9374f8a09d208c5bc30d27c20a5e9fa8a153eb083435e274427eecf9edffe5a1

Analysis

user interaction
yes
max time kernel
97s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Eon_Launcher_1.3.5_x64_en-US.msi
Size 56.0MB
Sample260623-vx83caev5q
SHA256 9374f8a09d208c5bc30d27c20a5e9fa8a153eb083435e274427eecf9edffe5a1
MD5 ad71e0e769841999c0a2c9dbd1003cde
SHA1 8f61e718979084772a9ae9474986b3783bff145a
SHA512 d0a672fff01aacbd59816b2f88a5c5e6de480b61caa4e055f0f2bfea3268eabe04347e3890e5566b09e7a6b62426d59a3a6793236bddd7900bc8da0ebd05cf46
SSDEEP 1572864:M0nWVv/pr7DGcfRiV6NNFkI9vgBqUfh97MPe1y0+nw:/W/GGAiHZ9vgYa7G4
TLSH
T198D73320B587C426E25F47779A3DEF1E007A3E26373345D766F0758A28718C1E6B8A93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Eon.exe

Executes dropped EXE 1 IoCs

pid	Process
4664	Eon.exe

Loads dropped DLL 31 IoCs

pid	Process
1164	MsiExec.exe
1164	MsiExec.exe
1164	MsiExec.exe
1164	MsiExec.exe
1164	MsiExec.exe
1164	MsiExec.exe
1164	MsiExec.exe
3612	MsiExec.exe
3612	MsiExec.exe
3612	MsiExec.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Eon.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
81	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8858.tmp	msiexec.exe
File created	C:\Windows\Installer\e5884ae.msi	msiexec.exe
File created	C:\Windows\Installer\e5884ac.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8633.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8654.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A5A96A11-F791-48FB-80F7-93C5782AC1DE}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5884ac.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8577.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4432	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\Colors	Eon.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267090564572062"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\PackageName = "Eon_Launcher_1.3.5_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11A69A5A197FBF84087F395C87A21CED	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9C0C197053899B44B931EBE364973904\11A69A5A197FBF84087F395C87A21CED	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{DBE506CB-511F-4967-9AB1-253962C72786}	msedgewebview2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\ProductName = "Eon Launcher"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\PackageCode = "D42F3BDDD48CAD44280481D352B9D573"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\Version = "16973829"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9C0C197053899B44B931EBE364973904	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11A69A5A197FBF84087F395C87A21CED\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\Language = "1033"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2224	msiexec.exe
2224	msiexec.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe
4664	Eon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3480	msedgewebview2.exe
3480	msedgewebview2.exe
3480	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4432	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4432	msiexec.exe
Token: SeSecurityPrivilege	2224	msiexec.exe
Token: SeCreateTokenPrivilege	4432	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4432	msiexec.exe
Token: SeLockMemoryPrivilege	4432	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4432	msiexec.exe
Token: SeMachineAccountPrivilege	4432	msiexec.exe
Token: SeTcbPrivilege	4432	msiexec.exe
Token: SeSecurityPrivilege	4432	msiexec.exe
Token: SeTakeOwnershipPrivilege	4432	msiexec.exe
Token: SeLoadDriverPrivilege	4432	msiexec.exe
Token: SeSystemProfilePrivilege	4432	msiexec.exe
Token: SeSystemtimePrivilege	4432	msiexec.exe
Token: SeProfSingleProcessPrivilege	4432	msiexec.exe
Token: SeIncBasePriorityPrivilege	4432	msiexec.exe
Token: SeCreatePagefilePrivilege	4432	msiexec.exe
Token: SeCreatePermanentPrivilege	4432	msiexec.exe
Token: SeBackupPrivilege	4432	msiexec.exe
Token: SeRestorePrivilege	4432	msiexec.exe
Token: SeShutdownPrivilege	4432	msiexec.exe
Token: SeDebugPrivilege	4432	msiexec.exe
Token: SeAuditPrivilege	4432	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4432	msiexec.exe
Token: SeChangeNotifyPrivilege	4432	msiexec.exe
Token: SeRemoteShutdownPrivilege	4432	msiexec.exe
Token: SeUndockPrivilege	4432	msiexec.exe
Token: SeSyncAgentPrivilege	4432	msiexec.exe
Token: SeEnableDelegationPrivilege	4432	msiexec.exe
Token: SeManageVolumePrivilege	4432	msiexec.exe
Token: SeImpersonatePrivilege	4432	msiexec.exe
Token: SeCreateGlobalPrivilege	4432	msiexec.exe
Token: SeCreateTokenPrivilege	4432	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4432	msiexec.exe
Token: SeLockMemoryPrivilege	4432	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4432	msiexec.exe
Token: SeMachineAccountPrivilege	4432	msiexec.exe
Token: SeTcbPrivilege	4432	msiexec.exe
Token: SeSecurityPrivilege	4432	msiexec.exe
Token: SeTakeOwnershipPrivilege	4432	msiexec.exe
Token: SeLoadDriverPrivilege	4432	msiexec.exe
Token: SeSystemProfilePrivilege	4432	msiexec.exe
Token: SeSystemtimePrivilege	4432	msiexec.exe
Token: SeProfSingleProcessPrivilege	4432	msiexec.exe
Token: SeIncBasePriorityPrivilege	4432	msiexec.exe
Token: SeCreatePagefilePrivilege	4432	msiexec.exe
Token: SeCreatePermanentPrivilege	4432	msiexec.exe
Token: SeBackupPrivilege	4432	msiexec.exe
Token: SeRestorePrivilege	4432	msiexec.exe
Token: SeShutdownPrivilege	4432	msiexec.exe
Token: SeDebugPrivilege	4432	msiexec.exe
Token: SeAuditPrivilege	4432	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4432	msiexec.exe
Token: SeChangeNotifyPrivilege	4432	msiexec.exe
Token: SeRemoteShutdownPrivilege	4432	msiexec.exe
Token: SeUndockPrivilege	4432	msiexec.exe
Token: SeSyncAgentPrivilege	4432	msiexec.exe
Token: SeEnableDelegationPrivilege	4432	msiexec.exe
Token: SeManageVolumePrivilege	4432	msiexec.exe
Token: SeImpersonatePrivilege	4432	msiexec.exe
Token: SeCreateGlobalPrivilege	4432	msiexec.exe
Token: SeCreateTokenPrivilege	4432	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4432	msiexec.exe
Token: SeLockMemoryPrivilege	4432	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4432	msiexec.exe
4432	msiexec.exe
3480	msedgewebview2.exe
3480	msedgewebview2.exe
4664	Eon.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4664	Eon.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1164	2224	msiexec.exe	92
PID 2224 wrote to memory of 4976	2224	msiexec.exe	97
PID 2224 wrote to memory of 3612	2224	msiexec.exe	99
PID 4664 wrote to memory of 3480	4664	Eon.exe	110
PID 3480 wrote to memory of 3760	3480	msedgewebview2.exe	111
PID 3480 wrote to memory of 1452	3480	msedgewebview2.exe	113
PID 3480 wrote to memory of 1452	3480	msedgewebview2.exe	113
PID 3480 wrote to memory of 1452	3480	msedgewebview2.exe	113
PID 3480 wrote to memory of 5060	3480	msedgewebview2.exe	114
PID 3480 wrote to memory of 700	3480	msedgewebview2.exe	115
PID 3480 wrote to memory of 700	3480	msedgewebview2.exe	115
PID 3480 wrote to memory of 2168	3480	msedgewebview2.exe	116
PID 3480 wrote to memory of 2168	3480	msedgewebview2.exe	116
PID 3480 wrote to memory of 2168	3480	msedgewebview2.exe	116
PID 3480 wrote to memory of 5684	3480	msedgewebview2.exe	119
PID 3480 wrote to memory of 5684	3480	msedgewebview2.exe	119
PID 3480 wrote to memory of 5684	3480	msedgewebview2.exe	119
PID 3480 wrote to memory of 5772	3480	msedgewebview2.exe	120
PID 3480 wrote to memory of 5772	3480	msedgewebview2.exe	120
PID 3480 wrote to memory of 5772	3480	msedgewebview2.exe	120
PID 3480 wrote to memory of 2992	3480	msedgewebview2.exe	121
PID 3480 wrote to memory of 2992	3480	msedgewebview2.exe	121
PID 3480 wrote to memory of 4452	3480	msedgewebview2.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Eon_Launcher_1.3.5_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4432

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C8B6A14CD4EFBF98E49B388D32464834 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1164
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3BCB95F7869D38441D8E21C150D6AE80
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:516

C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe
"C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --noerrdialogs --lang=en-US --mojo-named-platform-channel-pipe=4664.3960.16306899311814222745
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x118,0x188,0x7ffc288eb078,0x7ffc288eb084,0x7ffc288eb090
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1748,i,12296022594176266146,5085376095573346910,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=1704,i,12296022594176266146,5085376095573346910,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=2404,i,12296022594176266146,5085376095573346910,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3676,i,12296022594176266146,5085376095573346910,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4464,i,12296022594176266146,5085376095573346910,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4956,i,12296022594176266146,5085376095573346910,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=3760,i,12296022594176266146,5085376095573346910,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=4628,i,12296022594176266146,5085376095573346910,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    - Modifies registry class
    PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5884ad.rbs

Path C:\Config.Msi\e5884ad.rbs
Size 66KB
SHA256 e0b6db68adb7005423ac4c925c1ee9fb5c5b154b5282df2f1413567a1fa53311
MD5 45121de93e8cf28f5571138187075e1d
SHA1 082035cc58f2c8fa10963eff910bbdc12e62aed5
SHA512 7b765764fec6fa3b50ac76bbd6320f2a8141d718c3caa5f955d9e099a1609393551b72365561145f48ec4228c11174613a4856d29c42fb37a04b1ec704c7da4b
SSDEEP 1536:yQCSCQBcLffxSq6GLg5xemtYggG4C+0XyvRL4tyJ3+kJZiH0A6Vy2ozqA9nGTowS:7+Y
TLSH
T1C663DE1020CD9586CBA1F3631B78E16ED66CDE497F40FB184E6ADE3AB62DC5C9CA1443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI40FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI40FC.tmp
Size 1005KB
SHA256 7b3a4e3e3f58fa49164d49b14bc10c13a9d734846956c8a7a433c8bb6c82d983
MD5 0606e1a2fe0d72593405cafeb945c740
SHA1 641e8cfea8d2203d3127b49939b1ed5f1c97dc9e
SHA512 696152be48a1256c5eda545b8759671117a7b55e49723b437b6ee258a3b568b9440f1592e4abf4eb1aa878e960cc721bdbc55f2a48d77bb1b3315b75cc15946a
SSDEEP 24576:uADREF4f3fy4UpBxQnWh0lhSMXlI5G17n:uADREFClUDxuj45G17n
TLSH
T138257D203A89C436E56D05B3193D9B6BA13E797A0B7154CB93D8BE5A2DB00C2533DF93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

CommunityToolkit.Labs.WinUI.SettingsControls.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CommunityToolkit.Labs.WinUI.SettingsControls.dll
Size 67KB
SHA256 ac16e1516f02c97bb66d244f34a0374cd148b584dea70ca1c918ccdcd6210262
MD5 8b4fca108cabf561961da9a36cc32362
SHA1 ecfd2377bc35985e5887bdc568000e16f5714434
SHA512 ed744a4e57a8184afe4774ed8b582423ae71e3e13452d5dc89a8751b9f824eaa5a19d59a9a3b5099f40eb962ce6ec632a493afb6ee4ee9372d6df4e4f3e93e9c
SSDEEP 768:AaJwJSxe+jCDasjXwJYhfj1C9EcjmqWjrOffKu:TJwJgkasjHh4CcjmqQrOffKu
TLSH
T19F63A53433F86328E2FF0FB6A4B059154EB6FE96E812CB1D8905005E45A7B8316B1F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.WinUI.UI.Controls.Core.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CommunityToolkit.WinUI.UI.Controls.Core.dll
Size 247KB
SHA256 ff2fe35249a9bd995914634241051fe77a598e058720300027e5744a6c648613
MD5 80bee57b21236dace87875cdd1a65d4a
SHA1 0a05ff344a9a4ee301a41a9d59fe0dc0b70ba3d7
SHA512 f9931260d8bd49ae3fb0f1c6568a084865db9a837a2176cfe7d013712d66e49e711ccebf8ceea4d179c6d7f1ffe24dadd7bc3d687f6615ed3e81f74a246f5ffb
SSDEEP 6144:LbmQIsOPG+oDfpWiKEEMwsEkuaFYUULTjGNnfP:XmNnAEMEXaFYUULTjGNnH
TLSH
T16834D66033F84329E3FFAF36B4A9541005B6FAA3ED96CB4D521210DD04E2B42E661B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.WinUI.UI.Controls.Primitives.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CommunityToolkit.WinUI.UI.Controls.Primitives.dll
Size 65KB
SHA256 6be7263b5e8261fe70855c948db46b9994d11d4284ccb8c1e9a67eb6e507b87d
MD5 0019394a334fdda9333cd9be486cc5f2
SHA1 b4f0e6695c151e1ad29f96c9fbc286b590b2b1aa
SHA512 8d794491843cc2a6589c71191f5d6c23351c70d2d4aa749d8d40714081d75bbf59987deb431948ff2686cb9d99d215a134d58e6df2494dc75e683435cbc9059d
SSDEEP 1536:4spF0IwOBYWykHd281DTkRzDM6EvBpebLLWuMJ8uDoCyx+kMgpnM+5Xzo:4spF0IwO+WhHdD1DTkRz41UDWuDu1sNu
TLSH
T111635D6513B4862BDAFF1A39F4A0152807B1E543BE31D3C9AFC990EA4E8778105A47F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.WinUI.UI.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CommunityToolkit.WinUI.UI.dll
Size 179KB
SHA256 7681211efdda49b17263044708800d5fa4d5499a73bdee2d0c5a21183ee2a484
MD5 274445448258b4b076e8eced16e13210
SHA1 c8b7c3c0968e264a31c0cabe3383bb8e6b0a3d59
SHA512 49badbb3db60fff4778241b200b589da857cc2f49d76978afbcf58919bc8f31781a9e17c4c98aa355f74024fa66d87f93743ff26b4f71da5c93786f560c97523
SSDEEP 3072:KrO2e2BEZgE7f9gSRKwFw9DV84wjG4RrR7+wOs7/OqU:Ky+EJT9ZKuwjUEjl
TLSH
T142046C5113AC8A2AC7FF1779F2B441508B72E243D1B3DBDE5988A9FC09833825D563A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.WinUI.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CommunityToolkit.WinUI.dll
Size 115KB
SHA256 337c94f9d2b14cda497cea04c5b5b0bab44786862765af8f628d14eb380a2bcd
MD5 a02e51464ace847e9d2ae1a32e7c6464
SHA1 4dfaad702fd9ddd585c7322375b72fd78a5da119
SHA512 865d32868cf3d6fc8c7607daa55d6f0db6b185491fc0e46e4ac3995ea159b7b4c1e7ec9b89da694732440c6eb807d50f3233adbe1c66c8e69bcc3d35d99d5919
SSDEEP 1536:kWf0RjWwXIgKvzKQZ5ishveb9h6LV7HcvN1IzSTwi9Dh4zel00PXkfnHImgaeJqo:kW5v5phvehOIvzIzSn9dDMfn0ae6jg
TLSH
T112C37C25C3688E13CEEF97BD706052528733A34EF416FB8E588CA5E934577A06D423A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreMessagingXP.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CoreMessagingXP.dll
Size 1018KB
SHA256 99390cf8c5a02c63c7f540a882830432fa9ca470b886e1f9c88c9d91556e9bc9
MD5 7d786522234e6d35b656034625749262
SHA1 ff14c1cf175b01839ddbb2ef6a9289221ae2181b
SHA512 722dd77a8b33db71239bdfdd6425deccbf3cda1ec75ce045b1f0ce7528c84bf0a9f4f02ddb7d664f68f83d69833bbf04a0dca96eac6f23929c8194fc43279607
SSDEEP 12288:YkPHWUyciZyULptTGX7GSnXRGfcJYejJw4TINlWVcW7TL0I:YmHWxcvUL67GSecD5StQLJ
TLSH
T17D252B6F6FE88497D16AC27E86BB8A4AF2F1B852173147CF0451422D3F27BE49979310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eon.deps.json

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.deps.json
Size 30KB
SHA256 4c6648821d35a6b26b7728e88cf042c0db13ef0903afd74f6fbd406000fcb1b4
MD5 adf88eb7ddf104bab2794228e5579d37
SHA1 0e72a6d51886bc8428a55b8624ce74bcba32c1ef
SHA512 5be5673f08c15e93e971349f102916f5298e1877241c4ecc6e51b1972e82a346d1e4e3ca18848f07bb907595edfc54b88a69c3781ddefc82ec50dbf6f24a4306
SSDEEP 192:YLMKVyXdx1d9fpZDUDi5UhI5QB+l2/swhVubVcLfMkq4Ip8CULjYOgn5YAlLh0:YIKSx1d9noi5UhI5QBAPyyVAoRGYV5tm
TLSH
T141E2AA11D4604DA348B167A52D3F4A86FA55136FA0005A8F74FC206DEF37EABB252F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eon.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.dll
Size 507KB
SHA256 b0f666ffab61b278bd8f988e9ba2a9f0d9fcd7330560fe651ddd741ae4938403
MD5 155770df6f47e731cab006cb1c03b334
SHA1 5a59dc1c486804252cbfb5c383a3d3b7c1f3d177
SHA512 3ff0b888a3b29e00e53810b223056ef6d5df2ff7c1b3f639a13e90e98f7d0a834ad0461c8f6f44c868475a4bf7a9070fcdb56ed9de6acc7edc3c5662979468cc
SSDEEP 6144:lOYYmzzv7XU0ZVMabbqJh4gY5OS2E9CkFaqw/x8eJNuo9EnfvtY99Rwmc:LYmnpVMa6Jh7nj5x8eJNuOovgRwmc
TLSH
T10DB42C0063D975BDEAE78E35F4647B420E6FB19BE804CB7D6812DC8F8A5A3D15801B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eon.exe

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe
Size 424KB
SHA256 3dcd5ccc7faae84e8fbc63f71ef6ba040d87e6ad62e8064821692f286bbc839f
MD5 a55b3114a11e3d46f36448f5e342b6af
SHA1 3249f39bf6c1824c0f33450973c94951673273ec
SHA512 d409ed390e93008c46962909edb6b3036f3d1171a7982e2b7a3158788b801b6c4fb5fc0dbb9217f969d256117a9f5142b0e692793d5223ef1a7164723edd18c0
SSDEEP 6144:pBKjK2LFzZNfIULMyCkFaqw/x8eJNuo9Enfv3Y99Rwmc:pMjnNfYj5x8eJNuOoviRwmc
TLSH
T15D94F702629635FCE993C935E4687B425E6F309BDB08CFEB6992EC5FCF1A1D11C1160A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9c34e28942a6b2d0f9021a5c9906be331803431a4e4499e98bc78f61853d20e6
MD5 e0fdb3fefef93415342d118b14454bf3
SHA1 f2d913dbf3ac9ebaa38b21ed977b441d847b5625
SHA512 c007e96596fedf8b38690e73a617bb1620f48269e3ff9ebd93938cbdfc3cc503e3793728395f0cbe477b14379ea7b2280e34ecb48ffd4b33a88c2b8b70909f2f
TLSH
T1F8D01123320202B8C020203300A2A2882A00E20B80AE8008A82A8EAE2F8C8A00E02882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ea7b52624191d238a7a58801bd02f01a4e9eb74e0bed7c89d0414f2b551f55de
MD5 57537864312cc40dd6851e2d6d718bd9
SHA1 13c8244306be0daa8947ca6748b2f4f86cbaa656
SHA512 28018a6443c7b0804f05a48aacf3fffd8571af2df6b4687405b3657294acef973ffd5045bd4c18db53e874ce1c298cd00260c09c62aad2467d79799a9e930ba7
TLSH
T1C8D02B77350145F0C40010330081B4493740F307804E40490C3BCF6D6F4CC700C07C62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 bc9e5c5902aaf070326cc20b4f768fa77cff0c87963dca009f95d301cf0af229
MD5 5910a44df59eab1245ea524ec799dad7
SHA1 95a1d7a1f344fb0d886e880afb8668b703598692
SHA512 e6937db0adf58679b93d2cb3e25f671c21d7e5908e4c94191c33a2fc7c14cf34de9bdacd1c34c4a9d82dd2eb85ae4a35b2e61cdd7b21aa3cd8824470b0929210
TLSH
T110312D2D1A0A24CACF4A6AB4CCE8E4707B316420269B9C394C345178C8EBF8DC2D64DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596623.TMP

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe596623.TMP
Size 48B
SHA256 077b199e3529fd9bfc9a2cb7b3b2144ded4bd8f4c756eb9c094fe36ffc8e2d37
MD5 9a2f7a7b1255f0055f41704741482b11
SHA1 b40cb605c76b06892c54e35d482c9a65dc25f816
SHA512 99e7eb2340bbe8bce8272bece010012cc9a7f8480d702c92a34f23415940aeda3f0479ecdec87dfb8450df03ad6efa23ad99a94ff6aa585e8bc61db6fdf75449
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 551B
SHA256 00c41037f9534359c9ed5ee231320b7dacf6a9929dce1306b02dfae3e05a16ea
MD5 5e1ed3a006acb6d9c49192b59695de2b
SHA1 66d2d7c144e4e51949111d625ceb4cdd8a77d540
SHA512 b15c733b404c1daaed6efc1ff91bd1ff75ce2b9fdd080564cc120dcf8ad06cb84888448238b319fb7440ce83424c15d44504609faaef12058940e6a559faa4a6
TLSH
T14BF0C0B3C7D8426DCA5503F42A243917CA3E0C4403183C3ED4D5AB9F93D1165F20088F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59380e.TMP

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe59380e.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 55f1abb078d335bcdd84609f7716e894f76ffc54e13b3cb0c7ccad4a6b86f2ed
MD5 a8063304f25cb073432e2869e9b1f874
SHA1 1a62496bc8d302cfdb84c5ffdbe15aaef846dcd4
SHA512 16f82b9a85085022743a92d136fd5e1410cf22af2254a6f0a27eed18f9b2b3628a5f4428721b1aa1b11aa9d318f53fa2150039e1a77968a7675849dd185600b8
TLSH
T153F059A740BAA973502C5E2A2D483C015B76F231225164F9CEF286AEB0801F3470B922
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5930ca.TMP

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Network\TransportSecurity~RFe5930ca.TMP
Size 356B
SHA256 189ba19f9f3e0521a63ff95d76ddc1093b5ef67ad9737c993087689a17a04ccd
MD5 0abcdef79d7d8631753e59560af0937c
SHA1 af183853760ae8bb440fcd1a878c50be148abb94
SHA512 4f7be3f753bb4cd03f83fa6111c389ea8399e27a7fc99f0da367497b0cd4cd34aba478069e506aff1684a0986cda7f1df19be3f6912ca5fbe65f60e59bb8d2be
TLSH
T10CE026E751BBA637103C4E7A1A8C7D015B36B131225068E5DEE2866EB0801F75B0B922
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 b814fe21481f4decfa3a2541d8a4516d10a38b111ebf4edc4410c9b618ddab5e
MD5 d9341868a7a394d260b17aee25daf87e
SHA1 d35f3b09288c3b376da9e73544879dd30b6735ff
SHA512 44d4a55a896465ecfed7f20f1637fa622334fd0d5c98c27c646f527d9ec1b9990aa9633fcc107e594a4f02791abe58bfce0a03ea81b3d2af9d00bdf99a6b87e0
SSDEEP 96:stg05ZjmV4b9saffGZ8i0vhE/k7Km/7qx+WVHMSm+uecadQjme+gf2+yMyB:stg0XjsafuZ8pa+H/S+Wi8dGhuMO
TLSH
T1B4D1A9035F68697B4CCBE65DB935BB53E2FA602262D40E54EBFC861C08D65CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 64ffa965103c111ccb0485b16286aca375b212d18355dcfda66a0c9e78f56774
MD5 c3f2c34ea9b57b4072dc2e8ba1c331c3
SHA1 b95ae6f7d489a97179cf7aa82a3601351b519d79
SHA512 a6682c01289205130909022f24481c0142e935255572f82307a2a54eb9a34c72acfcc376a4062920be4252c64d6cfed9afc35fd61008078d031b6c54292470a2
SSDEEP 96:stg05IHmV4b9sJffGZ8i0vhE/k7Km/7qx+WVHMSm+uecadQjme+gI47c2+yKAB:stg0KHsJfuZ8pa+H/S+Wi8dGCuKQ
TLSH
T16BE1B8036F6869774CC7F65DB935BB52E2FA602262D40E94ABFC871C05E66CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 dd43d863231b7167145e37c038410592caa38f6a4a392a6b3a930056e5b9e96c
MD5 094d852fd1bf30d45fa3088fbe15a4f7
SHA1 cbda44e67cfe636887774f69d65b6903d0e9dbad
SHA512 1a63d71c60b9dd667f8347bab16d5aae0153d81b2930a8a2d1d14170aec5ac070a1e630e6914ae29145666f706f5a94ebc89b98ed7fa116f7399bf5f8042cc82
SSDEEP 96:stg05ZjmV4b9sJffGZ8i0vhE/k7Km/7qx+WVHMSm+uecadQjme+gZ52+yMAB:stg0XjsJfuZ8pa+H/S+Wi8dGluMQ
TLSH
T1EFE196035F6869774CCBE65DB935BB52E2FA602262D50E54ABFC871C05E66CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe593167.TMP

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Preferences~RFe593167.TMP
Size 6KB
SHA256 9aa4330872f0a889ef4adc6d1d49b3d6e8687edec9d8681064d9b5d02c35f7c8
MD5 d78b468e5ae9dfb6195b33ad9b9c0a07
SHA1 7b7e61a8ec0bad9ac330102420c9f621484b3560
SHA512 ae34aaceee0b9787dd231bb6d747eeb89b8f91d5d06a6c3a89eea5535f38b76035242c8e00e72122879c200d1a4e63ef4c5380f9a94c9c828bf5ba45f3594c4d
SSDEEP 96:stg05EB7V4b9saff2Z8i0vhE/klm/7qx+WVHMSm+uecadQjme+gZ2PMEB:stg0OBtaf+Z8paV/S+Wi8dGfwM8
TLSH
T184D1A7035F6869774CC7F25DBA35BB12D2FA602266D40E98EBFD861C09D65CC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\0cb0d2ad-7aee-41a7-b06e-ffeeb30960a5\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 177B
SHA256 20cd522b0fb848923ecbc6e210c76faebfd042ce6be5f9c41bc12aadb6b36332
MD5 5695b65c89f7ffebb8b9a6db365c2f47
SHA1 6f6417b7b6d53fec1eb5f833ec4bc1c7a3a6dfa4
SHA512 385af4c43910cab8fd256fda926ed4a02400dd8c11c4744be94caea8ce765e9b6aea16a5ef64a8937676d1160e43c11ce451ee681926b9442fc05afcf7dadca2
TLSH
T14BC022DF80200820274A028306A2908F83100CC80689B08452032087C434A22B223CEA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 170B
SHA256 639a3944cbdaf2791afb39f2d391a1d15de541e19f7aa0aa985b446b4413e29b
MD5 ff7d55016ba136fcbff68f668e35673f
SHA1 1826175c7ec581c662d7704c45b646a7b2c14ebb
SHA512 af2394b7096d791a1a6c7a0e8f71dd2006e660c6a97488cb73c92471cd43e48943821371ef57bb084ebb9c41708c2434f6195aebd904192d7a4262ef28da6890
TLSH
T190C012DF94154860165E07960692909F871514C96699B09552434587C405A327123CAA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe591831.TMP

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe591831.TMP
Size 114B
SHA256 3569658dd35102a94c94df78d0d265c1de3184476c3769d7da482d750e8d3c39
MD5 90c58f093f1be2e4a3c58328dd70b789
SHA1 11d499e85027b76d73001e5a120ac6e39ce3acf0
SHA512 a55f5ac50add0a45920cd578f5d5c95b1c80487b55e4f3745d269430807a29b71824d16b2345c157f8a0bc7e7b68369c7620adc9d8e53340a569a7f7b4bfb686
TLSH
T1E4B092AB94690D202B1906A287A3E0DF834A0CC8489AA495614738C76438F233202DE6
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Local State
Size 17KB
SHA256 7981871e54b51080c6017e0487ab4ffcf611e2d55a4c5a63ab9f88d77dd2b3a5
MD5 dc320faf28269bc7a41f3c306d7418d9
SHA1 bf82222e4187bde074066645eb7c226fd6daa305
SHA512 e3e77f1394a7ff26fe0a6146f6b6e08ed46362bf4a5497bafb98b81d29aea2e2e2510ca7d53fe7fe1ee4b7316cf09ac8c1acb05d541c2ac240c96da9393274fe
SSDEEP 384:zzNOjae3af7pOMe4tyUOh8iqLyWpMmG43NbJ7IMooiAwyTF:gjaeqD4MlshiLdMmBXMIiAwyh
TLSH
T12882AE7A98B4AA778C738585BA477A576A70029A82C57FDCDCD81F4E02D71CE1307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 eb197ea966e6026983f41c94ec0e36658567488bd9bbb0fda4647b74b7ad34df
MD5 d33b06fedf0a8dd8e56b780fb5573795
SHA1 84705b44398a92c1182296a1673086ef0b457580
SHA512 cf8190054d2576da33271e98d10acbcd71e41531163bd3462ae0b71077843913850cb66abb29db79b9db886de6fe81043e20d9cddd997271388c6886db47ace2
TLSH
T1A151987378989B374DE35A48B9493B235A3161A7B7522F54A5DE0F0C01EBA9C2302C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 0250d20d6cf9d6e5560140697f4311a656c9131bff61fc744d9b70cbf4dad89c
MD5 12d869ed6901b59f62fc77199731bf76
SHA1 fd57d58b65b839c192236df4a8c8c8ea9fe204f5
SHA512 fee36380d9346c6b65160d2974a74cfe28f7505d8db53b22db0efc03b1d0779ffd6f243a976e5c746d79d8e571e4e1dec185d4e8cefc667da14213e67c7ac617
SSDEEP 384:zzkOjae3af7pOMe4tyUOh8iqLyWpMmGrNbWSjeFYwyTF:vjaeqD4MlshiLdMmPIqYwyh
TLSH
T13972A06E59B85E774D339849BA8A7A171A3041EAD2917FEDDCD91F0E02DB1CA1202C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 91585cd67a96c3cca1fdcb639c40ed71fc44b7909327da8f2f416255a770c2bb
MD5 541ff899f93222892d6dafa70fe8f861
SHA1 95254b62108c27e91eae9cf2cc77fc05f0311979
SHA512 495bd155f28ed122e98e9a60eb0ce34933c78e2eeab51811949ade4d54303affdea4ff476ea7786d4c70b205aa801b7022ede792e38a77e5225132eeb0c6c676
TLSH
T154318573E0E46B331D916A85B5867A632E212167B3118F48B1DF4B0812F7ACC6916C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 5079d91d049510a289f969b25c07778dbf61798d3a203314238978258faec635
MD5 055329c529a4d27c638a5b087f766ebc
SHA1 d284ed9f2cfea23ffe99e0bc9016e9ea75985871
SHA512 dbd0ba847451398d1a4f5b20301e9fa2d0590168cae124c20e28f52e67bce22eab4f3568e2f6240b0c68ae33adff042486a353e3934e83d4c9869e081f29d5ae
TLSH
T15E71963765A4EA374DE29E44B8852B2376615127F6953F98D5EE0F0C01EB7D82302C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58c4d2.TMP

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Local State~RFe58c4d2.TMP
Size 1KB
SHA256 6171683234ddc11b6dbfce174d5cadba5fe47032fedc7cd60ad0d960366ff04c
MD5 a2d5beceffab6369aa5d0c9b9c058472
SHA1 65b46179f69f5f3f70cac01729ebe70c5fa05033
SHA512 7657fcb440140423241c478f6b468db6c1e032bf0ae253f819eee6dc2388340e79911625924997857cd190ee07bb52e5ad3d29d66559145fb53e873588ec158a
TLSH
T156218737E0E8AA335D915984B582B6572E2165A773148F0CB0DF470813F79DC6A23C72
MD5 SHA1 SHA512 TLSH

Submit Download

Eon.pri

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.pri
Size 2.0MB
SHA256 020194c93158c645c17483b833c8011b48f587224999f0818aedeb5e68849775
MD5 be27b37b2e2d50576dc003d5c32130c9
SHA1 50c47786de1c96dccdc19fc69a541d5d25a70fdc
SHA512 3934eb11e1a6e42c692fd20ee0125a6f8507a45c83cb341ba702da3e56ac6f77ce2a2ac43945eb419a3327bae0b018456aa68c873e28d19d140406df7f40f531
SSDEEP 24576:QkNQBc/a8/6GfavOkNQBc/aL/6Gfajsc9eFCp4VOL:Q5q/6GfaW5R/6GfaeCp4oL
TLSH
T141A51D01E3FB0108F6F76BB1AEBA4B2518B7BE666931C07F1144174E2E71B855AE4723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eon.runtimeconfig.json

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.runtimeconfig.json
Size 340B
SHA256 feeff745ba1e8cc27d50546cffb499788e3ce8aafded81cc789fb4f39900128a
MD5 8c88cf0c6f912ba8598fca08650f74b9
SHA1 9046c66f681ab25b0973d9416207effc378370c6
SHA512 0cb08857803f582c50bc531af56ac9fd372c6edeaeca920540169c54a6fd6017d702268817da7397cecee0075629049d3791d004732909d38dc05c82c949ebbe
TLSH
T122E02665CE006CA701FA727BC531C183EB30632700101891B4FC080C2F7BAB50112F56
MD5 SHA1 SHA512 TLSH

Submit Download

MRM.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\MRM.dll
Size 298KB
SHA256 10070cc02a778d8ae04a82e3592aec3304107b92b1b07f5ed1c5745fab950051
MD5 2a6e03215376f77b7f9ada8b5fb470e8
SHA1 3d7f3ee73057885002bf8f8512ab6bd8e8e7d047
SHA512 722eb74a204fe22c3c0d25a24f99626c0658b21d07fe783ccf66d06b4ca2484bdd58c717939dbb893c25979aff13012a7c88aa0d227d7f1d471a820a86ef7ca1
SSDEEP 6144:yA0sC5hebJ9hHX7dWOHeumBR+9FSsKx+ZbUVbYG7QGille+Wz:yQC7ebJnXJ7+umBRyO8GTPie5
TLSH
T197545A2B63D814E6E17AA23CC5974A4AE7F2740113619BCB07B1414E7F1BBE89E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.InteractiveExperiences.Projection.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.InteractiveExperiences.Projection.dll
Size 1.7MB
SHA256 bdec197bb97d9836cba83487195f4795927ab1bf351374c4911725e45a7c51ce
MD5 f9262627c19815f0551e432c4cfb3b51
SHA1 2e68989684bcbbc43df52616d61341f6275221cf
SHA512 81946a89d86ed015429eec6dac4966759e62c1da34629eab8937612adf2b2d3ab39692d924cb062ebf3b1dbdce2f2b31bafa68291da3dcb6091a6fbe8d2c71f3
SSDEEP 12288:UNksUaU+1zdNeKalyWBN5WQWbn6PN27UbYesxeKMrNB09f:UNKEvoyWBN0Qengb2lZ
TLSH
T12E853915773CEE3ECA8F1BB6E29252146239E78B7347E346104DA6790FA37810F445EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Internal.FrameworkUdk.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.Internal.FrameworkUdk.dll
Size 997KB
SHA256 9241e0dfdc4d7f843dc1ed362d115aa964b51fc13ede292c20e32e668b4d67d3
MD5 e0879017e7ee3c6b587e2a85be0e893d
SHA1 7206ed84b90c4d8c8e29746bbc13b5ca2789a20b
SHA512 fe5d58311237e67d0cf565080067bf3e06c6c870cfe436d50d7594be844b09a6543005908601fe3918367d7cd7e58a95244df0b7b5fe75062c1a91c9a5c33a7b
SSDEEP 12288:5C8jIUBYbf81sQQPo1x2FcfoGJtPeumaNICB:A8jIUB2f81s61so8ulBB
TLSH
T19F25961FAE7951E0C4B9C0389596622FF8F130E68B3457C3E6919A1B6B32FE4A53D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.Core.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.UI.Windowing.Core.dll
Size 530KB
SHA256 c150e900207cfe5a979b67236eb5aacd3c9412f51e5b31fba68802c6f2bd2a86
MD5 6cc5412c486487ee96a24d2d83436e11
SHA1 4448f20fdee172f8088722f6816bbcf6f5cd8acc
SHA512 b9e9ba2f30b2fadfcf05f183d8b03ce1f4fe22e2fbaffc989e1b0693651398e63e0939469065d1fac9b5493758c4e83b81fa389409c36efb0931621f7cd00038
SSDEEP 6144:8+6A4LtjFUUwb0efDm7GZL+n82dzzyUX78nAknywHpNqzoCWu8+6H:56RLt5bWFL+nfdzzytnAkyw7EoCWuCH
TLSH
T108B44D6F6BE84496E22A913D85978B0AF6F174125732CBCB0121D13E6F27BE85D7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Xaml.Controls.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.UI.Xaml.Controls.dll
Size 6.4MB
SHA256 2d05531c93c4b16d3673cafcf8daf3330c6ec5962e1c6d3db3110b730ed6903d
MD5 08b47709cb49b6ec8c83c53d4b283c60
SHA1 2d4c2ea0952a939e6637630b1ca3e9107339bec7
SHA512 6c067ef65e1b945292857dec320a3681ea227eef76175da6b6f01423e679a245111fe134fe5bbfe6924f553d03771954843619e13c050542215c634aab48b072
SSDEEP 196608:/A8CTjD5fxWXQSzCRRe5Ds2auhze6mKZZ+GDFHOahWJ4Q92k+ZTTr8F1uSmafRy:/A8CTjD5fxMQSzCRRe5Ds2auhze6mKZR
TLSH
T109665A5AA6BD02E4D0F8E97C96A3880BF5F2386A8731EADF0135415E4F1B7F1463E611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Xaml.Phone.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.UI.Xaml.Phone.dll
Size 1.0MB
SHA256 8af7cac4aa9398b9dd726a639bda0e4609dfa3c9e4118adeade66be38c9c403b
MD5 f41874fa3cf245e80bdb277016c8c3a7
SHA1 37e0732c6d1f34950579de1d56432e25c6f4810a
SHA512 69164d5c1483b0928114a77010703565466f202b35f75e999124c3aabe6346cbf7fed2a7ea917a844eb8cd60a9c297e6cd2f8b3a52040a0c71aa818cf18a725c
SSDEEP 24576:4jPVVgQ8RBq4FJeTLSmLM9BnnT90ZXoU:4Bsu4F9J0Z
TLSH
T14A35F80716EE0992C5BC663CA563594EFAB1B8422773B6CB0294025D4F3FBD19B3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Xaml.Resources.19H1.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.UI.Xaml.Resources.19H1.dll
Size 553KB
SHA256 b00cc68ba9fbdef4e6ac47935dedca893bb291f7ac2d88fc8dd0fb830c90c934
MD5 1293316c940de42780c1cee128b8aa45
SHA1 df3ebf54dc3e8bf734737222588d72503567bbe4
SHA512 5da465d1a4d8ef321e9204064b63d97deacd9754b26f9e28f4d4a30608dc254fce1afb79c00d099d279ed42b9f91bc55a051cee4854f8098b456a6b8f9ef7569
SSDEEP 6144:R33u9Ra+DIY8EGc0aeGPh46AdtUJyDJAg0ZCzstVskouv:R3ufIY8EUdAzVskz
TLSH
T18AC40C01E7FB1648F2F76AB06FFA496418B3BE536E31C07F40141A4E0A72F859A95763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Xaml.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.UI.Xaml.dll
Size 14.4MB
SHA256 6b92fff94551e5e2d4c40079ecb42abb315c7e4ccc5c6c246fffe723dcbd758f
MD5 5a872570af1c38d5e37d20a926dc56af
SHA1 8c7f4c69d2f2ad93c8a4c0bc6f3d637779e3c18c
SHA512 83f4645b364ee3b02ed9a230dbd80cad461710d5d4492af2163beeb142659d774752cd1116f7044841b84e7cd65479ebb96b44db0fabfa4f27917c535932adc8
SSDEEP 98304:OKKEHgHgXkfeCG4eP+UmDQXXqhJJjI8AgnGcvI1KgWtuEznxEiyyH:pHSg0feCGbGUmi6BI8j9I1Kg2uCCFyH
TLSH
T1CFE6284626ED4591D5B9A638962B738FEBF178211371A3CB0231015D8FBFBD28BBD211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Core.Projection.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.Web.WebView2.Core.Projection.dll
Size 652KB
SHA256 1468bb8e4233c6fef6667fd8a3fb214fcf4feff9a1f70fb4e338335dd87a5350
MD5 86680c697ba7e36c55add405e330cf77
SHA1 03d007a48983194fb0259f62d914c9029e2cb87a
SHA512 e53736d18fee03557f543b4c9ef9b45903cd10af73f9c3d637aa78f0b0bc520479cd522d60e939d717ce4197960d221f5a712436d4b6f47b58ad0b5c6986d7ef
SSDEEP 12288:0G+xOfDfrn+HvelBQLsnbgTM/tYUWdCZJLzoTMr99/DF2cbxSpWDSplq+1lqVaKN:z+grIeqyX7
TLSH
T1E5E4E72127AD872ACDCF6FFDE6A0829DB33EC24B719B67522D49A4A10F433506D085F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WinUI.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.WinUI.dll
Size 7.3MB
SHA256 667e51a0993459357d4d79cbd6f4a92ea57f4d17c88e44416076ff4505767439
MD5 bc67cb7c543b8a8f9a4f8692f2f1e001
SHA1 a012f40b1d65fa3e3563d2eda7f84b2603eb57ea
SHA512 466793fbc66b6efddd6316ba4b0eafc0083861a34601e124e303c30438b22cee00fe153727e07b34daed357b9836c5b58b44e1369b18ea7f185a3e9ec1d7fa91
SSDEEP 98304:3B8ofpumztYZ844bySCfMrUe/gRUjlnJFjqE9lnizJjqg:Mk4V
TLSH
T12E760802DBB8DF3BCE4E22BAE162523C8A24D6878353D7575409D8B72D63354374A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Windows.ApplicationModel.Resources.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.Windows.ApplicationModel.Resources.dll
Size 153KB
SHA256 fe7d05bb004898ac10adbd3ccb3a4386600b5190b2a0bab59d9111f2483b60fc
MD5 7d131b8f5190043cfb6d6012bcd80b1d
SHA1 6d8f39cdca59edc4440f881db891c247ec2f4d3d
SHA512 3df3b3a53e13575d942af44856a86deb0357b9c6367727de3b059f743eae50bd3cd3eae6f920c04d02a02502a54060230f5ba1c650969f594ba01579c071fbd7
SSDEEP 3072:gwpvv37QUU4TowW6s1mzSZJRXZNWn2KjcLIR4:gwFQCw6scSZ0rjcZ
TLSH
T19AE34B96B5BC40F5E97B957AC4A70A06FA72B0254321A3CF0235433D0F73BD5EA3A651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Windows.SDK.NET.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.Windows.SDK.NET.dll
Size 24.9MB
SHA256 b8d8ca8cea228f4c93d923f095e20660baaa8d5399bcb3c7863433a386df7adf
MD5 e72ed1c8f8236e6d68386d7be08d28d9
SHA1 e6047461a89bfd07f8583585ea5ae09785cd6e89
SHA512 d2a45f7d691dfae6495369615d744649f7c414066ea39c720f3df5a9871b9feb261f8b448f884d4a12974ef892396525aeb9eba1428cdcd869729845a4144855
SSDEEP 196608:+nZtrfkqJLQgVHQ+qNXkmS1rfqDrVpP0BeatVvLwt5:ofYgVHClkxf+r3mZo5
TLSH
T155474A026776CE3EDA6F13B6B6980F11C231DE89AB8BBF11445CC2A41CAB3551B495F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WindowsAppRuntime.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.WindowsAppRuntime.dll
Size 2.0MB
SHA256 ec567b500e44fe27da9ea40dffac6fa206d42896c0745948b23c13daedf7f1dd
MD5 341cb0116c34cd52f276a1dc1d64c4c3
SHA1 be19d55658dd361de3182c996d72be07992c69e1
SHA512 58b9f2b620a2ff44661a4bf18ce65dcf8a5d19992626bbd782a326ee5f48f729451ba70400493c7947b89669de21088ef7f87edee0a86a856c13297f4bf41fea
SSDEEP 49152:pGhEL4D+/QrTMthMzL3QEL6hMYQ/BefdrLsbzcRHcmEF9fIy46F7H8g2LmXGeOJ8:stMjEeMpG+V
TLSH
T133A53A42B1BC81D5D8BBE87AE2270902FB3370260335A7DB011643296E67BF3967F655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRT.Runtime.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\WinRT.Runtime.dll
Size 508KB
SHA256 1dc0dd3381e1e9432c96e6426469edac9acaf369a5c87343fcba778713791487
MD5 1fee0b1fe3a70677e15dd884b36af17d
SHA1 013d8cb3e877843f740dee343162db830380c8bc
SHA512 3e0540cf1dbb2e0836cd0761167ad1457f0ce45646248f49f6bb016bf65dbb1cef354eb63c23a1bc6ebba09f218e7f0ccb69944217eeaf71e070891fd37ddd8c
SSDEEP 12288:GeqzsFhcRq9FlwXYq8vH2NHav96iTtqJe:GFzsnjlwXJ8H2+
TLSH
T196B4288127FC9A1BD7FE17B8B43026048672FC53A196E76F268894B90F62741DE407F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinUIEx.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\WinUIEx.dll
Size 519KB
SHA256 25b22ce6d8a79e6517efefc7e7ad4ad898f2af7dddaec4738ec3172efd87d42c
MD5 7e97c6f6627e64529f70f374102fbd48
SHA1 4c31e1c68b3720bf5edc00ec48e1beee9ad0c779
SHA512 596cc52f275ff00ad02658cdc5e168b063fed00231c0932320fd8731d35e321663ddb1f1311533208d8aa2d8f9692cb2bbc1dcf7d7fcb1676c378290b2e5d2f7
SSDEEP 6144:Fbx55y51GT4XLTV9NIAhp2Oa+WwMAOCR06xiCpbbWjeyxv7eY81G+BBN28l:FbtyqMLTBLOC+6PbbW8ZLV
TLSH
T120B43A2A77E98F33EA5E2F36E0124205FA72D4406617F74D105493B09CA5FF1AC1AAF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcompi.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\dcompi.dll
Size 1.6MB
SHA256 c7314f35344808d78fdaa2ca53e1cada6c750570c80505177e4acdf13a8b9426
MD5 af04274019d569261530340afe6ea81b
SHA1 7c3febe614fcf051175039b5514bebd2ca204af6
SHA512 852d3cbc7172660eb7f65048cb0c44ee3223c81c450d4f858a9345f0c093480d0ef6d463a608c408195e059d2cb92e6188577b48d2ba984d4675967f4fa8ba51
SSDEEP 24576:TENXrsxFzN6CUlaiLTWC/jaUblEcPdUUKCaLGkIC7VfVJtEpHY/Sl5UMBS:T/atbaUblfPdUUKCQG1C7jJe9Y/SHM
TLSH
T136755C5A6ABC0099D6BAE178C9A7861ED3727C110F74D7CF012442AE9F37FE5483A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Xaml.dll.mui

Path C:\Users\Admin\Documents\Eon Launcher\Data\en-US\Microsoft.UI.Xaml.dll.mui
Size 25KB
SHA256 269aa55378f2b582f4b329d3661837413d10ca2f60f5cb68a33bdf87b9c61c97
MD5 95c14bec271e50b7faae7f41650f0604
SHA1 8eebbfc7aa9dcef266357f37d232a9781d390371
SHA512 4fd4b703abddfb39837d63aff58a5aeb3a582be9b393d739ddb2550e603504cc3b6eb36b274c2c8a9421213bc4ece90f2a0e890ef0a9c49b1c5b9f7da6eae495
SSDEEP 384:gWmLMouMtn73JA1F+zg2PEzXT7nHRN7OzxIPaR9z90h:iJ7n73M2PErOzxOW9zOh
TLSH
T1EBC25391A7FC0505F1FB6F746BB996516E3ABDA3AD34C61E0150A04E0CB2B81ED20777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

marshal.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\marshal.dll
Size 494KB
SHA256 efc12f8b8db772970e96a581cdda6e5e58b83802f1404b9961923729294b2850
MD5 41c89f4382ee7e45f35611d0d3dd8a83
SHA1 46439bacdfeb647dd54bb2e14d02cd6e69f2e912
SHA512 54e9a28e86d4d30ad1cd65e6ff3dbcf4b4a1ef7ae8b2e2cbb5021bf5b4814e09b7e8976b08a26d6086d7dd80b0fa178c805b0b6a1c6aa237008454c4d3433973
SSDEEP 6144:KFSpCRIb7zvKS03UP0V/KLzXq6pMuSEWRM6v/2ALcT7dfLA/7g:cSpCIb7j7J01Kf5euSEABPLcTZzA/0
TLSH
T179B4F48F696844A3C426423CC5678706DBB9BB9517D487CB037082ADDFDBBE42C3B625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 eeb76db9d58b73ad6c013294a89a27fe50d4920f8778d709937e29b26c76bb4d
MD5 b57e7f56a99642d025c4ac1b06f4110e
SHA1 4e6f7cab9398652c330da9b902e4382851683ada
SHA512 2147699c37b346c14780981d9ca45990cfb02f9cec6ed1426daf9574689dcadab22c1e4d25add431751babc2ae9e02779764741c79dfdb0abe02f2c8ef50a715
SSDEEP 24576:Eu8m+1zIdoO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:3
TLSH
T13647B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{58304e69-a2b0-4c74-920e-4a9517065e1b}_OnDiskSnapshotProp

Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{58304e69-a2b0-4c74-920e-4a9517065e1b}_OnDiskSnapshotProp
Size 6KB
SHA256 d4d7cfb41b3bf5f643afb6edee4041b48eab9ea66321a400f8973758852080e0
MD5 a327e80da757fbf693232ea6215199e0
SHA1 ee47befdb32cc84cace3bc3722c6979d59174f62
SHA512 3660549d67df9406eeae855f613dccf36bbb6f7b183785b35eca50ed86f0381c0652e01fc2623cfea27bcf59b3b28f01ca4ab069a4ed457a4387cd22b3e8b68b
SSDEEP 96:F+oJjGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:8YGPGnb++ZVmN
TLSH
T175D1990C5AE54711E2B3AB7129F18557A877B911EF33CB8E0198638E6670910F835F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-499-0x00007FFC4E770000-0x00007FFC4E771000-memory.dmp

Download

memory/700-500-0x00007FFC4D2B0000-0x00007FFC4D2B1000-memory.dmp

Download

memory/1452-495-0x00007FFC4EFA0000-0x00007FFC4EFA1000-memory.dmp

Download

memory/2168-588-0x00007FFC4EFA0000-0x00007FFC4EFA1000-memory.dmp

Download

memory/4664-435-0x00007FFC0C900000-0x00007FFC0C910000-memory.dmp

Download