\Windows\System32\net.exe
                NET STOP "Evolis Services Provider 2"
                6⤵
                  PID:1864
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 STOP "Evolis Services Provider 2"
                    7⤵
                      PID:4164
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C "sc.exe delete "Evolis Services Provider 2""
                  5⤵
                  • Executes a command shell one-liner
                  PID:2708
                  • C:\Windows\System32\sc.exe
                    sc.exe delete "Evolis Services Provider 2"
                    6⤵
                    • Launches sc.exe
                    PID:2840
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C "sc.exe create "Evolis Services Provider 2" start= auto binPath= "\"C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\bin\evoservice.exe\"""
                  5⤵
                  • Executes a command shell one-liner
                  PID:2852
                  • C:\Windows\System32\sc.exe
                    sc.exe create "Evolis Services Provider 2" start= auto binPath= "\"C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\bin\evoservice.exe\""
                    6⤵
                    • Launches sc.exe
                    PID:3508
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C "sc.exe description "Evolis Services Provider 2" "Evolis Services Provider 2""
                  5⤵
                  • Executes a command shell one-liner
                  PID:3136
                  • C:\Windows\System32\sc.exe
                    sc.exe description "Evolis Services Provider 2" "Evolis Services Provider 2"
                    6⤵
                    • Launches sc.exe
                    PID:4420
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C "NET START "Evolis Services Provider 2""
                  5⤵
                  • Executes a command shell one-liner
                  PID:6124
                  • C:\Windows\System32\net.exe
                    NET START "Evolis Services Provider 2"
                    6⤵
                      PID:3260
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 START "Evolis Services Provider 2"
                        7⤵
                          PID:4352
                    • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\bin\evonotify.exe
                      "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\bin\evonotify.exe"
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Reads the TCP/IP host and domain name from the registry
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:4192
                • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\bin\evomanager.exe
                  "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\bin\evomanager.exe" -n
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: AddClipboardFormatListener
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of FindShellTrayWindow
                  PID:4128
                • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\bin\evomanager.exe
                  "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\bin\evomanager.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: AddClipboardFormatListener
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of FindShellTrayWindow
                  PID:4532
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{336fcd7f-d92e-9943-93d6-d42010991470}\evoun02.inf" "9" "47bd6cd97" "0000000000000130" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files\Evolis Card Printer 2\Evolis Drivers"
              1⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:720
            • C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\bin\evoservice.exe
              "C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\bin\evoservice.exe"
              1⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5680
            • C:\PROGRA~1\EVOLIS~1\EVOLIS~2\bin\evonotify.exe
              C:\PROGRA~1\EVOLIS~1\EVOLIS~2\bin\EVONOT~1.EXE
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1568
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:4876

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    Windows Command Shell

                    1
                    T1059.003

                    System Services

                    2
                    T1569

                    Service Execution

                    2
                    T1569.002

                    Persistence

                    Create or Modify System Process

                    2
                    T1543

                    Windows Service

                    2
                    T1543.003

                    Privilege Escalation

                    Create or Modify System Process

                    2
                    T1543

                    Windows Service

                    2
                    T1543.003

                    Defense Evasion

                    Impair Defenses

                    1
                    T1562

                    Modify Registry

                    1
                    T1112

                    Subvert Trust Controls

                    2
                    T1553

                    Install Root Certificate

                    1
                    T1553.004

                    SIP and Trust Provider Hijacking

                    1
                    T1553.003

                    Credential Access

                    Discovery

                    Peripheral Device Discovery

                    1
                    T1120

                    Query Registry

                    2
                    T1012

                    System Information Discovery

                    2
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Network Configuration Discovery

                    1
                    T1016

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Service Stop

                    1
                    T1489

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    agilia.gpd
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\agilia.gpd
                    • Size 37KB
                    • SHA256 30d349517a856605820fd9f0c147e5672b2b17cbfb23f92ec242d163ae65d442
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02DRV.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02DRV.DLL
                    • Size 651KB
                    • SHA256 d480dc7af11d3a72337b8328c68016063a9a0aeade20c3e8c9ca5dc24734b8ee
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_AR.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_AR.DLL
                    • Size 30KB
                    • SHA256 bab7344a83518f9a3e607864f0cf940336c712b0cf5e24b8106ebcbc70ebff73
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_DE.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_DE.DLL
                    • Size 30KB
                    • SHA256 5d400ab7d394a39943294884f18d2ae1db5c7331e007dee20682453bef4906e3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_EN.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_EN.DLL
                    • Size 30KB
                    • SHA256 461e2c883df51dcf76ff256a5a21e9fde91d3a2b06294211e3452f67d9fa4273
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_ES.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_ES.DLL
                    • Size 31KB
                    • SHA256 15a07c85d0dfd4f4be186373f22f26b1d8402630615b55fef5f6ecfb1f1560be
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_FA.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_FA.DLL
                    • Size 29KB
                    • SHA256 68702b97ffd651da8bee0a1c2ada92b0ae319a35ffc4c1297e607c757835f5b9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_FR.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_FR.DLL
                    • Size 31KB
                    • SHA256 4818d60c38d43159038d6635d67d3fa878786e185780fd551377ec7fdf3a9d31
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_IT.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_IT.DLL
                    • Size 31KB
                    • SHA256 09ab3069638123b734faa85db3311ad0bd60cb689feb8cf6002a9bb943f99d0e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_JA.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_JA.DLL
                    • Size 27KB
                    • SHA256 021e1dca620dd796f6e0e77823954d6bb762cfdc3e327af41639f0f9f933e669
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_KO.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_KO.DLL
                    • Size 27KB
                    • SHA256 0f0ef1ac64610b026c5b5e42b31708e74879a9d971b541a7fad1a5429396dae6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_NL.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_NL.DLL
                    • Size 30KB
                    • SHA256 8be34683e7df084578a7421410892066fe671449b48d077c06464c19ae6d86ac
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_PL.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_PL.DLL
                    • Size 31KB
                    • SHA256 a264217bb92565b775ccdc11133a0d2de3c32cb4ff75e3a5c09abbee1f6db38c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_PT.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_PT.DLL
                    • Size 31KB
                    • SHA256 db6605681854beb4c1122de19322b085d37893ca7ca353a66400fd0915e2cc11
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_RU.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_RU.DLL
                    • Size 31KB
                    • SHA256 49ab140c41db2ca7d5e613db69a47568781ed199c2a882bb3d480714e0fc0bbd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_TR.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_TR.DLL
                    • Size 30KB
                    • SHA256 a65e2983960e80e6bedbcd2d2c0c8aa50c1f2469bb959ba2c4069a06f2b3d460
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_ZH.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_ZH.DLL
                    • Size 27KB
                    • SHA256 64bc82befa25dfe3c95eb9d37ee13113a63a36315d10c7edcd8fb5032d3d4d1a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02GPD_ZH1.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02GPD_ZH1.DLL
                    • Size 27KB
                    • SHA256 091a8d0270c2dbd8c095ff60f67d7f25e3f1d213c0c884d58193244776d371a7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02MON.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02MON.DLL
                    • Size 1.9MB
                    • SHA256 459020bba1f0a728add325f0052f0fcad2b2c7b4d1365f4e561e3525372e77be
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EVOUN02UI.DLL
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\amd64\EVOUN02UI.DLL
                    • Size 599KB
                    • SHA256 49823f1475fc2e6f07da32b7fb8c12375180ca6e95527ddadf0fef349f1fe125
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    epx200.gpd
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\epx200.gpd
                    • Size 29KB
                    • SHA256 090cc76464cb0743cb6991e587a70826ace9d9de58a5787716af7470c9561dd2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    epx300.gpd
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\epx300.gpd
                    • Size 43KB
                    • SHA256 d3a774335d0eccfdd62ec9e7a7824d39082c9c04f14bb43a65f147259a1a5e20
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    evoboot.gpd
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\evoboot.gpd
                    • Size 29KB
                    • SHA256 61570c57ea9b2cfad3585a9f9f970d3d01137b7c78272d0b624243f848d5f35c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    evoun02.cat
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\evoun02.cat
                    • Size 32KB
                    • SHA256 4314529e20128667134697757e38117b53af0b9056e8d564662e4d3a7b58f3ee
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    evoun02.ini
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\evoun02.ini
                    • Size 73B
                    • SHA256 72ec7a78e7a79b7cae505332699852a3050230c8973584f7ca42955978efd58c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    primacy2.gpd
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\primacy2.gpd
                    • Size 49KB
                    • SHA256 969b70b381fade9fe2303bfada652a97a081e128d931ae4277534600e7e842fe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    zenius2classic.gpd
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\zenius2classic.gpd
                    • Size 31KB
                    • SHA256 39265d29a6714f2f5f9980a982d23a3ada3be56a39b39340a1e9bba6917b76d3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    zenius2expert.gpd
                    • Path C:\PROGRA~1\EVOLIS~1\EVOLIS~1\zenius2expert.gpd
                    • Size 36KB
                    • SHA256 2ca1952a5baa2048baeaf1fe7d69aa21b3a1ed5c1c1e479a2bdfdeb5273e71c1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    evoun02.inf
                    • Path C:\Program Files\Evolis Card Printer 2\Evolis Drivers\evoun02.inf
                    • Size 5KB
                    • SHA256 03b2d67dd136ef3a9e498bb22ff5229b121dd44493798dca492aebca2787b917
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    is-BFKJD.tmp
                    • Path C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\bin\defaultOptions\is-BFKJD.tmp
                    • Size 838B
                    • SHA256 2ff83d4dc730f600d55a248d9851f312c43b9a9e583b462170131ad972d66b69
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    EvoDIFx.exe
                    • Path C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoDIFx.exe
                    • Size 74KB
                    • SHA256 a8890b2bddbad5a496ac72d46dfe24bdebba98b3ba33b6755a2f0445c3b23135
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EvoHlp1.exe
                    • Path C:\Program Files\Evolis Card Printer 2\Evolis Premium Suite 2\tools\amd64\EvoHlp1.exe
                    • Size 236KB
                    • SHA256 83523faac210dd08f37df1445b390d164a0eb15376feda3cc5cdbc2b00f18d9a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    is-C12DK.tmp
                    • Path C:\Program Files\Evolis Card Printer 2\is-C12DK.tmp
                    • Size 798KB
                    • SHA256 eaf7bf70297aac744329244cda90dd405b2726e85f1f9678d70b1df3b40e461c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    unins000.dat
                    • Path C:\Program Files\Evolis Card Printer 2\unins000.dat
                    • Size 137KB
                    • SHA256 2840605019b8cc61c8fd9f955c69b5d6563e60d35b8daee2aafe9d382afa39d9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EvoCer.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\is-3QR3R.tmp\EvoCer.dat
                    • Size 1KB
                    • SHA256 78a6b61aff948052ca75afefe57c69d1197d351b92e83ff8d13e5cbcca4b7355
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    EvoCer.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\is-3QR3R.tmp\EvoCer.exe
                    • Size 57KB
                    • SHA256 70526b307e8afe6aa8735f6b341175ba5ddd033829e37260d67c46b2f63ef86f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _RegDLL.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\is-C0I5Q.tmp\_isetup\_RegDLL.tmp
                    • Size 4KB
                    • SHA256 4dc09bac0613590f1fac8771d18af5be25a1e1cb8fdbf4031aa364f3057e74a2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    _setup64.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\is-C0I5Q.tmp\_isetup\_setup64.tmp
                    • Size 6KB
                    • SHA256 a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _shfoldr.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\is-DH3SU.tmp\_isetup\_shfoldr.dll
                    • Size 22KB
                    • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    fake.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\fake.exe
                    • Size 402KB
                    • SHA256 53a63b1b6703aadc1a94d4d751b18cb9089de75c4690ba2bd9aeeada74a73e21
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    setup_drv.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_drv.exe
                    • Size 8.9MB
                    • SHA256 3401c38df446f2e9dc7cc341556353400d73adc64063bfddfa9bb94bfbcec5df
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    setup_standard_mode.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\is-FA9IC.tmp\setup_standard_mode.exe
                    • Size 44.6MB
                    • SHA256 e68471b5f3f53f2074692716cea5a02dd662409cf20d8956f03585602e5a5350
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    evolis-premium-suite-2.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\is-SGLTJ.tmp\evolis-premium-suite-2.tmp
                    • Size 788KB
                    • SHA256 1fd3e35d4a629c7f99b847d426450096037cd97dabbb64bf4b58b3c0458a2702
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    settings.ini.LJJPRm
                    • Path C:\Users\Admin\AppData\Roaming\Evolis\Evolis Premium Suite 2\settings.ini.LJJPRm
                    • Size 59B
                    • SHA256 92715812d2b7bf3b92613c0cb137e62e486bf1346e56d65819a79b0f532fdc67
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    settings.ini.fmBMlR
                    • Path C:\Users\Admin\AppData\Roaming\Evolis\Evolis Premium Suite 2\settings.ini.fmBMlR
                    • Size 24B
                    • SHA256 fa85ec847d3c310d7d474ca8ec25f2adb57747a8c3ed33ac0e785d43a4764801
                    • MD5 SHA1 SHA512
                    Submit Download

                    dberr.txt
                    • Path C:\Windows\System32\CatRoot2\dberr.txt
                    • Size 70KB
                    • SHA256 1f8c4630d76dcfc7a2b2c6e6cc7c1e3b5075d8e92d6ce1ed8187fe40c375ae67
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    evoun02.inf_amd64_f68bc2d193114993.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\evoun02.inf_amd64_f68bc2d193114993.ini
                    • Size 2KB
                    • SHA256 7ba9898c5f3127256f18ab73ee6f4e11aba1c1de37189bf52f84db086c7561dd
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/1256-366-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/1516-93-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/1568-631-0x00007FFC13F40000-0x00007FFC14501000-memory.dmp
                    Download

                    memory/1964-107-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/1964-120-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/2040-551-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/2040-647-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/2508-94-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/2508-80-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/2512-53-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/2512-55-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/2512-47-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/2656-20-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/2656-0-0x000000000040D000-0x000000000040E000-memory.dmp
                    Download

                    memory/2656-1-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/2780-549-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/2780-463-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/2796-119-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/2948-122-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/2948-367-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/2996-260-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/2996-275-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/4128-658-0x00007FFC13F40000-0x00007FFC14501000-memory.dmp
                    Download

                    memory/4128-659-0x00007FF7B7B00000-0x00007FF7BC072000-memory.dmp
                    Download

                    memory/4192-640-0x00007FFC13F40000-0x00007FFC14501000-memory.dmp
                    Download

                    memory/4220-39-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/4220-56-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/4760-462-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/4760-550-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/4760-368-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/4788-793-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1044-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-841-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-423-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-19-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-23-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-25-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-616-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-27-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-29-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-33-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1271-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1201-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1179-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1158-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-663-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-690-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-718-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-742-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-767-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-9-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-817-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-273-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-865-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-888-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-913-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-939-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-967-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-983-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1004-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1024-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-8-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1067-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1085-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1104-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1122-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4788-1142-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4804-274-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/4844-74-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/5044-646-0x0000000000400000-0x00000000004D5000-memory.dmp
                    Download

                    memory/5940-75-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download

                    memory/5940-61-0x0000000000400000-0x000000000042D000-memory.dmp
                    Download