d14fbebd7ded3c2bb933567ddcbdf4636ba00e5058042512d3a2d3b2b34e24e6

Analysis

user interaction
yes
max time kernel
181s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EvoVisLauncher.exe
Size 67.7MB
Sample260929-whe2dsty4r
SHA256 d14fbebd7ded3c2bb933567ddcbdf4636ba00e5058042512d3a2d3b2b34e24e6
MD5 02d3fe2bbb2bf26f11666d887e29c368
SHA1 c45d556021fa839b62455a15235533603d2fd7c6
SHA512 308b4726fecbd4b880fe50034e7db647e3e23b8c6f78f02914579314cd9e39fa1040e23127ab9177887d6a61117c6746c1c0257532094255a327f3dd70b7dacd
SSDEEP 1572864:sLciAhSEv4KmeoGcyIj8IJnYKrb0wD/Bfqakgg8:hSjKFDOjVdVD/Hkm
TLSH
T167F72356E2F900E8D57BC0B8C6574627EBB278551330A7DB56A48A692F33FE06E3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	EvoVisLauncher.exe

Loads dropped DLL 62 IoCs

pid	Process
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EvoVisLauncher.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	EvoVisLauncher.exe
File opened (read-only)	\??\K:	EvoVisLauncher.exe
File opened (read-only)	\??\Q:	EvoVisLauncher.exe
File opened (read-only)	\??\T:	EvoVisLauncher.exe
File opened (read-only)	\??\U:	EvoVisLauncher.exe
File opened (read-only)	\??\A:	EvoVisLauncher.exe
File opened (read-only)	\??\B:	EvoVisLauncher.exe
File opened (read-only)	\??\E:	EvoVisLauncher.exe
File opened (read-only)	\??\I:	EvoVisLauncher.exe
File opened (read-only)	\??\M:	EvoVisLauncher.exe
File opened (read-only)	\??\N:	EvoVisLauncher.exe
File opened (read-only)	\??\R:	EvoVisLauncher.exe
File opened (read-only)	\??\W:	EvoVisLauncher.exe
File opened (read-only)	\??\H:	EvoVisLauncher.exe
File opened (read-only)	\??\J:	EvoVisLauncher.exe
File opened (read-only)	\??\P:	EvoVisLauncher.exe
File opened (read-only)	\??\S:	EvoVisLauncher.exe
File opened (read-only)	\??\V:	EvoVisLauncher.exe
File opened (read-only)	\??\X:	EvoVisLauncher.exe
File opened (read-only)	\??\L:	EvoVisLauncher.exe
File opened (read-only)	\??\O:	EvoVisLauncher.exe
File opened (read-only)	\??\Y:	EvoVisLauncher.exe
File opened (read-only)	\??\Z:	EvoVisLauncher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4984_810310773\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4740_1917769374\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4740_1917769374\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4740_1917769374\manifest.fingerprint	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	EvoVisLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	EvoVisLauncher.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3520	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EvoVisLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EvoVisLauncher.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000002b5ded781100557365727300640009000400efbe874f77483d5df68e2e000000c70500000000010000000000000000003a000000000087e2c70055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0 = 4e003100000000003d5d478f10006d6f647300003a0009000400efbe3d5d478f3d5d478f2e0000009d490200000007000000000000000000000000000000d603ad006d006f0064007300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 54003100000000003d5d2f8f100045766f56697300003e0009000400efbe3d5d198f3d5d2f8f2e000000c9e3010000000300000000000000000000000000000069c0cb00450076006f00560069007300000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000002b5dcd83100041646d696e003c0009000400efbe2b5ded783d5df68e2e0000004be101000000010000000000000000000000000000002afa2601410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 5 IoCs

pid	Process
4448	explorer.exe
5492	explorer.exe
3148	explorer.exe
5636	explorer.exe
5892	explorer.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe
2620	EvoVisLauncher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4740	msedgewebview2.exe
4740	msedgewebview2.exe
4740	msedgewebview2.exe
4740	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2620	EvoVisLauncher.exe
Token: SeCreatePagefilePrivilege	2620	EvoVisLauncher.exe
Token: SeShutdownPrivilege	2620	EvoVisLauncher.exe
Token: SeCreatePagefilePrivilege	2620	EvoVisLauncher.exe
Token: SeShutdownPrivilege	2620	EvoVisLauncher.exe
Token: SeCreatePagefilePrivilege	2620	EvoVisLauncher.exe
Token: SeDebugPrivilege	2620	EvoVisLauncher.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4448	explorer.exe
4448	explorer.exe
5492	explorer.exe
5492	explorer.exe
3148	explorer.exe
3148	explorer.exe
5636	explorer.exe
5636	explorer.exe
5892	explorer.exe
5892	explorer.exe
1328	explorer.exe
1328	explorer.exe
5828	explorer.exe
5828	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 4984	2620	EvoVisLauncher.exe	96
PID 4984 wrote to memory of 4208	4984	msedge.exe	97
PID 4984 wrote to memory of 5032	4984	msedge.exe	98
PID 4984 wrote to memory of 3520	4984	msedge.exe	99
PID 4984 wrote to memory of 5032	4984	msedge.exe	98
PID 4984 wrote to memory of 5032	4984	msedge.exe	98
PID 4984 wrote to memory of 2828	4984	msedge.exe	100
PID 4984 wrote to memory of 2828	4984	msedge.exe	100
PID 4984 wrote to memory of 4540	4984	msedge.exe	102
PID 4984 wrote to memory of 3156	4984	msedge.exe	101
PID 4984 wrote to memory of 4540	4984	msedge.exe	102
PID 4984 wrote to memory of 4540	4984	msedge.exe	102
PID 4984 wrote to memory of 3156	4984	msedge.exe	101
PID 4984 wrote to memory of 3156	4984	msedge.exe	101
PID 4984 wrote to memory of 2480	4984	msedge.exe	104
PID 4984 wrote to memory of 2480	4984	msedge.exe	104
PID 4984 wrote to memory of 2480	4984	msedge.exe	104
PID 4984 wrote to memory of 3924	4984	msedge.exe	105
PID 4984 wrote to memory of 3924	4984	msedge.exe	105
PID 4984 wrote to memory of 3924	4984	msedge.exe	105
PID 4984 wrote to memory of 4324	4984	msedge.exe	107
PID 4984 wrote to memory of 4324	4984	msedge.exe	107
PID 4984 wrote to memory of 3700	4984	msedge.exe	110
PID 4984 wrote to memory of 3700	4984	msedge.exe	110
PID 4984 wrote to memory of 2204	4984	msedge.exe	112
PID 4984 wrote to memory of 2204	4984	msedge.exe	112
PID 4984 wrote to memory of 1496	4984	msedge.exe	113
PID 4984 wrote to memory of 1496	4984	msedge.exe	113
PID 4984 wrote to memory of 2680	4984	msedge.exe	116
PID 4984 wrote to memory of 3892	4984	msedge.exe	117
PID 4984 wrote to memory of 3892	4984	msedge.exe	117
PID 4984 wrote to memory of 5148	4984	msedge.exe	118
PID 4984 wrote to memory of 5148	4984	msedge.exe	118
PID 4984 wrote to memory of 5268	4984	msedge.exe	119
PID 4984 wrote to memory of 5268	4984	msedge.exe	119
PID 4984 wrote to memory of 5656	4984	msedge.exe	120
PID 4984 wrote to memory of 5656	4984	msedge.exe	120
PID 4984 wrote to memory of 5708	4984	msedge.exe	121
PID 4984 wrote to memory of 5708	4984	msedge.exe	121
PID 4984 wrote to memory of 5908	4984	msedge.exe	124
PID 4984 wrote to memory of 5680	4984	msedge.exe	125
PID 4984 wrote to memory of 5916	4984	msedge.exe	126
PID 4984 wrote to memory of 2680	4984	msedge.exe	133
PID 4984 wrote to memory of 2680	4984	msedge.exe	133
PID 4984 wrote to memory of 1428	4984	msedge.exe	137
PID 4984 wrote to memory of 1428	4984	msedge.exe	137
PID 2620 wrote to memory of 4740	2620	EvoVisLauncher.exe	139
PID 4740 wrote to memory of 4840	4740	msedgewebview2.exe	140
PID 4740 wrote to memory of 5420	4740	msedgewebview2.exe	141
PID 4740 wrote to memory of 5420	4740	msedgewebview2.exe	141
PID 4740 wrote to memory of 5420	4740	msedgewebview2.exe	141
PID 4740 wrote to memory of 5540	4740	msedgewebview2.exe	142
PID 4740 wrote to memory of 5564	4740	msedgewebview2.exe	143
PID 4740 wrote to memory of 5564	4740	msedgewebview2.exe	143
PID 4740 wrote to memory of 1728	4740	msedgewebview2.exe	144
PID 4740 wrote to memory of 1728	4740	msedgewebview2.exe	144
PID 4740 wrote to memory of 1728	4740	msedgewebview2.exe	144
PID 4740 wrote to memory of 5700	4740	msedgewebview2.exe	145
PID 4740 wrote to memory of 5700	4740	msedgewebview2.exe	145
PID 4740 wrote to memory of 5700	4740	msedgewebview2.exe	145
PID 4740 wrote to memory of 4232	4740	msedgewebview2.exe	146
PID 4740 wrote to memory of 4232	4740	msedgewebview2.exe	146
PID 4740 wrote to memory of 4232	4740	msedgewebview2.exe	146
PID 4740 wrote to memory of 4308	4740	msedgewebview2.exe	147

C:\Users\Admin\AppData\Local\Temp\EvoVisLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\EvoVisLauncher.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.evoproject.xyz/auth?hwid=aaef1e6869f93f1909a82e58ea12609b2574a5f32d8659a16c4e0c1b4e5a6a0c&code=0a0a4f06eaa967af
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffb84fbc188,0x7ffb84fbc194,0x7ffb84fbc1a0
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,15227314455575135665,17561959283217454415,262144 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,9586371378527202118,3582497769961585522,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,18172330946874386811,11784883575254617042,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:8
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6711470870282399296,7087559823786704785,2097152 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,7565079014620350939,16808388294094141201,2097152 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,2184727246362071,5355974635282140790,2097152 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,11009145757516761939,9495489761505980125,2097152 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,7399308861179549600,7928332065154246110,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,499403375863525366,7119572910049910421,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,11653145518824611274,2529198540727191255,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,14345047986249469945,4520222553089370036,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,4160481754672291580,18210135290389668716,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,4160481754672291580,18210135290389668716,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,16812188052579388298,885678910041831098,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,3348798888478804202,14482319886469057795,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,4180576520846877701,9371831903888552559,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,11980322716723667921,9976599986879819523,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,16721296535133665964,11205645919105958460,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,10435282160402506909,16942213039665074477,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,7154842974716159287,146214814449734078,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,208324123551643048,3806473249605445373,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,3647002260010212098,17585453453893548167,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,7320565200002812699,15138009022522892725,524288 --field-trial-handle=2368,i,3341643727015181593,9126855278870003094,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
    3⤵
    PID:1428
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=EvoVisLauncher.exe --webview-exe-version=1.1.13.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-unsafe-swiftshader --mojo-named-platform-channel-pipe=2620.5900.12117472998058816052
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x19c,0x7ffb8464b078,0x7ffb8464b084,0x7ffb8464b090
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --enable-unsafe-swiftshader --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView" --webview-exe-name=EvoVisLauncher.exe --webview-exe-version=1.1.13.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,8697235427418824198,18212138805585119680,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView" --webview-exe-name=EvoVisLauncher.exe --webview-exe-version=1.1.13.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,8697235427418824198,18212138805585119680,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView" --webview-exe-name=EvoVisLauncher.exe --webview-exe-version=1.1.13.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1744,i,8697235427418824198,18212138805585119680,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView" --webview-exe-name=EvoVisLauncher.exe --webview-exe-version=1.1.13.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3632,i,8697235427418824198,18212138805585119680,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView" --webview-exe-name=EvoVisLauncher.exe --webview-exe-version=1.1.13.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4068,i,8697235427418824198,18212138805585119680,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView" --webview-exe-name=EvoVisLauncher.exe --webview-exe-version=1.1.13.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4292,i,8697235427418824198,18212138805585119680,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView" --webview-exe-name=EvoVisLauncher.exe --webview-exe-version=1.1.13.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5028,i,8697235427418824198,18212138805585119680,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView" --webview-exe-name=EvoVisLauncher.exe --webview-exe-version=1.1.13.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4804,i,8697235427418824198,18212138805585119680,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
    3⤵
    PID:5852
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Roaming\EvoVis\instance\mc\mods"
  2⤵
  PID:2928
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Roaming\EvoVis\instance\mc\mods"
  2⤵
  PID:1408
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Roaming\EvoVis\instance\mc\mods"
  2⤵
  PID:2672
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Roaming\EvoVis\instance\mc\mods"
  2⤵
  PID:5600
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Roaming\EvoVis\instance\mc\mods"
  2⤵
  PID:3492
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Roaming\EvoVis\instance\mc\mods"
  2⤵
  PID:4604
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Roaming\EvoVis\instance\mc\mods"
  2⤵
  PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1792

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5492

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3148

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5636

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5892

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1328

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4740_1917769374\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4740_1917769374\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4984_810310773\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cb0b2e7b2f05d775343f6d8358811aa49d866a633de80073ad625e169021a10
MD5 f075ad7186a1f6c200abd69ca7856c96
SHA1 9bc250f221c26c725e12199febb7a3a178070ec7
SHA512 52730b59c4a720a9d526482430c0b2af7e12cb71a526f9149bb1b7748ec8134b51426f9b1d414cc62a4ca0c89bb9b0344afb23b1313af6aaf8e1075ff2f08415
TLSH
T1D0D0C001ED689FF4E071183C0239800836CCB1424B023141D0A012578C24242106CCE4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 83193e1c6704e80748c307f08bc1e8de973a5e66a5bcd9783cf856fd23a63496
MD5 50a7ce48f80cee407b821b740a06d37d
SHA1 624e57d9fc4e577d44628928e358aea3bd8409f0
SHA512 2bf63bb04a12d0470187377dfa1b91df2622e92355f189196a3149358d547cdf00bc6ea71b44a1c500fef67fe0f5ce4cafa2a848484dd30fe8a3364863484b91
TLSH
T1D16184D2C4E169EDFBFC43B965D53B87B73895C2368B9D2300A4D4BA98063DAE642074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595a0d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595a0d.TMP
Size 3KB
SHA256 b9f5d3abee03c31827f67e5e8a923e485319865cb3f1f025646a22212dc3bb2f
MD5 757697595f295652f22c7a7df4a97d34
SHA1 5a4815534a2c6e29079314d310fe769aeb62d88c
SHA512 0ba9bb2769e0672d7edfbb9f9c86e8ec182eb16be2e9b30132f733fbfcb9218252e76bb1be02cc2fd69bb25587e457c8268c316a937d6d576522f558ec61fd16
TLSH
T1266194D2C4E069EDFBFC43BDA5D53B87B73895C2768B5D2300A8D4BA44063D9E686074
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 07b05621aaf87d51680a03e71ae928efa5edd6de09d505a38aa846cdb6c6c93b
MD5 856eccc78003d679c5d891e48cba9fd7
SHA1 6ef9787e1d185cf648986301ef1ebaaad35c9ae9
SHA512 5d30c023fef8bcc4180198fa9c944c5497028e92129b78b1ef4254a311c7a7ad976e18a5f2033cf592be10540642a4809df51697d55888f47531fe2c16e6f2e6
TLSH
T1B0816DF3C6E4CA2EC90156F06B146E2BCE5D0919522C3D6A85E4DF9BD3F24B2E14164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2116e7854590909660aebc340f678c8f1cbcaab9992989cbc02619ee7097522e
MD5 dc382cb28aa262c193b72a1a922d63cf
SHA1 65a4c7f1609432adad9a20fef2b92b8040693b3f
SHA512 c9ef6de9c851b8cd82b3fb643dee106b79df5d1c3d6058d2eaaa7586d63fa37a9575e3e5e45d378b756f0dbccc13d88bd29673dddd2411f3385f99a7bcad5693
TLSH
T18B816DF3C6E4CA2EC90156F06B146E2BCE5D0919522C3D6A85E4DF9BD3F24B2E14164E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d331d67c4d3c80cb6143e377513a45890fca1c692613958ddc58d1a17bcfee55
MD5 b61ce8193f3c0d0ee6c422eef3cd69ec
SHA1 1faf86d3066bdef6bf4c540de45c2c491cccf64d
SHA512 afc16b830d3471a914b047f72ef1c13165b68eb36f2bff8e7d5f6c2875299dab7c2721bdd586f80d70c8289fbc749f2c4872b7762ccff892719a5e9808c409c5
SSDEEP 192:sxZ3REs2/flsbG1/cUO3IdpD4HW6+WNDCY/YYB6fcDIg4J:sxZ3n2/flsixcUOYkHbF/f6Ac
TLSH
T1D122C951AE38A97B8CC7E21DBB15BF13D6F9503265D01E48AAFCC61C05E7ADD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b46b59ccd912abfae8f50fe4cabd239ed08ad3eed0dff4eebe8e88a9bfd88f46
MD5 0c9a218a6d3adf1cd63ef4bebbeb28ab
SHA1 4bb5cebce1c6b6523f7e8810104b84179a5a0d21
SHA512 5c1d228326c530f7cca5359b37d839c61c7ce57c4f7fe5bde0d055271bbe2ea0d53ad9e26a2a1c9f6865cf7f55c7b00fcccfd34d31228cbea56f3e793090d754
SSDEEP 192:sxZaR5Z2/flsmOWpVI1/cUODIdp14HW6+WNwwjjTYwBZANIgbjRJ:sxZa12/flsTWvIxcUOcaHbZTjI/b
TLSH
T1F942D851A928A97F8CC6D21DFB55BF13E6F9103265D11E48ABFCC61C01E7ADE220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 27b23f3e50c58cc462a3aa9ae1a4ecd1cb859e7b7e3f73e1ca39f7aee14a36f4
MD5 9803618159e640573375ef008d764415
SHA1 c60e8dd1552e8f6f37d9417094faeb521f5e3128
SHA512 a882c84b27ea7d17fedfa13c13f21595455967c11d47854815ed24535d6490aef5a759150b8e0996a429e68e0408d972d52a2566b4b2f80c83a7b073f676e26b
SSDEEP 192:sxZ3Rbs2/flsms1/cUO3IdpD4HW6+WND/lNYYB9cDIg5jRJ:sxZ3+2/flsZxcUOYkHbBNfW1b
TLSH
T13D32D851AE28A97B8CC7E21DBB55BF13E6F9503265D11E48A7FCC61C01E7ACD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 241697d3f65d48372abc38c250a596a23ae5db7ef90c7509b0446233c24e741c
MD5 0bfecd15ddc213d8d3d5f8f52bba6b59
SHA1 c371d9a35916f984f92f8c671aeb6f64ab747047
SHA512 57ba35a086d54920903446d2da14444bce70f2bb1e91913960b2649a0f9963ee22531150a772d65e98b92cf551f48f827e5a2e75726de0efceb6faa3dbefb9e9
SSDEEP 192:sxZ3Rbs2/flsmG1/cUO3IdpD4HW6+WNDQ+dYYB2cDIg5jXJ:sxZ3+2/flsjxcUOYkHbFdft15
TLSH
T15022C751AE28A57B8CC7E21DBB55BF13E6F9503265D11E48AAFCC61C04E7ACD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9113da0b1107041b13c048602c76d952f0ba75f4fb8c80d18f3f04c078187cce
MD5 b94a6bf257c85c8f8399ae8e8944c5ee
SHA1 ff147cdeb61304dc9abf7f9b9ed2854cd27660e9
SHA512 ca0f61e73f9d8bc904345a6c2ce5cd11166595c21da0dd4491bbfe247826556a7152a2adc0e18b079c68650f262356868b63d2cd76505239a71642b0d059f841
SSDEEP 192:sxZaRbs2/flsms1/cUO3Idp14HW6+WND9b9YYBHcDIg5jRJ:sxZa+2/flsZxcUOYaHbd9fI1b
TLSH
T1CB32EA51AD28A57B8CC7E21DBB54BF13D6F9503255D01E48A7FCC61C01E7ACD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 16e6b0d10bfde36aef974a871bab2bea849141dc8322dc60006a3602b39c94a6
MD5 1c03af674245fd2e6a9d51f0a4325539
SHA1 110b9cb1fd5575091a5fd620e3cd89216af8b1b8
SHA512 da4c73d28c522db51ccc38780b2be0b8281fd10e18b895b8a6c8dae3cc66dad0fbdf4e4a6941b495bcb55e625920b875bcdb7a6712ad6f2f6d401e99915bafbb
SSDEEP 768:yTyYRxZ7pLuLbbjWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OV91/CLlGcvXVroz:yTyYRxvEbbjWv3NpBu1jac1/CL8OXuYy
TLSH
T1C2E2DA7B680DCB7E4FC00A9DDD1A7F9F6DA802CB9698C94047FA945C02C6BEE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3d11c39501373d97857e582d512122b32577d53d3b90662ae87302772c2a6c66
MD5 a46299ab6357176c18b1ec2eb181b679
SHA1 2cb30ce73bc4de6dec2f889c79f30d4fea9da3a5
SHA512 e03b34624369a6434020ecfb7e54a4bad4c5d6295aab8588a5822c2fa983bf2302036b5dabbf428b7a585f95bfa430c285ab574be90e057f604468cddc621076
SSDEEP 96:KwhQwKpq+nvKFxvV1xQRAsyJxKa4yPx+Hf4JAwoKZaq:ITnvKFxvV1+RAFJL4yPoHf4J5/
TLSH
T136914F4131BB065038BD6A4C8374C72B428276733159EF2B7FBC51A64E6AE081DFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e9aa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e9aa.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 67bc0e9e8ae2c5a2deb3fb88b2e16e605b3b753ec794f582827aa97206bc1388
MD5 34d970fb45cb74a058696ed0d12ff0ac
SHA1 267f6457657fbd66044c9f0b2618d2926a6bf31a
SHA512 d3dfb8d0b2dbc716c5bd8cfab80b2ec98facee991e2ab0b2a03ab78279114519e4dac5c13dfd63a1e18302ad5a62398e4ffbbd74078ee6db27e289d43bc2966b
SSDEEP 3:MsEllllkEthXllkl2zE/lot:/M/xT02zf
TLSH
T14A4402846B805406E96151344051835027B0DC1006529793285508226DC96450C00006
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 694356065df94bb64ace5eff675252b2b07876b9f3b66e3954c765532277ecc6
MD5 554cb6d0bacd20dd5494422394acffb6
SHA1 261ab61614125e639aee267c2389d33d6f7c02b0
SHA512 8d5d607d3f89d84fc2012ef8cada18a6994ea97b6108a21fee24b26b78751546a4488eb4db32bbcd0938bfa48c92fdf9d98fd48c52f1858e4a1e062ea87cf3a2
SSDEEP 384:n7ZcIhsNQHFjHZiS63uQX5+DtT863IAXcFtgOIwZOylKaoi:jhtjHZMVkDLjcFXsNaF
TLSH
T13E828F319CB8ACB71DFBA149B48733539F742477D9C49F84D6E89B1C0095A98170BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5430439c2b399d0a83fa17f461ee7d5fcc4523aedc422bac8ca215d4a8385141
MD5 ef472dc4d7661b024ee08be39c4548fe
SHA1 ff88c77148ca63c334caf3aa70e75afed66c6576
SHA512 96d2146c839f05f815f5f5c0b5e53bb9cdcec644171c4dac16dabab5572ef9a37c38a22aa4cd43e2aad11edfac9c2beb3c87682642d2108412ea17360c943c65
SSDEEP 384:nPiFWZcIQZsNw8TUNTUlIlqFjHZiEn3u1Dfh4X5+DtT863IAXxg6crt36dsP9eUb:aFEuNwgojHZnY4kDLjxUrfP9eSXsNaF
TLSH
T175F260F184D39DB6D8AE93C3573DAD025ABCC123B5885588B7E4692CEC5B5BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4ee8cc78310ce705b4ff6f314baa106879565777fad708d4f4233d672a26e072
MD5 5c442758ca1c5c5c9ab83dd2b93b8ac1
SHA1 1503100263044fcea0e755b0aec97a54b5fdeddf
SHA512 b0fe2a0ea2ab65204f1807d4f782915646df68f53dcf2c26999c6c1530e42f4b34b7651aae1d6e043f43ff98f93fa2f25b59c3e1852e10e4319ab8c7426f1d35
SSDEEP 192:EONg6nnHGQmiUyZvQYcX5hQDP1Djzor63I3cMcrF+8U6:EONg6nCyQNX5+DtT863IYHU6
TLSH
T1C402DA34BCA87CBB8AF3AD45B48632139FA5217BE5946B80DAEC5E1D00D765C2306D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 24e323e8ba4ed76f21b55637a4564e20fdc65ba488a7ed8a35aef7b2b585233a
MD5 3d5f4492bc08ac27d0cacb2cd3f43232
SHA1 410887e25996f693bbc71bff66136b186a4f52c2
SHA512 e8da1887ad0807933b05a445b7b2bac02c898300183a97bdbc219165a1141c26c300fb92124b5d241aad4c039c693a3e704ff3d44cee30c21c008648c53583dc
SSDEEP 384:nPiFiZcIQzsNQ8TUNTUlIlqFjHZiS53u1Df44X5+DtT863IAXIFtgOIwZOylKaoi:aFQMRwgojHZTN4kDLjIFXsNaF
TLSH
T126D2B4F198D7997AE8AE5387A77E2E429EBCD053B4849984F7D45D0CCC425BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c8f0bf46a324273c1cda7012df66f5cba779ea6c81ffe29ceb05b952f59b50a3
MD5 0c0e7e65f039e1ff61bbe4466b3f4233
SHA1 d4f5b44ad1baf43b2a300456c3c1ab58217774ce
SHA512 49d195dcf39f7e74e32f910f3a01b45af27cec64918cb0c576d0210894cff1aeb95119075ce73c04606bbf19a2e74b6f46b1964f72ce7ca32ba153fa7b069afe
SSDEEP 384:nrZcIhsNQqFjHZiS63uQX5+DtT863IAXcFtgOIwZOylKaoi:zh2jHZMVkDLjcFXsNaF
TLSH
T1B1828E3198B8ACBB1DFBA149B4873353AFB42477D9C49F84D6F89B1C0095A98170BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3d6f3d610cba57c694a3bf9e3ad2b9bb351b4c2f2e5cfeb0e152d92e51706db6
MD5 26366657ea92af7a3afeea8580df8584
SHA1 d8d9dfae35ddd77dc743d997ee27bcf74e8147ca
SHA512 de4f761411ef8ce9ace2a3462eec20ff2ef24093ab78c1d8d7579d5d7d1fc93b45dbfdaac93ac3cd2b9885351098f619147983307ae913d7af1dc44ef8dba35f
SSDEEP 192:EONx6nnHRQmiUy0v6YcX5hQDP1Djzor63I3wXkefg36qX9U6:EONx6nP56NX5+DtT863IAXMFU6
TLSH
T152120B34A8A8BC675EE7B459B0C73253AFA52077D9846F80D6E84F1C009AB5C270A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

85e4c429-29a5-44d4-b543-0cadc466c133.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\85e4c429-29a5-44d4-b543-0cadc466c133.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 cc3affa00117282e04322dbb2e97fe99151cca77d0fcf454204c29fd535345f3
MD5 2325aa98bb87405469a43fbf9bc1fc92
SHA1 caf26d249160b6a5cdba24f1bad9833c1b293193
SHA512 0b5e388e1c0dd3a3aa99f0ae853ed9183cd1567515e37fc250851f2ef80d60b95636ef5ac862501f1e0a0f73a0d1c3dd31abd034c35214c3d453442977d9cbbd
SSDEEP 768:20aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:YZP2tFPuNnY4UmqEMioTaBacg
TLSH
T1F9154137D190B085CF2C71B1E5ED5F08BA23B10712E152465FB8A67BBA633C98D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectWriteForwarder.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\DirectWriteForwarder.dll
Size 501KB
SHA256 691250dac9a44ffd9dac9354b636ee748dcb6c50036b895dbcfcc934323f28eb
MD5 e13a272ee2cbaadb31105adbe2655d60
SHA1 af7c1bc019c96592d4fce57a1e869387c45fda8e
SHA512 b32de8c6ee2e2d988f023894f9eed35c754a30320e66ee4a7730b3c53dd9f97f6c870382227013c273d6a25f77c4d169e4f0327fd7f2a278e99651b0e4abfe87
SSDEEP 6144:2nQJt88J1S36vI2McM/e2dEzvMH8vOQT291TDfv8ylSg4XymaFh5WUUN:2QJt3J1S36vI22dXVlKymM57E
TLSH
T131B49E19B7C46662E96E82BF8243C262D630D9F31313E3C387418A671D2FBD1D637996
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EvoVisLauncher.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\EvoVisLauncher.dll
Size 2.0MB
SHA256 43f5c5a82e522be2d43a4c81b27aed4bb66ee1c61e5c30c5986a61d3190a9206
MD5 a9e53f3ee17f87facededc2823243c20
SHA1 9b676071fa374fa3c126e81b3ad4b4ef17c5a9f2
SHA512 1f4b9d147ed179b6520194676e52c3ce8ae446d6c2148b32489c30e57d831db76286ab33db97db68c5fb25be50e698b0a2c0899ab69950ec053f8e10df4b25a2
SSDEEP 24576:pI2bKhljaOmHsGLEciRuE5DSKpTjNYJpBkhR2CboKsJqjNkLLzZL7Ao8ymE3V4v9:pXbKhljaOmHsGLEc8hnkrZL7AoVJ2O
TLSH
T19FA58D11B756C346D99D3B34C3AA63543776EC815F22C74BA59C7BACAC722821C4B3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Registry.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\Microsoft.Win32.Registry.dll
Size 117KB
SHA256 077a2d629819b3d86d6c81e0647fbf30fb6273974cef51023719f2a0f1fab410
MD5 c9b135a7b2e7a3967391c3927a944af2
SHA1 548a836284294773f239b9079bf7886f55693def
SHA512 453435f969e1cbf218f87b9b15f8c19d8502c6e1771a99c4d65aa7b238ab18bf4451a9ef4cd8858e0502386959f8c0aa32a7c866e6366034e243ec0937e33f82
SSDEEP 3072:fiupwrrkkYM368JSvEdCrOVi/n4t76VmgN7:ejq8JSvEd0Fc7u
TLSH
T1C5C328517BD0450BFA7E8A7A9967C841E2B6F0971B01EACF52C5805A2F63BC7F631213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationCore.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\PresentationCore.dll
Size 8.2MB
SHA256 4fe00893cfca54ab0b0bce95caa1f8ddc87f383c7553cc17c81da65bc54e4e3b
MD5 2690760cf397c05d30c3749b9deebcd5
SHA1 b426e50d2eadf4e6fcf416ed8e99a8c65cd46496
SHA512 f558ec0572954f95334ce01439b4912810c25b7b3fbe6cf68d3227271667cd28cf041ae1262227d093372764944d4dafc529579b58f069e247c24d8531e16bbd
SSDEEP 98304:0CqgbdPWvVcH8NMUEgxPNOlwGUC9h1ZPLNIs99rLXvUMag/:HqgpPSPNOlwTC9hrPLNIs99rTZ
TLSH
T12B968C05B7C40A11E2BF85BF91A38832E574A093431294EB345CDE2A3FA7BE156F7752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFramework-SystemXml.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\PresentationFramework-SystemXml.dll
Size 33KB
SHA256 592ec192e9f8590cbf2da06d30a30086c1a88d890819110aeb4db09107d633f3
MD5 e0643ee9d809952237463faae1e826b4
SHA1 01aed86a6768159606ffb3dc715b91b8b3509b63
SHA512 c062d0302aef3cee147f324470770d43777c7a5cbe598ae3af60ae83ec647519f0d7a5b8792e301ffdd4fbd4464c27ddfb037a1d32e0a91cc786bad22dd2d70a
SSDEEP 384:oNW+wmZhdFEPzjYx+GtH6fDoFYh3A9etpZlNSriSR9zI19Bc:7qdGPzcKkFoA0Irr9zITBc
TLSH
T120F27CA69BBC8A02E9DE5A7446B5CD86BD30E3C12201DAFF1685E44C8CA37C4977212D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFramework.Aero2.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\PresentationFramework.Aero2.dll
Size 441KB
SHA256 68c67d27c2b3e3cd9b9122b450b3008ba91ee83387ee34cf89015106513b4b9d
MD5 e4fd87964a6db2cb97d1b1fddd21e90a
SHA1 6433f82372700c63d8732f6204219b5916c3809b
SHA512 f89f1cdfec0bd70fc3b2bca25816d2a7cef5130eed9dddf4e013cc4bd06cdc203b06364d67d62204afdd24c37cdea24442766c507f2bd4193a86bcaff01f4c21
SSDEEP 6144:JrnlU69O+CAI1WWo+bGON9keVRANO9v1Wr:JrnlU6Md1Ho+bZN9keVlWr
TLSH
T1C0A44C48274046B0DA3644B986E3C419F671BC5223E0E4EB27EB4F8D7FDAF82516616F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFramework.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\PresentationFramework.dll
Size 15.4MB
SHA256 2c349aeb8c48dbf98aa19ff3beda2f86681390039d21bbb8e9828bde4e62992a
MD5 6530656c16294d7d258e987cc4834183
SHA1 f1863c5c17a7044f5849e9d4688641f953d4da6f
SHA512 d36e9c6a374a0541b1cbe2e7c0f35090494848145d276bd1ef3460823a5b14a85951b885319e74837601bfc7840b1552f09c5c6483019b6fa583e1087fa9463e
SSDEEP 393216:qUza2NnvNCxYIgWUJV1D3wwLJuuN/tZ0jXE:/H3ZVuuNVCjU
TLSH
T16EF69E24A3F88A45D33ED6BC83634242E6F0B8D35326C4CF8895D94D2FA77C16676663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 6c588208852d8663d81872e0eafdecec4f2ca5cc2cede2e74e167427932e70f3
MD5 e3317e7f8817f2005a2f87484afeedd3
SHA1 5bc45c25b1c63892835e5a849913c368ad88bcf7
SHA512 f881dc2ae7c32a2e407f71f2e876f04e47ce605c515fc161d54ea2756cbc66808bf18a054d7407de004dd2287986861ce863cead5b4c51af125f3c447770dc89
SSDEEP 24576:6GD+42x2Jvddeoyo7Pkmn/V1Pt8clT3D4iLFxVCPL67uMFAC0q4dovzvfPbR8/9H:S2BzeoRPkmTP2clT31wPO7hACNYovznK
TLSH
T189454A62E2E642E5C47FC1B8C6469717FBB0740A131C66DB87608B592F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Collections.Concurrent.dll
Size 285KB
SHA256 bd6f2cdfd5ec6fc487c5757728d4330334b2a89a813ba291234e2c2efb60720a
MD5 75cbb225f4fde7fb89f3b51581620f94
SHA1 b7834f9e88e4c177d9acfa60fb51cc9d80a8f19b
SHA512 d04c1e7b38a9912171579e6868486cc4d5a3cdb22b83fbd468117035f5926f4b511a72df11dfa3de75f2d5ebd3ebb0be91d2b740eff2046f23b1d2a096fe596e
SSDEEP 6144:emDiDADnW0D1dQvx+19w5xFzc2cOggEdIQMh:emhDtDLsswBc2cOggZT
TLSH
T124547D1173CD0616FE6F9A3A8963C800D1BAB4E21312D1EB4335E658DE5FBC61ABF146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.NonGeneric.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Collections.NonGeneric.dll
Size 105KB
SHA256 bf98e26d1f68e44df462019400ddd54d77b7355c1005502121e653d94cc80f8c
MD5 04c77dec5a02619fbfd06b2ccc2d0d21
SHA1 89cb6f3590e26a7c64a3f666c1ac4bb5d97d0515
SHA512 9a63807622c7818d15e4f15ff25a5e0988149d82e6cfcb019c767eee8bcfda3a44985f63b214dbf50d751d03d1c6e54f2c2ebbb0afc85e43ad2cfd1dd6a66846
SSDEEP 1536:b5wjfz1rx4tmQ+tvmRrVvIrKQ77WG0O8Gdlw3UMkzNv:b5w311gmQ+14wvWG02rwZkhv
TLSH
T173B34A39B3980227C6AE66FC91AB8902E271F5D36703E2DF195459CD1E9B7C2D2B3017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Specialized.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Collections.Specialized.dll
Size 101KB
SHA256 ad848ee601e2a864f482c06a0763486c98558cdf95de66cc08c7c6020c558941
MD5 6c153d7552555478dfa8b8d74ec008ac
SHA1 47fc7dd4810df2cd0a79320f9c457c4b727d3d1f
SHA512 c67919b5277e2b0e334fd860e2491d5d0eb86ad964e94630eaab0947039e8cdb305a292d5adf600e33bb1caacae675ced953a8f889ce4044b3eed64e89e1bf8d
SSDEEP 1536:XGEOm2RuYWjVahA0/cOHz+SE6iTWNYa6dZm8bUHczgd:XGEO/RuzjVw4OaDTWNYa6dZdbU80d
TLSH
T126A35B2873C84721C7BA92FDC1978942E634F2D31352E6CF68499589DED77C09AB702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Collections.dll
Size 325KB
SHA256 752ace8c7eddeb911c8eb4f5a71aea72be767719d2270fb39fffb2e329014103
MD5 89e6aa59e49d38aca1e6e528c08a64a6
SHA1 ce342966269f4d318bd30ae98abbd051bf597540
SHA512 f94029da16cffd5189fe787d5b8465d690e8c1ef53b969e7820a000ce436017c77d5382436c1795a5275bd1ee87d1edd5c32af484ce44851cb977bb5586015fe
SSDEEP 6144:wwi7t29x3ZZIkk3u3mqbe29p1pwmghvmmxBVsTdlENig5kqERD:YZ2VZdk+35begpom4vm/TEkbRD
TLSH
T18A645B29738C1729ED6F81BAA593C031E479C0D2C3D0C6DB066DE6409EEBBD16DBA153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 bfced6c24bfaea7f2872c051b4d72da87bacca7d03cfe76ce7bd9e3d2f53fd0d
MD5 34837ea91472a00de8c713d1389f53fe
SHA1 c7f44464a89c2380e378708efbe212475d571c36
SHA512 dee815a0f79920d8f68e71f5f0ea61e51f17b7639678c50f200eae80a161a0f656933fb9c54db273cec2cc6ca4ba0f4bc22c9d62895c943d45b1aed52fad07f8
SSDEEP 1536:AahvggPzMHPgIAhuBYYcYm2oICGZ8CsUt+z62:Aah4gIvgIAhuqYcv2olGZQBG2
TLSH
T19D734B1913E84315FABD62BC9AB39A109574F5832313D9CF5A60D90E2F977C1F231A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.TypeConverter.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.ComponentModel.TypeConverter.dll
Size 753KB
SHA256 3244001ba95c4799a79773c984ff70276a03b46460b2883fbae8cd72609f2b16
MD5 e733fe8914eccc9039cf98b8608a2840
SHA1 eb6e8672c2879e5a2325bab17c019132005daa81
SHA512 3686b8b1c8f1e733cba9e74d6e2832a8475ef84f8e10ced5a85310430dc352d58e1aa5d9a449d8a57ae8bbd3f0562fcd135ea28ee50fb1d0015187ecdd557530
SSDEEP 12288:lxEZCef/6C21MxUNMeWcP7VGTipzEti8h1ri4FBrXNI+oX3URr3Nmxo:lCZJf/R21MxUNMeW8Pp6O4FBrNeENdmo
TLSH
T149F46B19BBC88E35DBBFC2BCC6A34002E175A5976371C5CB04A6DD852F937C1A272762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.ComponentModel.dll
Size 29KB
SHA256 c505e75a98e5e9c05fa56ed39b919eca19adbb361e79a0b4099855f1cfdfa369
MD5 80d23b1f81e16d55412e5fe6b610355a
SHA1 4da52308a784389689191c74415697dd2e4871fc
SHA512 ae0e37dc9f28c309d2161cbede317b0306d2f2eb7d431311abe2de3ba5261ef55232046005a02de5aec0692a037dabc07159b32b00c1da661088567b43003631
SSDEEP 192:qW4p1WK6GP1Okn+ALxMZmu7wEPWF+GBTBWsea8WrTVueTXflYBQXBnX01k9z3Ax4:qW4p1WK6KL+UM4s8lNVcUthXBnR9z84
TLSH
T136D24BE6C7B88213ED960D749AACDA533D7DB7CA9E1287670182F1491D937C8AB3013D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Configuration.ConfigurationManager.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Configuration.ConfigurationManager.dll
Size 1.0MB
SHA256 033164658b573748af3be245a169fdc9673fbd59af3ece8fb1d6b7cae4c12571
MD5 59c773cba73f44cd9c12c5ca65e51a4c
SHA1 1d1f74435d148b42efd86df51c7e06665eb12899
SHA512 68ab39765a1864fa1d56bfd9dac45555ff2730cc41fc271b702f51977ce80f338c3e673e82cbd55c03e5f855f3ccd66ebfd4d46b95e07a296041ce789720eb91
SSDEEP 12288:uPYNcXS2FPqqfOsdV0Z8oApKK1sPTdokGH5OTNWLOdNRvFTcHQQzOM1ajWAYAp3l:fNcCOARgSWANBl81MjmUDF8u
TLSH
T1F2354B2553D8470AE76E1778C96A4601D6B1B8970332E2CF8510B88E3B97BC3D7F2667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Diagnostics.DiagnosticSource.dll
Size 441KB
SHA256 2217b1f68cc8a642bb5b4baba46cb610ffb65212a5e90a0a8e6d7fc6d82472c7
MD5 c42f03183bfb3c39d066572b94480cee
SHA1 594d0ae8d089651a3eaef2995b5df99fffc87771
SHA512 931aba2a69d2d020a0c809585dea740a8d58154fa91efe61d3144ab2833951f07eef03ef0c2a09691d4d3649f866a557ed7967b113c529942f8943b394c3d6b7
SSDEEP 6144:eTxl+c7MEYr+lcx55I/6eOw5/0aabXbtd7yluEgNdmoA1X8WSzO:eTD+MlavaaDbtd78fgOobC
TLSH
T197A45B18B3E80660CE6BA67992674401C571A78653A1D2CBC544EFDABF4FFC1BB32217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Diagnostics.Process.dll
Size 329KB
SHA256 30573352f23b110f0d229f84ccd4a748a5c781e0f611bd205eeb28d86b00c22f
MD5 4f9a14903ce947a7bff86ac6b52dd9ec
SHA1 872f85534aa228f5e95a390a60579f5d7a460a3b
SHA512 cbfe12e25a297be9f547a983963187d16f0ec1574bc6fa11865abe5799d49012af76378ba25087b5c1ec56aa6808f47f5c857a7c0ab87ad2e1509a87e8d70210
SSDEEP 6144:wM2lf1CKFui9ZEzpfRa2p8d4NS+f5KSV/h+19jb3bG1PjSlWOh5cDOblR:cFuiszvXwq5vVZ+bgwSelR
TLSH
T197746C257398090EFE6EDA7C8453D502F6B8B09307D2DACB0650DE992F8B7C79A31167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.StackTrace.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Diagnostics.StackTrace.dll
Size 45KB
SHA256 55b81899b6377e5d00e53d7a186994ac9755cee2ec583cd906e37249461f699e
MD5 287f3c4661fd7f36fefae790fc90cddb
SHA1 456ed3695f7905757df2c3bc591fb181bc8b5347
SHA512 ce7531532774afda254ae67b5f4c3da00767db4da07e7cb4209fa1851bd234a3fab7e599e8cf7b8c49ae9fbdb94d7e1706eadc158abbe540327d721b3072de64
SSDEEP 384:AWnagW8Uq9iaAgAeYjNhYBZTTvvuKDDEoGmxy1MDfUcwC/FmlF/N57DH2lNwEjRK:Q2UAi2YjLYBZTTvPDA1wf84mlFHu9zzw
TLSH
T142236C629788E232ECD68438EAA3DD461479E7C51B92AFD7168CCB1E0CD37C5B63211D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.TraceSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Diagnostics.TraceSource.dll
Size 141KB
SHA256 ea4ed234a1dded79c49037220948a7b47a7ccc115e86bd5ab4520ac44374ab59
MD5 ab33aad8ed7aa3cab260bda076866e10
SHA1 5dd60e1b0554790a31f1f2094bc7faf6b983fb71
SHA512 8c0d7e83c30e973c9cda87f1ed15e52885c140412ac7ec8f4cda3bc2ef40bccdbef6def61efc0431ccbaccc5437a2f803da9963096338d9b66b2d9aa5cbf9e74
SSDEEP 1536:Kg4Qkg1qPks+V3Q0v2xCXqYmBlM5m9iWRarxaOnDefRcGcx2CwF62zW:KXLg2OPm9XagGDefRcGcxb92i
TLSH
T162E35B2A37E84617C76E167C85678600E6B3D8C3270BD6CF484A9DA81F43BD2BFB5095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Drawing.Primitives.dll
Size 133KB
SHA256 4688ba89e7941b2863311b8baa62d17ef9fad4ba984dc50296b39c56f19c7b0c
MD5 f9c02d88dcf541954273078b2e626721
SHA1 fa04c1de6b9573dc6fea568d270939da20456afe
SHA512 1280c22c792ddd5d00353b4a857fe0678d9bdb9914ac1bbcd51a31400acec1a5936571dd53a6f9ba87736995efe15e9219a7ab00aec6164df24dc7ca3e4796e8
SSDEEP 1536:szNbmS+aaRoxP64LkdvsCq005v4fiBSRQHwFiYrmaA2RiblNIbSVzol:szNbh+zoxPxLp04oiBMQfNqRiHcSVA
TLSH
T199D35C1EF34448ADE67E517E91926923DE26F24A0311D9CF99D0909CAF433C9F6B30B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Packaging.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.IO.Packaging.dll
Size 317KB
SHA256 f0fec5728921ff0836fdff56a798897b1974456e949d368aeab6a26b9571835e
MD5 e3f5d6a621b0f5baa2b7ac218e9628c2
SHA1 0315a5a1a471457085587100d0be5fa290af6758
SHA512 79d768e6ee34ab86eeb364984abc945077a5e36a42ff3e65970b690db4bb30e321e6e1ec58c4bb92117a41b73ae6f3128dc9f70eecc2aa5131b956815fbf6f89
SSDEEP 6144:HrfbPPXa6+qF62rrW//sOQV8CgR5Y9vOFFpYnu:Hrjq0rrW//s4uORYnu
TLSH
T1D1642A2433E80607FBBB56BDC57BD021E979B69217A2C6CF0910958D4E9BBC1CA71723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Linq.dll
Size 641KB
SHA256 675ed58c04594655b067a3e4f3d4f1c01a27057057166c33dc54b9916167f0da
MD5 43b77ab8817454cc2e8c18e1e13b8527
SHA1 c26e33697981c12e551e5c6747fb914b7e76b42a
SHA512 70268fadaa3ce5ee9468f726f3f175ada1f5d37339a40af2528d6dc64a9ad607b19372ca26418626517ebfda2b5fb6ff4ec40d93fe8384044ba07b7cca606de7
SSDEEP 12288:f2bNExN0GCS2GtRqZ7D5EvRInGG4hhh0ppppKMMMMMEVr:f2EXGZ7WdVr
TLSH
T18AE44B29A38C4A02C62E867A8573C071D2E0ADD68311D5DBA75CEE841FF3FF16976724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Memory.dll
Size 157KB
SHA256 da40a6f6af8a20e129874628910ade425a5854e0b7b31dba95332f8e8b48e59c
MD5 d8c79edefedbd9d53e7ec789d1cc706f
SHA1 4869e08137fd6c740c02bde83113cbe1d3291988
SHA512 a5892dc89677aadc4c41801dd003e18efa6530b045ea1a34e015a5353f4409f4daa8f5044e590b68df118abadd455926e2e5690a032cee195b82c30e3fc80115
SSDEEP 3072:U32iLH0P+ZSX//vpjM+dXwayf11ojXM6EaI/hv2KAUL:0DipYMwayfWXM6a5+ZE
TLSH
T15FF36C37C3980257D92FEAB9A5268E02E7337052970195CBE8D4D6846F53BD0FEB7422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Net.Http.dll
Size 1.7MB
SHA256 2617810681bb9f6f2bb2ddc47f9c6c5a63ec5a397ceefd814329dea8d38806ce
MD5 da399422da1390190dc7afa10f138a9c
SHA1 e92d6ec73c8f4d16af30259fd8c96f10e736ad14
SHA512 bbe4e4d04ed15727a22255173583d823982c34ad28d261598c1dd3610cadc2f96568a899ac1322c4e16060a1dc31ad71a22d8bb9bd8b61b7ad1166d91663b0c1
SSDEEP 24576:qps461eqDBdRuJ8j/AA3R/4ljhTPfPpX4BvmxDWck3LLHx:8d61F3IJ8j/AORwZRomNE
TLSH
T12A856B05B3EA4611D72FC6BDA1678841C571A4838B13D7CF1885FD892E937C2AB363A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.NameResolution.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Net.NameResolution.dll
Size 121KB
SHA256 9e9b296a3af8290fc210af232be164c0e00dd0e18de2b6f74b0f96cacf5fd19e
MD5 5371bd4fec4c9f9df9518051c9e2e015
SHA1 9b85f495758d9764b154016209dce81808402da2
SHA512 27ed81e580b537759b710e116e7410aa9fc8de2757253d6b7b6fedae2fdd4111b85adced007f7a8c2421fa2d4fedc0edc174cd8230a1a1b3e0fe746f139cdf14
SSDEEP 1536:veR3Eybv4fbuVnFDvrK1URGpIj4kjPiFDyby735HEBtAuz6Q9:vMEyD4fbuRhK1Rij4GP+DybybtItTOQ9
TLSH
T1F1C34A10B3D88711DB7E557D85638E42E2B3E1E31701DAEF128CA9483FA37E0B676652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.NetworkInformation.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Net.NetworkInformation.dll
Size 153KB
SHA256 7c441879df72e0b3da19da8d8687abc846df334be8f09fa8e9afbf6d700d8183
MD5 830378ac50ce7b024d5c629043224feb
SHA1 1986dcf6d9a4c645730eb2b366c37bf35432d34c
SHA512 c7344b41d2ac28f659a615c5ddb8c5a193d20894cf246eef40855f36428cf9672934f520cad0d49d440c7fbae3b629e8521c321976869778d384910d2c49c33f
SSDEEP 1536:vOIZMmsQhPMCD/plCgzr3tMY4SJt+k5sPQNARLVXyVb0EZ89LhWtODxlM06zz:vtZMmJagRLv3mYL6LVXyVwa8lxlM06H
TLSH
T144F36C11639C4216DA9B813DE0EB5932853BDDC23336D6EB3488AD9C1DB7BE5B332152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Net.Primitives.dll
Size 221KB
SHA256 46ead7b5c522317188d001f45bece7d865b394984a2373dce8e5ed0fb75222c2
MD5 173d67ef53501a1f2d34993cf3c7d5bb
SHA1 b74cdf3373d5c9e8530e7ebbb60d0eabf474e0a8
SHA512 76dc373267ca6212cb555b5c9a5ec3d713173f57781139b4b5fa19d8958aae449fb3bb308cedfa02bff94f6ed799cb01b7e6e4e6efe3246e8a0500ba429cdd05
SSDEEP 6144:KlKlaPpJQZo3OPC9h9wDMInKziqQtsCoFjgtz:pFZme2huMPziqQtvajg1
TLSH
T18C247D1AA3D40D4BF7EF857CC353C511D372A4A25742E6DB06A49ADA1F837C26EB2063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Requests.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Net.Requests.dll
Size 373KB
SHA256 ce8349cffa646155a317caf87fb7cb57d51f3107ccdde871b4b08f1751c6e5b0
MD5 9c5d65bd000c2a039c2db22b4f397c5c
SHA1 54d34826fa5fc27043001dd1fe9017335ff93e34
SHA512 e2eac61cad226e764986d99355473e2c68d9da44344139d15a628ca27e95dc981838f0f7b2e4979dbd9d79a91aa7b774485db05ac1c7f88ed42fd7e3853d8be4
SSDEEP 6144:wfLcR6mdomod/xPgv6byLs18eSmoXMwp5Fa5B7Yb:OQRRdWFOv6uc2Fvb
TLSH
T1FE846A1CF3D50E56EB2B9578C637A281E178B58207C1DEEB41109A8DAF8F7C1E631267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Security.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Net.Security.dll
Size 661KB
SHA256 c3d0636840840003327495c117573306f6e03f4f2bd1f1b65bfbc27f2f41deb1
MD5 88b8307c2b36c119635b158196216677
SHA1 52409e5ab2d9428199f8d7cbc36f84132ed7bfff
SHA512 a60efcfa3b09d8c959f9c3ec2b73f3cbfb69160ed8a95254b6f37275bcb5d4058827cf3317a3fcc680e16469304bb4e72f43e3d03e8f6adbd53276e7cbcb1733
SSDEEP 12288:7CYHsx8JQO+Kyi8GU+wH08emCev1jdXL1Pq9Se:7Cs/QBhiCtrbpS9T
TLSH
T17FE46C10A3D50B55E6AFA73985324831E6B1A9C7B752D9CF5088C89D3F63FE2C235326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Sockets.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Net.Sockets.dll
Size 533KB
SHA256 4b24bd1d219f8716a31a4a175842f382c5104b01336bd9eb7ce6cbdca716bdee
MD5 9c89d5f7c8bc7ba33ea474cb97601844
SHA1 b97cd4261d7ea5012576c485fd4f246d4f6c513b
SHA512 bc93b7436be6bd79a0fb9effd724c3a6c0ca03ef6fdd1e288223085b3f461c1f2ca3a6dacbb69bcb8e23bfe46ed0b28b09c814d84f31ba6755a345b880fd9f0f
SSDEEP 6144:3m9zWng/Oon3CejOEa2cJNSwEZHN7XpWezln5HEBa2k+pds+mNg6:WZfn3LF7cqw2wezN32kuW9NT
TLSH
T17BC46C2463E44905DE2F9B7CC9634109E3F0B1A71762EACB8848EF992F537C1D376662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.WebClient.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Net.WebClient.dll
Size 165KB
SHA256 4d26b50ad6e78254600592b2dbe0c1e677267aea654b04d68cb2e8caa0c77def
MD5 70714972600930416ea59d561074b2dc
SHA1 34152a7752ac21e43e6a9db0dfbaedec7b2a25ff
SHA512 e0d239d38fbcaf23b840199bb2d86aed1a22882285a75390a226421b1e245b2d5568c7cb6788f8232b1edf1ad29426fcb83cd629a216c5277760d93493540821
SSDEEP 1536:38L8QyuFoxzHS+FUonznTRosHw/KNaWgbKUixgQDbDg3pqy/2+EY3ypJ9/iej/50:38LsuAXRoe+QK/ZEY3ypJ9/i8/BS6m
TLSH
T1C0F32827D7985E07CE1F92B8C5E78280F77390B60311D6CB188895581E93BCA7F7626E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.WebHeaderCollection.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Net.WebHeaderCollection.dll
Size 61KB
SHA256 907fe4d1a19dc0e07875e4d2bf33524b4d7a2bfec3594c4268010862d4f21144
MD5 fee6da53cfbbdb316c8babb7d8fbe2ce
SHA1 8eb6e92026d88b7bdfc84afecf0eea9f9c97d1b0
SHA512 31ecd6ebc377531ffcf037f5983067373746be5ae7aeee248c23117bc55446e4ec8639a0f2f5c8653a35ebfaae4d54f9ed5d892697790695dcb10b7ab7bd9b57
SSDEEP 768:cjRVCeJodVDwpMVfYqO47AAQ0CvGrtZuZWGBIBvBmQ6erjZ9zb:c9LJwpTqb6Wwrt1BZmQ9zb
TLSH
T1B0535C68D3E41609EB77AB7CC2B68496CA32F6420752C8DF188AD54D0FD3BC19BF2521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ObjectModel.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.ObjectModel.dll
Size 81KB
SHA256 8785dde8d1d8d26c193b8aa1235cb73df878838843c480f22d22b281e992f608
MD5 d5e753c521e38bd68cab19a8d046a390
SHA1 b671d9d93553ae8b9e5f1d9756669b804c53c8f7
SHA512 cd75e0aafda1e0aee177ccb68c632b97c527cb45c6ccbbdf7fca181de33a6fae248decb3daf743938b9ca1e8657942cdef954d7b530dc4006e6947d04abfef87
SSDEEP 768:H98wSbPSavuZgIxvDtAHyx7mkQFUUbduFe4xFHlTELOUAZ+X2yf47TZGRq8j1aAD:H9HFeOVmXaUbdCfrQr47gLZ7Wozmo
TLSH
T11B836B267398271AEBAE063DC9B305A2D434FED21732CACF5695D40E6F137C2527116B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Private.CoreLib.dll
Size 14.6MB
SHA256 18dd52b72d7726914249749376c2e635103ab25d7f4c5d37bb3a033166f2df0e
MD5 7c10cdf767a17c379f0f8efafce17acf
SHA1 86c43ad2ba1a5cfbd9666a451dac49ba6241247f
SHA512 bc19ffac87d127e3d544c1cfa57247111ad1c175e150b6d65c008adde04139c8246fb85a7298673c378e3e27c56b05e1ad3e2b56971e954e2edcd0653113984c
SSDEEP 98304:GzjBkMq3VrGQWWhGEwf+rC09jn5VJGjabT3GzgzP09I9PSZQsga:GvBE3vWWgDf+f9jn5fGiT3G0z89IRa
TLSH
T1B4F69E00E7D94F96E12FC27D82938116EA74F89E432294EB1945D95D2F23BE1533B2F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Private.Uri.dll
Size 253KB
SHA256 2d661e583a48a7b84f1b5633f0879d432c2b24b8c566b034680f714796a21347
MD5 5040983596f2e0d51a67560905500559
SHA1 683c93d2e29c3b4c0cab44c55792aea9ac224e43
SHA512 e153a20f069acfefb9007de6d14f2dd8da7e3805bb954da2017cc1b26dafadc6a056c77b2523d6359f5b61ba3f9995f084ce6a144fb8a91cc50f5403e933702e
SSDEEP 6144:1r2+UmyT6Sup03QyFWLdTEFVtGVRsDYWtAa:RbUzEhTgVtGVR07tT
TLSH
T1C2448C35E3884966FB3E87BD8283D213E67174A25305EACB4AF5D1922F233C1BA35553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Private.Xml.dll
Size 7.6MB
SHA256 09da98e70dd4271f3b37ad00e93c055116988311ae605589c40669f8a7ca062f
MD5 0cbb5ddac8b08cbb9613e26dd6730b24
SHA1 8f1e3c3546411660299f3725a0b2662fadb9e1ea
SHA512 a8eab79c622d4fcf6eaf5779dc167488455102c30047b3ba67eca003843345b7ef27c8fbbeb203e69efff37030948a15066f536c87bd04fd7d4c9491b2fa6206
SSDEEP 98304:Yu4a7xgoN/azZLXHmmPC2gCoa4ToK1gGMsExdTqcQP:YuzxTN/azZrHBA1l1qqcU
TLSH
T13A868C26B3D40E16D32FCABD83228902F2F9F443539696CF0618EAD52F837C19976567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.VisualC.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Runtime.CompilerServices.VisualC.dll
Size 29KB
SHA256 0c4ad019991df6557e370b482014c1547804b5afe2fd02990aa8d2c2b835498e
MD5 d96e92f7cabd38f5c38a7926978decd5
SHA1 ff810687d6f118da23ed895d7f61543dec28a834
SHA512 330a572c08a76356438f7ee8bacf325aa616c8a543e558e4a082510e6d68a03bac004c23a17530b4d98ea8943b21875199afc34ddbf11331473bde9b04937ae9
SSDEEP 192:v+WsHLWRpjGa3HVilUFLNxH1lzWVi4TaMWCWKie1BzBWseawW/Fk2K13X01k9z3F:v+WsHLWRpjxoG3VtwZlNZ62QR9zCTm
TLSH
T1A1D24AA19B6C8367EE6B1C74D9B5E6833D35B3C59B525BCB109DE1065C623C48B30634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Runtime.InteropServices.dll
Size 109KB
SHA256 0377b3ec6ee4ea2a4c386d59171759dd1a2a5ea58a24fae2faca8d6f7f500eb4
MD5 b57ddea21f04d1acde2f1d6f75f7cce9
SHA1 e3b794b813e48ece251add585c21ecac24e87846
SHA512 f028c11bc8e9158ae02b3d7a194935fe4c57b55b20c540468be0a6ca1e24434af9e2cf78327e1bffcfc0e88c09a97bd127173de8473ba2bbb7649b68802da894
SSDEEP 1536:zKYPiaYGgQpnNPgGZ6QYIhRFS/wM6ppOKKnUilMzzI:zKZQ7pR8QYIRFS4M6LHKnUiluU
TLSH
T1D8B3392037E8026ACF568738FC7369509AB2F7C25312E6DF5198884E0ED77C166737A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Claims.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Security.Claims.dll
Size 97KB
SHA256 8fce868bd0c246ae38145c71d0188df9add9fd337cb4bb20d3f7872ca485f364
MD5 ce006e8bdf913623f9ed83203afea466
SHA1 e3812de762e54b23b07aad0921250a1b6038ed4c
SHA512 12919bf9b418827701d52892709e72c46e073fafc7db29721ad4b423c6d76677b14a7ab19a4ae086e346ecce9aac4028b926b859154cac4cdaa7d69889f10538
SSDEEP 1536:BeQcBi93A8w0L15AiqMhTp6CedGOQwQ7rzUU3q2bP6OVvcW1zo:B8BiRxFR5TqCIdsvj10
TLSH
T12EA33B6437EC0212DAFA4F3DD5E28409E974F6821761C6DF1A788B4D0D97BC1D932A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.ProtectedData.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Security.Cryptography.ProtectedData.dll
Size 53KB
SHA256 49458451b5689498ea821f9ee505f2613f126911ab7c765e5f21a93c5403d719
MD5 44f53a55ecb14bf803f0b351527babc4
SHA1 27113b3267b88bc38974ee1aca41a45f30beddd2
SHA512 312a1b798fdc86e7afba49ef88a740aa59ad28972d50928e37d32f66720b0654bc942ae20663509b9153b764b9679f131bc7e474bd38e0cb7d5e0ff18fce6795
SSDEEP 768:vq8VF+KpLcoDwmgC2w9JMeax7FVx7Yv1FnpARqBnOFBq79zM:vq86KWIwjo9JH6FXqpAR7iRzM
TLSH
T1A2335D119368836AED5A4838F872F70A783CD2C5C656BB7FC1C890491DB2BC19E3576B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Security.Cryptography.dll
Size 2.0MB
SHA256 fec1abfdf414457b3d7d37900d7aff8f52cebe3dbadaf832f86d4270ce75c365
MD5 a67e2d59f2c173af7ebe65194c301efc
SHA1 a2b8a4300bf214420b5129c8b30bba4c5aa9b836
SHA512 fa3915836af0741b6ecb0b5eb0fc98a95e3de6e47a1f69978cfab6c28743d6910c8f54ea9ce559ab23669742ce8a8cb15fffc3a295a6180bf31745b130d474ef
SSDEEP 24576:dvP+VBkKkCgYCnYEzHDAlMXFY8fqr5QNjI6tqTAWvC+A6xpc0IP/K9aRNjwrH/SP:dvPAxgYCnBfAlilNjI6NW9A6xpc0LcdP
TLSH
T1EEA58C18B3D08A26D9AFC67DC1138941D970E4539752EACB1149EFC82FE3BC39636297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Security.Principal.Windows.dll
Size 181KB
SHA256 5d5533f4ef6ea717312c1267cc295ad01655a784abc5788313f97f21e19e417a
MD5 51e55380dc7bc7584be072ff56e8517a
SHA1 1609d96df7d472c42e52490c315c0bd602b02949
SHA512 43f47b9122337c61e59a8a09fbf2c8cc0c296e87af2189006bda3f7049f77e65536c09562ea0d728273a68b70539e8872c66b359db0785aa45213d0e51fa624b
SSDEEP 3072:A4f3+8pgzE+WhJFiG5RHdHnbDfzC/8Id1hZF3miBJ:NfO8pgzlYh57HnbDG/8IXF3mk
TLSH
T172045C1663881506E66F8A3C81738A81D7F3A49B0749FAC754D18DD52F9FBC2BB32253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Text.Json.dll
Size 1.7MB
SHA256 0f6b5625311c1d98678cebe33a37f7e7ef3ff6ddc0c6653a0af17cd2e9e745f5
MD5 ec9b2be3baf52aee1b6d66aef020c480
SHA1 450034492d192a0c521cd593cb838a10c0a19841
SHA512 4d5ea46ee1847bd74a8a2958f84e5d4bce9eb96dede493c9016e765691923e67c1c04debeff734932d6893bc5054ab5cf53151e92624f76bdb15f5418128e6ce
SSDEEP 24576:F3NYESMfKKo27Gzp3JwOG4YZ4JKPwgZHoUxcb12YAgCvaj3ytRY:F2EJSJ27QvG4u4JiNoUxZA
TLSH
T106858D15A3D98316CD6ED2BED4B3C022FA75B8421352D6CB34A4DA852F937C253372B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Threading.dll
Size 81KB
SHA256 3d4d5fd570ebde1da7d9e1fa15fe9de4af00d352ac9196ab1e1a93147d4cbd95
MD5 2d4a8b0103a7c1ab7a13b873456da1fc
SHA1 866f19e1a1e947ce089b2c1edc1d24c270aa5841
SHA512 40953a2be01c086d021fe849b9fbae0e281c090745a78c25b25c6d64a09e056ca3d59aa5b18624ae6e87ceb2020b8ffa2ea74195e173de1d8f86767392810285
SSDEEP 1536:AuWp18Q4ogHwXQaJUglRZdRbH98cOfon1Bz/jmn:AuWT8Q4oAwXJlRZHrKcOfonXmn
TLSH
T1FF833811A7E8051AF67A877DC5B75A058076FAD60B00C5CF11A9D00E2EB7BC0A7F35AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Controls.Ribbon.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Windows.Controls.Ribbon.dll
Size 1.4MB
SHA256 4fb08f9d5311d071e6a76c75036136dc0289e1aafc2bdb4b6d78763eddb341e5
MD5 68e3f750594b4906ada230d78626a83f
SHA1 37b3a0d6cf90339cf9442b4b2581af803837ad71
SHA512 8d8fc2fec791272b53756ce437395fbdf3481545f6d58725f7cfafc37cd217d91fc921ec6d740b07ff21193d18658c6d4f8d69ed2a09aa0e06815b6a1f86daaf
SSDEEP 24576:swWllrTtLV6HmakghIWj4dJUPo0e3AGGvDuw:folPtLV6HmazhIWkkL5
TLSH
T16365391223A4876CCF3E55BDC1365624E471946317B2C0C704BADF882EC7BCA9776A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Windows.Extensions.dll
Size 117KB
SHA256 a22d5275f486b1ac5b9c5aaab6b265133e138e4a875fb9e6bc9fc030b97e6af6
MD5 6b4eb4507b230dfdc566cd97dd785417
SHA1 7d1c8135932057c5901365058c0d0e7f6b202023
SHA512 1ecaa28adab497f10217b0039278f199ccb514e5d709a021ac782fb7248d657810ae2bc7d46161630c88788fe229770f1f5b9821d7e9c07723ba04fd3e5d30e2
SSDEEP 1536:DCCGqxKG3pbN9Q3rJKtTso0B/SwgxAkwaEptJcKbYqx57YPjFvTbU6q8TYVBzIQ:DNGqVzSVKtTso0xswaMtJ7bYckddtWsQ
TLSH
T1F9C3081073E40225FBFA6E7CA9F694118637B8926B31D6DF0581808D1EB7BC5E67072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xaml.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\System.Xaml.dll
Size 1.4MB
SHA256 a94e47527b3992fad1897772a31e496c32bd695dba7043af915dcc6f5a1fceb7
MD5 1a4ddb1278b79b3b5e0259450dfdfac4
SHA1 9888b1b68d844d1916bc81ea1f24cbbc9d811f77
SHA512 aeeaf0eecb86360652b3b3ed1a8d23e668b5a81f7db5ae8ce3209ef001fd2dc32c479ec6a63e330d0d739e248eaf3674b67028b02b1016dbe08014a7a27abc49
SSDEEP 24576:JGRmNV6u2syFIjQUJyhHUfxtRXmqU7mJiqFi5/up44Q4ke977aG:Jjv2dFIjQGG+xtxmq0VuptQM
TLSH
T141657C2A6BD88B19C77F82FDD6A28112D6B1E1570321C1CF4421FE9D2F837C3967259A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIAutomationProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\UIAutomationProvider.dll
Size 61KB
SHA256 8ddd9bec0c1ce431e9a1c06761fbf0d1cc38967cd24372017532e38ef36f6d94
MD5 00003807ab9c94b8b84822b25870c77e
SHA1 bd931f1295667bd5070aa7f196403ee32e6ba419
SHA512 dfd3a6f25527a9c6df67e8df2de4d74ab010eef978a6f5269385a2439a245559d952bddcd29a1cad38eeb61891aa1dfb4ce3a6dba163dfd7d80e7f01c697b658
SSDEEP 384:C4oWMzvGaHTNbamSygfYSnqraO13ZfztL8Hqsg9/aycXJCLxmI2liZ/EZiQIjDZZ:ELHTMhQSGBztL8RB+xl0wa0s9zd5I
TLSH
T11A53B43C5FE85233D8BBC674E9F58983EC35B58336125C4E10D357894D93F82AAA261E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIAutomationTypes.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\UIAutomationTypes.dll
Size 305KB
SHA256 e147124f1df63a677c98d12d4addedb993df754ab515603bff12d206f942e8b9
MD5 91c3af8fa636d14a4717327c5095f518
SHA1 0a0484873f01e98164ed815509a13886b9fe3289
SHA512 8bd96d391f74a1c7cbd191e03e4d95794b18182cee5acdbcad90d4b6b567ca7391916184f2a3282e9a1a841347ea330583383ed3842a3a35e3f8d757677ffa79
SSDEEP 6144:WtLzLruZhtLKilc2HaPpcvysc3ILQNvwv:WtLzLruzci6LyaPYLQ+v
TLSH
T155643924A3D6065BD4BB867C64F3BA079475B41A3791C6CF0161875C2DFBBC2A832B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsBase.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\WindowsBase.dll
Size 2.1MB
SHA256 5702274d0ee53d20d0847f1aa284b02679313cf743be25af9aea4372384134c2
MD5 16355878e21ead94ba1b5215a213fcbc
SHA1 acdf52631497de519481208405fb72797e44e015
SHA512 65747a6cbcb59b34845ca52051e7e234d28e2210524e295d61da0c4cb6febe1f37f5d4791a9802d6005f62f658d9a9248a9fbd09f32b6e63fc50517b95eaefea
SSDEEP 49152:3h7W+Z9YQyECR9A5SEnW6Qzk0I4J1/0avTW/44oVyvc:E+FUgEL0jc
TLSH
T1FDA57D1B73C84612C67B82BE85A38111D5B1E4A31712C6CF6C05EA6E2FD3FE1C67D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.mp4

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\assets\background.mp4
Size 4.6MB
SHA256 b9b57776f646ec4df1724488a9cc1c26616ab44769d6ee612afc2487523b3d32
MD5 9a0840e75b7cd34ca14e3c91084fc404
SHA1 560886ac27cd47b43d1a7fa36b928c9ac72a3895
SHA512 7de99676ed64e9712d30895d0ee6b2d68a103cbf8b789196d5b95358b09775213b0f0916bc665e829c64784b1a2fc760ed17c8b47cab39131cdd5ddc98fb165f
SSDEEP 98304:TxHbz6BSlNpMsOBpawkokPzF6ReyZ3Y4uYcyDW:5qBS7bOLatFkYfY6
TLSH
T1EA2633BA3F41E163EEA81178289167F42E7CDE409A2B659A3B0537180D787DC9F173D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\xXD90B1eWSl+RvFec1cB7xXUIIpH3aI=\wpfgfx_cor3.dll
Size 1.9MB
SHA256 699ed38f9decff822b64a76fff30519226cfb9886abdde223a0e42b88fadea0d
MD5 d6a7e3f1652bcf3bd266f1ab04b256f3
SHA1 2fcca11403b7e6ed30b631752171d60e275e64b9
SHA512 0f8a7c1f4d65a453e9e9a8a310427e515932e652f32e4e053fd3a6563ebf52fe3217a557430e925665c8512fd555cf0fe258b3a38013dba0d98a5fe9f9a0acaa
SSDEEP 24576:QtDwCz/yVZEUmkGRaMbp9WFlJJT4C3fd6FlwTvfYPiEGRisPVAmbQ9dnZlJ/:vIqmUmkGvF94lx3ELwT4PiE4iCxK/X
TLSH
T1AE953A4AB7BC40E9D47A933CDAD7861AF27174142B6197CF23A0479D6F27BD00A7A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7de6defd-a60a-4f50-8df6-aaa9d04061bb.tmp

Path C:\Users\Admin\AppData\Local\Temp\7de6defd-a60a-4f50-8df6-aaa9d04061bb.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a50bf3f6-1ebd-4ccd-a704-7255514969d8.tmp

Path C:\Users\Admin\AppData\Local\Temp\a50bf3f6-1ebd-4ccd-a704-7255514969d8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

91b15db0-b34a-46f2-9171-dfdbfe13707c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4984_208691310\91b15db0-b34a-46f2-9171-dfdbfe13707c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4984_208691310\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0087a67505064a09c6cef7f94c5968b83f8a539db716bb52873c191762f104a2
MD5 7e03fc711590430889e143d04866f975
SHA1 3468eadc78c509a97e5d0a2d78eb1bb0e3ebb40b
SHA512 4409aa320fde1da26099fdddc24792df28669cc6346886878b3dd7354ee3efed1f8689ad6d0b2c6217e04a9efba0d716d3712355849108249960320ebba44167
TLSH
T1E6D0127236830378C01020330052710D0541D50F80078104B428971D1A444A00902851
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b086b6c5a2d7da46d8aad4f8742c283b06370b4536beb4f486e50421acce6adc
MD5 3082f302c4f264ff1ba9f52b09f750c3
SHA1 45383340407725a8798d7b799face11fa7cf9a3f
SHA512 a7a94f26b267a76fe1e0a6f1a1484886091263c40ca3b074cc9a9426b44e17da1cd6868c8bc8d13f348909d393b16ff51d87d695f5d764777d18d6f4371105eb
TLSH
T1B0D02BF232570774C310313740C1F14C1101C51F400785047E35FB1C0A804F10CC1D41
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 79663cb2bf79629bb9abcd949e1f0f0fecebb82053614bf0a8ff7003c1b1caee
MD5 cbb77b85f5a919c1f947422bb51a1d92
SHA1 426f935f70f02b772fe6658aa55fb37a4f62bf46
SHA512 ea6a278d67fa12a0d62fc49028c3353a3a0f8ee5466741fe7920f262399a18c138d26f9c4d6614eae4fc65c2072d2211a8f5c52fcb1e2b122437eef6be99a901
TLSH
T17B1166948CE150D0DF58A376E5D20D047B7228C19A83FF36950B00743C3D3DC8AA4ACC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 926169e660258385a962cf89cbfa72f0ed26d463e73538b49f4aab83c9dcf4f3
MD5 7b38168182da49a8c07353d9a3eb573a
SHA1 4b19f1fa3cef31a1e20b3f2307cbae1e1c44c722
SHA512 194d68229a233a259d165497a2c2491502b56e6c7fdf8b0cf0d7df4c6590a0473ef04fdc0acd500da52fafe645f7115f7e5c91b1aeacb162ac9b072b8e0bfc57
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\Network\Network Persistent State
Size 7KB
SHA256 b447ddd9609c55593d2f781e8f6c07578fbbdfa336a6dddd478076b79b1cbbbb
MD5 93a63f00bcebb71c8663becc90c8026f
SHA1 8a431f3b1778068ae6d389904082a13f3948cea0
SHA512 6f0d89b05c4cecddce8128a64b325bb364ee4c7262a42475f0f165f520d12e8f852e1e9ebeb7b858670d196e344c6345552aac89915edfcb977f6624922c080b
SSDEEP 192:DVFXJFeyU1tiI5Ctl85AiYCgCH8NJiQWqsiY3e/RCWCPlnw1hyCIPIVzdOsPDn:DVF5FeyU1tiI5Ctl85AiYCgCH8NJiQRH
TLSH
T14FF174F7C3F48A3D8A5196F82A25AE1BCF1D0625032C297A88C57F46D3E7462E21175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State~RFe5b88c4.TMP

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\Network\Network Persistent State~RFe5b88c4.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\Preferences
Size 9KB
SHA256 245e086e4f99296d16e7dd13540bf148039790f8322fe32835064ff8f4b0c687
MD5 1c8211800901e6e75b447a17078e6091
SHA1 e5dc6dfc0d493c159b563d4f6996e3a949d1f306
SHA512 96e45eb7d77a25376cf6215ecf09f69df51238b91f84d5bc68e7dc9c6cdef9050f557263c35de72d35fbea259d26dfb9ad35a22fe493a1486242f202f72de3ea
SSDEEP 192:stv05NfS5f0/Z8pFKI5p/S+Witfcr1Kw0th10tRBJ4qFCJShjhQIXQqtwvVQICIu:sts5NfS5ceF/VaowHq4Px6+nw8
TLSH
T18F125393E97C1AFB0DCAA53DF424F32DD2E5002666D54ED9ABF9C82C04D69DCA106CC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\Preferences
Size 10KB
SHA256 a0a9aee81b0da7facb17a5f577a1acb742a44af3a13bc914b51dad313e799745
MD5 701ff6ad5a4f4da5a3fdfe69f6b36296
SHA1 dfb4875f120dce3f079e1bfe326aac83fb2fab78
SHA512 5938e5642104faa214c61f0e969eff31074c56809cc4db679b282638aa64331b696d509f0c80e25602bdf158102b75551e79510664e1db2f37d711a839cc409f
SSDEEP 192:stv05NfStfYZZ8paKI5p/S+Wit89B1Kw0th10tRBJ4qFCJShjhQIXQqtwvVQICIE:sts5NfStAsI/VGewHq4Px6+nyvC
TLSH
T1F2225393E93C1AFB0DCAA53DF424F72ED2E5002666D54EC9ABFDC81C05D79DCA106886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\Preferences
Size 9KB
SHA256 5601483753affef110cb495ca5319b639a138db3b5ae347ed90e9f6c1c2f580d
MD5 40b8758e2a9785c7dee6619459c38a8f
SHA1 b9b4b74e99fd1886b20b1f30e0c13794ac2f4a77
SHA512 7bc602fa7c579874fc2961d762b30ccf8b8f679b267c0e689fda67278daa262976eeeee036e5dca7340d03ef553607a5d4956ea85fe71a557b8373afd1301af8
SSDEEP 192:stv05NfStf0/Z8pFKI5p/S+Wit89B1Kw0th10tRBJ4qFCJShjhQIXQqtwvVQICI0:sts5NfStceF/VGewHq4Px6+n48
TLSH
T1F1125293E93C1AFB0DCAA53DF424F32DD2E5002666D54ED9ABF9C82C05D79DCA106C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5ad255.TMP

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\Preferences~RFe5ad255.TMP
Size 9KB
SHA256 c286f1e7964a76f705a6d2cce24d273afd255f613ad800fe122710b47c6a8ff1
MD5 8323fddb43d0b662d67a62e05fdc6222
SHA1 15b3350dd0eb2456fb0dee1d6c6804344131e2b1
SHA512 be05e544fe80a102c23eb125acf16fb79bf45bad7c1938356eeb2daf69a88c8a8771b0c42324ba457bd250035d0478350d86d0527c71ad6e22c28cc45ddbfed0
SSDEEP 192:stv0OfS5f0/Z8pFKI5p/S+WiteCJ1Kw0th10tRBJ4qFCJIjhQIXQqtwvVQICI53i:stsOfS5ceF/VVGwHq4Zx6+n68
TLSH
T11C125493E97C1AFB0DC6A53DF424F32DD2E5002656D54EDAABF9C81C04D69DCA105CC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Local State
Size 1KB
SHA256 ed1781d9b74f746e083f053683a5562576a289e1b029a1fd53e908e8112d120f
MD5 f5c6882de1786b30544cca3a548ea7a3
SHA1 676321d48cae5fbe0b4aa006a9d310a254adb89d
SHA512 bb6b12561a10ed890406093ff87a153bfc9bdecd1e3b9b79503bc061b6129041cba56ebce789ee9bf09ad985d28f72ba421f10ba644e73ed87eb65c437ed7cab
TLSH
T13531A7B1E0542F766CC65A9EB1427B476F21102AD3610F5861EE4B5C02EB9DCA92AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Local State
Size 2KB
SHA256 fadcffd608a2ef071b88d12d202753cfd3a80b91a864edf6ca694e27d1b6ff4b
MD5 84c5461ecc95b55d22d3dc0d4d698bb4
SHA1 afe58bf9d4bbf21d2bcbb73347196de8c3d377a1
SHA512 4fc45e17345aa432bf178fa0dbbd3cb3e374d7dd41fd261b93ddbf4d747c3a15c32518b59f5d9566a10ca42c0f185e1db1d733bc901089fd7bd42c2dd81df9ea
TLSH
T1DF51A772F414AF774CE35A4CB94A3B13EB32516597621F6495EE0B1C01EB99C2706C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Local State
Size 3KB
SHA256 ef355cd50e8004af3cbc87769dde17231e411fd04ba8014902af7906dcf2b83f
MD5 a6819f6c72bab5c277102e67540c6996
SHA1 e3f4823614705622ac7374d7d286db4bcb0f85c6
SHA512 259cfa72b4564ba4f9a49239dd48a888022959e42618919aff1290bb450c8b45689f7714ed3ba44278570f916596de16a8c585258342cbf4edd4bf749f2e17af
TLSH
T1AF719676E464AA3B4DE39A49B8863B07B7615127E6912FA8C5ED0F0C01DB6DC1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Local State
Size 4KB
SHA256 f90e08e516d7b5dc59d5603053e3e00d61f246248b34d66fe51d98a9f4b01dd6
MD5 0bb145534fb0b6dad9e6f0b4e36c1248
SHA1 4be5371e7d52155832366960d86dc0b0d4ebbc4b
SHA512 9c46d2241569229ee1be30c749821edfe3493f43afae7701e3fc909c0dde341722ed913920649cf9d0c0c2e53d486058cc39f730fed71d24cba10a1c63edb3f7
SSDEEP 96:zun5bNkCE2CfNnJ58Frh/cInURoDotoionDiBxxv6uwVZrhT1l7a:za5bNbAnwooDUDiixxv+9a
TLSH
T105819522E574AA375DE79949B9863B07B7615027E6D12FACC9ED0F0C01DB6DC1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Local State
Size 4KB
SHA256 f5ed90d7dfae0f8f2346be61cb4bcd567abe20f11c9383372c6be665b666e1a0
MD5 92e01ef1fa7b36c280d3fdfa79252504
SHA1 fd361f6080ae999150d21a7f2389af4ce3f618b3
SHA512 91838234d18956190d86c2ed02b90b3e2d2f586ab0d97bb58c64185a023d9f7f0ee086f23cc5c7961525a56ef8e324b9c0ff04f4aa3bc2d93e3cffa170413557
SSDEEP 96:zun5+NkCb12CfNnJe8Frh/cInURoDoto+5onDiBxxv6uwVZrhT1l7a:za5+NbxnDooDUhiixxv+9a
TLSH
T14A918321E564AA374CF7E949B8463B03B7A19027E6D12FA8C9ED0F0C01EB6DC1346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Local State
Size 4KB
SHA256 adbb74ea69ac7ae38369ace9bf1a6e1208a5325e28458e5d7eabc0a5a51fb055
MD5 bc2d21c57fcb2b5908b9a60977e25382
SHA1 4a9086695014d38ae296d119953fecdcaee38d02
SHA512 fc7884eda49f56b7aae8761daa26dc4dec39591ed66f6f7bfc8f5b49d7b1ada6892fbfcedb5730251363040d6762f73caedf7b98c92339fcb878237653877d4a
SSDEEP 96:zun5KNkCb12CfNnJt8Frh/cInURoDoto+5onDiBxxv6uwVZrhT1l7a:za5KNbxnkooDUhiixxv+9a
TLSH
T169918561E574AA774CF7D949B8463B03B7A19027E6912FA8C5ED0F0C01EB6DC1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Local State
Size 4KB
SHA256 310df279898f5defacba1fbcc6e02b1517302c06c2201b3d508e51e271c28414
MD5 5b5ee686bdbf088e6897bc49710a4133
SHA1 5e27697b25ef378c022f80b74cc04bd69f2fd8bf
SHA512 015b83c73c12dfa3020640ce01453403e567bb400c92bce7888edcd71b97c06d801fb8a970aa607921a476c86b0deaa8392ad719e2c3e7434228a70a61c7f5fa
SSDEEP 96:zun5rNkCE2CfNnJ78Frh/cInURoDoto+5onDiBxxv6uwVZrhT1l7a:za5rNbAnuooDUhiixxv+9a
TLSH
T17A918322E534AA774CF79949B9463B07B7A29067E6D12FA8C9ED0F0C01EB6DC1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Local State
Size 17KB
SHA256 de965ab0d0a065fd32778c7910ba4c64efe6898571ab29f0d74e87e40aebf381
MD5 7b42f7777254fe672b43b48893ef8afa
SHA1 e7de7add34d83d13891093e45be68b9900c29e11
SHA512 019b4baa925a67beba1f5ef9b29c7245071aca10a50c07f4861c1ebea18545b4a738f69a1b27e934fcd2d5160dcb0884d8c4da2e10be3c0611b2e2b3d87efefe
SSDEEP 384:ze+aQikB+z/xvxjg/qhEJ3NbhCMXrhW7MiH6JBNF9zS:N/UxvxjgC+Jbk7MiH6JBNFFS
TLSH
T10782AF37E429AE33A8F7A645760A6B8BDBB5806291C56EE84DFD1F0C06D77DC0302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a7f43.TMP

Path C:\Users\Admin\AppData\Roaming\EvoVis\webview\EBWebView\Local State~RFe5a7f43.TMP
Size 1KB
SHA256 f79bc5b4d1440e6aa04182a4accb57451fd6021f60c975465a9bc1d2bd34d6ba
MD5 58c4a790a949ff2f80518deebc64f9bf
SHA1 9f3d0787385385b09f6f94afdf26ff67aea3c57e
SHA512 b7ff616dec9b1693f523e7f71aacdd25272ba0e22324f2960fa32d3f5db9cdcee1158a64856d5258e047be818ba4fa85544966bd2cfd4ff1e8ed6d7f1b644b23
TLSH
T112216572D0546F767CC5099EB142BB4B2F21506A93600F1CA1EE071C12DB8EC9966C33
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1728-1498-0x00007FFBAAA20000-0x00007FFBAAA21000-memory.dmp

Download

memory/5420-1540-0x00000202D0720000-0x00000202D0724000-memory.dmp

Download

memory/5420-1549-0x00000202D0970000-0x00000202D0974000-memory.dmp

Download

memory/5420-1721-0x00000202D6A90000-0x00000202D6A94000-memory.dmp

Download

memory/5420-1728-0x00000202D6AA0000-0x00000202D6AA8000-memory.dmp

Download

memory/5420-1727-0x00000202D6AB0000-0x00000202D6AB4000-memory.dmp

Download

memory/5420-1725-0x00000202D6A90000-0x00000202D6A98000-memory.dmp

Download

memory/5420-1724-0x00000202D6AA0000-0x00000202D6AA4000-memory.dmp

Download

memory/5420-1718-0x00000202D6A70000-0x00000202D6A74000-memory.dmp

Download

memory/5420-1719-0x00000202D6A60000-0x00000202D6A68000-memory.dmp

Download

memory/5420-1553-0x00000202D0970000-0x00000202D0978000-memory.dmp

Download

memory/5420-1552-0x00000202D0980000-0x00000202D0984000-memory.dmp

Download

memory/5420-1722-0x00000202D6A70000-0x00000202D6A78000-memory.dmp

Download

memory/5420-1550-0x00000202D0960000-0x00000202D0968000-memory.dmp

Download

memory/5420-1547-0x00000202D0950000-0x00000202D0951000-memory.dmp

Download

memory/5420-1545-0x00000202D0950000-0x00000202D0954000-memory.dmp

Download

memory/5420-1546-0x00000202D0720000-0x00000202D0727000-memory.dmp

Download

memory/5420-1543-0x00000202D0940000-0x00000202D0942000-memory.dmp

Download

memory/5420-1539-0x00000202D0710000-0x00000202D0711000-memory.dmp

Download

memory/5420-1541-0x00000202D0710000-0x00000202D0718000-memory.dmp

Download

memory/5420-1395-0x00007FFBAAA20000-0x00007FFBAAA21000-memory.dmp

Download

memory/5564-1436-0x00007FFBA9A40000-0x00007FFBA9A41000-memory.dmp

Download

memory/5564-1437-0x00007FFBAAA20000-0x00007FFBAAA21000-memory.dmp

Download