Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    29/10/2026, 19:01

General

  • Target
    EvoVisLauncher.exe
  • Size 74.6MB
  • Sample261029-xpn4basvay
  • SHA256 3939baa001b00a7837e29c9b2512ced76a6f490bf24b24edbec15063545329a9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 52 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EvoVisLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\EvoVisLauncher.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    PID:4204

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        WMSDKNS.XML

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
        • Size 9KB
        • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        D3DCompiler_47_cor3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\D3DCompiler_47_cor3.dll
        • Size 4.5MB
        • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DirectWriteForwarder.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\DirectWriteForwarder.dll
        • Size 505KB
        • SHA256 a98cbe43af323e76c814b3bdf3094fb85de5bda335f949aa8477bd60d78fd9bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EvoVisLauncher.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\EvoVisLauncher.dll
        • Size 2.4MB
        • SHA256 be63adbe221e7250a1cf155ee00c7eb1b12a4aa6f43ffd0f0272d50d65ecae82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Win32.Registry.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\Microsoft.Win32.Registry.dll
        • Size 117KB
        • SHA256 c50525843a2f58e044a9a46cda4c7f65d8781489da575a734e39673c9671045d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationCore.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\PresentationCore.dll
        • Size 8.2MB
        • SHA256 49050af8b5b97c410ba90106485e549a405d7c19fb6310ef0e705820d8c7d597
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationFramework-SystemXml.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\PresentationFramework-SystemXml.dll
        • Size 33KB
        • SHA256 c7f8b55c76570b339055c4249b63bdc0a7c8f14b3cfc066cd9fb3f3a06c6bbc8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationFramework.Aero2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\PresentationFramework.Aero2.dll
        • Size 441KB
        • SHA256 ead11040d878c4c83d5f5d2a6f5c4d92fcbc1010dc8a10827d69f3b4c60bbcd9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationFramework.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\PresentationFramework.dll
        • Size 15.4MB
        • SHA256 f20a81e7b3a0ea61c0f4dd565c652b8dc564aa4256ae29e376e9604e65d4ac93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PresentationNative_cor3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\PresentationNative_cor3.dll
        • Size 1.2MB
        • SHA256 7e5064a14f3b6d6261d7a8eec1722d74cd1780d8d5cc4c5dc9e2ce43ba10fc69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.Concurrent.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Collections.Concurrent.dll
        • Size 285KB
        • SHA256 a0c6d712c9cddefebdc20e5ea374e7f5b925b2cdd3c43c7b9ebee2f1be40d183
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.NonGeneric.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Collections.NonGeneric.dll
        • Size 105KB
        • SHA256 35e486eaa7cab7a7b33fd0da82b550ecf9e6c98b390094041929a6b53e3ab777
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.Specialized.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Collections.Specialized.dll
        • Size 101KB
        • SHA256 a8de889224641938d363dc92e5fb5377997284756a68ddf7d64a826ac98a7b02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Collections.dll
        • Size 325KB
        • SHA256 8055cc85123e810f16613cc872aeb4b8db4158677b3d6648873968cd1a1f5d35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.Primitives.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.ComponentModel.Primitives.dll
        • Size 77KB
        • SHA256 80dbac49c40a814fe7341f27c0316c7f09bdad7e7bf1cf4368ecaf7c167bb7db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.TypeConverter.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.ComponentModel.TypeConverter.dll
        • Size 753KB
        • SHA256 8c5f541804113cbca302ec533f0078adf5499c6264cc785dfd9cc4d5d732e92f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.ComponentModel.dll
        • Size 29KB
        • SHA256 fff61957f2bc45c51d66c8e3b3bafa8e98f361ff59db4b4e2bae36209492d6f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Configuration.ConfigurationManager.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Configuration.ConfigurationManager.dll
        • Size 1.0MB
        • SHA256 ff4ec7942e2c262fe518506da8295866005ed95ca4c7515ca78c54ba5f5c4af1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.Process.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Diagnostics.Process.dll
        • Size 329KB
        • SHA256 d2e1d2992fb1eedbf5e38869155d66e5fa2932d2839ef487c7d5ed4e5d096500
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.StackTrace.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Diagnostics.StackTrace.dll
        • Size 45KB
        • SHA256 fd2d2d3e940aaaa731f210c24d64ce35c1dc9186cbb0914420458bec2815d0e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.TraceSource.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Diagnostics.TraceSource.dll
        • Size 141KB
        • SHA256 8d9637094867928eef16a59c7d6474e73cec2c0bd8487b88e5350a7023315872
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Drawing.Primitives.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Drawing.Primitives.dll
        • Size 133KB
        • SHA256 28beb5c8c7654eaab2ad2f26ed4d223d74d0b1512b7120d9b21269ee9fbd622d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.IO.Packaging.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.IO.Packaging.dll
        • Size 317KB
        • SHA256 0bb0795f6071f95c3e46e32f03afe7dd934fa9e705f675ff44e2525d6282b14a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Linq.Expressions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Linq.Expressions.dll
        • Size 3.5MB
        • SHA256 e119c94935e9a5ccf2d0d830f28127339396ce38d909da9952d7893370e411aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Linq.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Linq.dll
        • Size 641KB
        • SHA256 f878b3058ec073483712e64fcfb0b20aa1b480b7d90cc6f2d27a4d28f1130764
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Memory.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Memory.dll
        • Size 157KB
        • SHA256 46c667a396f1f9efb64ca675f99dd5a7fd174c1a3a44924a1f8dd609ed8aad23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.Http.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Net.Http.dll
        • Size 1.7MB
        • SHA256 3ebb0dd00392fbef43ba8ae64f59170c6bb8005d086503376f5b857ba2ec1922
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.Primitives.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Net.Primitives.dll
        • Size 221KB
        • SHA256 fbd166a28c914653f923f7ec8cebb17580f9c2089bf5d30fbdada0c2aa1ac814
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.Requests.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Net.Requests.dll
        • Size 373KB
        • SHA256 6e34ec3d8c6a2d31ba32c9af8eafe9be4840633c77ef74963b6abf92d301056f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.WebClient.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Net.WebClient.dll
        • Size 165KB
        • SHA256 2095176c5b8c9bbe720b2e55a935fb265d4eb82c64d10fa20f15ea6b59fc573e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Net.WebHeaderCollection.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Net.WebHeaderCollection.dll
        • Size 61KB
        • SHA256 f0b93b27cf539d936b0fa2fe826e41b64a0df7efa5a86e32edec781c48d39ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ObjectModel.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.ObjectModel.dll
        • Size 81KB
        • SHA256 246f1485b90e76f9bd57d111d63cc6f455ebbe0806adea5ef9494e0f284b4fca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.CoreLib.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Private.CoreLib.dll
        • Size 14.6MB
        • SHA256 603040f32ea81b39041b4c487eb3f64a57618107f33947f0775926c22a6645f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.Uri.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Private.Uri.dll
        • Size 253KB
        • SHA256 b66253331c9e314923ddb905f98ab189d22476217eff16e13181c071e02c3575
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.Xml.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Private.Xml.dll
        • Size 7.6MB
        • SHA256 728b6097073e377c42a2e0eb9b536033bf9237b736e15d29e7aad24a15efbb93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.CompilerServices.VisualC.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Runtime.CompilerServices.VisualC.dll
        • Size 29KB
        • SHA256 92070285f12a26e4ea3a3ef77bd485d4505d048931d345b67434fb909c5c967d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.InteropServices.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Runtime.InteropServices.dll
        • Size 109KB
        • SHA256 00dbb54e60c6f5329cd314d4fb4524b78df6b42e17e6d65f5d8ae7f03fd28fc0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.Serialization.Formatters.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Runtime.Serialization.Formatters.dll
        • Size 121KB
        • SHA256 5bc554b76259e7955cf73fa821f37d3bbb10c10c835000a7cf6478f399a1b159
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Security.Cryptography.ProtectedData.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Security.Cryptography.ProtectedData.dll
        • Size 53KB
        • SHA256 a4c8a56dcc59961c6ff6c9a5d445093e48e3ceef45c844b23abd42046710498f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Security.Cryptography.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Security.Cryptography.dll
        • Size 2.0MB
        • SHA256 445d9895ac350f32d603adb0d35fb4fb1259b6f5d3d7e5484c6ebe220d4d2493
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Text.Encodings.Web.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Text.Encodings.Web.dll
        • Size 129KB
        • SHA256 3a452759ed426f313a8d54f0adcf2a3635743d9946e3afadbcf29f83a857d24b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Text.Json.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Text.Json.dll
        • Size 1.7MB
        • SHA256 f564c35eacf32f5387840ec7f8be7d42703bb0157d16b172143abf8f80714f44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Text.RegularExpressions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Text.RegularExpressions.dll
        • Size 997KB
        • SHA256 8aa34edcd00c3f2320b6c7c884efc58e356bd60eba32e97527b1a41f49f00c1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Threading.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Threading.dll
        • Size 81KB
        • SHA256 871bf03911dbf08dbe29a7a17210f82866777020244bbe2acd879458f8dca398
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Windows.Controls.Ribbon.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Windows.Controls.Ribbon.dll
        • Size 1.4MB
        • SHA256 9eca44c22675d2492e8e4f094b6121cdf8de027ebe2b490954508edbb5ce4f52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Windows.Extensions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Windows.Extensions.dll
        • Size 117KB
        • SHA256 731f60c75aa08e1185d0fb799fd3145e52acdcf4d84205393d85a2d3729ca04e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Xaml.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\System.Xaml.dll
        • Size 1.4MB
        • SHA256 1efeafa6c4b90f534ae93bdba8fcd2a6b17d1609531c560928bbf5e22660ddb4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UIAutomationProvider.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\UIAutomationProvider.dll
        • Size 61KB
        • SHA256 142b7e698f5b8fd3ba7efa02795091335c4ff20ef66a24d8aae30a2c372aa0f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UIAutomationTypes.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\UIAutomationTypes.dll
        • Size 305KB
        • SHA256 3afe1e1b16146b538e99cb6ceb16d3f5cb9399801e216c8be596af321b84adfd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WindowsBase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\WindowsBase.dll
        • Size 2.1MB
        • SHA256 39bce3391ce24841ecd76d2be3c957b3c53569379a5096979e6ce9e26582ce6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wpfgfx_cor3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\EvoVisLauncher\u9wq+2TyYRhspKWm7JpJaOhXExJN9vs=\wpfgfx_cor3.dll
        • Size 1.9MB
        • SHA256 026a4111a55adca4292dda552cb41c46f5dbb1604e6d593080c75284560e1752
        • MD5 SHA1 SHA512 SSDEEP TLSH