9374f8a09d208c5bc30d27c20a5e9fa8a153eb083435e274427eecf9edffe5a1

Analysis

user interaction
yes
max time kernel
140s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Eon_Launcher_1.3.5_x64_en-US.msi
Size 56.0MB
Sample260816-n24vvsdb22
SHA256 9374f8a09d208c5bc30d27c20a5e9fa8a153eb083435e274427eecf9edffe5a1
MD5 ad71e0e769841999c0a2c9dbd1003cde
SHA1 8f61e718979084772a9ae9474986b3783bff145a
SHA512 d0a672fff01aacbd59816b2f88a5c5e6de480b61caa4e055f0f2bfea3268eabe04347e3890e5566b09e7a6b62426d59a3a6793236bddd7900bc8da0ebd05cf46
SSDEEP 1572864:M0nWVv/pr7DGcfRiV6NNFkI9vgBqUfh97MPe1y0+nw:/W/GGAiHZ9vgYa7G4
TLSH
T198D73320B587C426E25F47779A3DEF1E007A3E26373345D766F0758A28718C1E6B8A93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Eon.exe

Executes dropped EXE 1 IoCs

pid	Process
4356	Eon.exe

Loads dropped DLL 32 IoCs

pid	Process
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
876	MsiExec.exe
876	MsiExec.exe
876	MsiExec.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Eon.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
97	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2560_1207564687\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2560_1207564687\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2560_1207564687\manifest.fingerprint	msedgewebview2.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEACB.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e5aa.msi	msiexec.exe
File created	C:\Windows\Installer\e58e5a8.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6D2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE702.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A5A96A11-F791-48FB-80F7-93C5782AC1DE}	msiexec.exe
File opened for modification	C:\Windows\Installer\e58e5a8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE625.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2332	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Colors	Eon.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313549578846681"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11A69A5A197FBF84087F395C87A21CED\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\PackageCode = "D42F3BDDD48CAD44280481D352B9D573"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\PackageName = "Eon_Launcher_1.3.5_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11A69A5A197FBF84087F395C87A21CED	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\Version = "16973829"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9C0C197053899B44B931EBE364973904\11A69A5A197FBF84087F395C87A21CED	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\ProductName = "Eon Launcher"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9C0C197053899B44B931EBE364973904	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11A69A5A197FBF84087F395C87A21CED\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{C8E26CF2-9309-4C43-B02A-44BF5DACEE7E}	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3004	msiexec.exe
3004	msiexec.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe
4356	Eon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2560	msedgewebview2.exe
2560	msedgewebview2.exe
2560	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2332	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2332	msiexec.exe
Token: SeSecurityPrivilege	3004	msiexec.exe
Token: SeCreateTokenPrivilege	2332	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2332	msiexec.exe
Token: SeLockMemoryPrivilege	2332	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2332	msiexec.exe
Token: SeMachineAccountPrivilege	2332	msiexec.exe
Token: SeTcbPrivilege	2332	msiexec.exe
Token: SeSecurityPrivilege	2332	msiexec.exe
Token: SeTakeOwnershipPrivilege	2332	msiexec.exe
Token: SeLoadDriverPrivilege	2332	msiexec.exe
Token: SeSystemProfilePrivilege	2332	msiexec.exe
Token: SeSystemtimePrivilege	2332	msiexec.exe
Token: SeProfSingleProcessPrivilege	2332	msiexec.exe
Token: SeIncBasePriorityPrivilege	2332	msiexec.exe
Token: SeCreatePagefilePrivilege	2332	msiexec.exe
Token: SeCreatePermanentPrivilege	2332	msiexec.exe
Token: SeBackupPrivilege	2332	msiexec.exe
Token: SeRestorePrivilege	2332	msiexec.exe
Token: SeShutdownPrivilege	2332	msiexec.exe
Token: SeDebugPrivilege	2332	msiexec.exe
Token: SeAuditPrivilege	2332	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2332	msiexec.exe
Token: SeChangeNotifyPrivilege	2332	msiexec.exe
Token: SeRemoteShutdownPrivilege	2332	msiexec.exe
Token: SeUndockPrivilege	2332	msiexec.exe
Token: SeSyncAgentPrivilege	2332	msiexec.exe
Token: SeEnableDelegationPrivilege	2332	msiexec.exe
Token: SeManageVolumePrivilege	2332	msiexec.exe
Token: SeImpersonatePrivilege	2332	msiexec.exe
Token: SeCreateGlobalPrivilege	2332	msiexec.exe
Token: SeCreateTokenPrivilege	2332	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2332	msiexec.exe
Token: SeLockMemoryPrivilege	2332	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2332	msiexec.exe
Token: SeMachineAccountPrivilege	2332	msiexec.exe
Token: SeTcbPrivilege	2332	msiexec.exe
Token: SeSecurityPrivilege	2332	msiexec.exe
Token: SeTakeOwnershipPrivilege	2332	msiexec.exe
Token: SeLoadDriverPrivilege	2332	msiexec.exe
Token: SeSystemProfilePrivilege	2332	msiexec.exe
Token: SeSystemtimePrivilege	2332	msiexec.exe
Token: SeProfSingleProcessPrivilege	2332	msiexec.exe
Token: SeIncBasePriorityPrivilege	2332	msiexec.exe
Token: SeCreatePagefilePrivilege	2332	msiexec.exe
Token: SeCreatePermanentPrivilege	2332	msiexec.exe
Token: SeBackupPrivilege	2332	msiexec.exe
Token: SeRestorePrivilege	2332	msiexec.exe
Token: SeShutdownPrivilege	2332	msiexec.exe
Token: SeDebugPrivilege	2332	msiexec.exe
Token: SeAuditPrivilege	2332	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2332	msiexec.exe
Token: SeChangeNotifyPrivilege	2332	msiexec.exe
Token: SeRemoteShutdownPrivilege	2332	msiexec.exe
Token: SeUndockPrivilege	2332	msiexec.exe
Token: SeSyncAgentPrivilege	2332	msiexec.exe
Token: SeEnableDelegationPrivilege	2332	msiexec.exe
Token: SeManageVolumePrivilege	2332	msiexec.exe
Token: SeImpersonatePrivilege	2332	msiexec.exe
Token: SeCreateGlobalPrivilege	2332	msiexec.exe
Token: SeCreateTokenPrivilege	2332	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2332	msiexec.exe
Token: SeLockMemoryPrivilege	2332	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2332	msiexec.exe
2332	msiexec.exe
2560	msedgewebview2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4356	Eon.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2792	3004	msiexec.exe	90
PID 3004 wrote to memory of 4044	3004	msiexec.exe	95
PID 3004 wrote to memory of 876	3004	msiexec.exe	97
PID 4356 wrote to memory of 2560	4356	Eon.exe	103
PID 2560 wrote to memory of 900	2560	msedgewebview2.exe	104
PID 2560 wrote to memory of 3312	2560	msedgewebview2.exe	105
PID 2560 wrote to memory of 3312	2560	msedgewebview2.exe	105
PID 2560 wrote to memory of 3312	2560	msedgewebview2.exe	105
PID 2560 wrote to memory of 3172	2560	msedgewebview2.exe	106
PID 2560 wrote to memory of 676	2560	msedgewebview2.exe	107
PID 2560 wrote to memory of 676	2560	msedgewebview2.exe	107
PID 2560 wrote to memory of 4476	2560	msedgewebview2.exe	108
PID 2560 wrote to memory of 4476	2560	msedgewebview2.exe	108
PID 2560 wrote to memory of 4476	2560	msedgewebview2.exe	108
PID 2560 wrote to memory of 2924	2560	msedgewebview2.exe	122
PID 2560 wrote to memory of 2924	2560	msedgewebview2.exe	122
PID 2560 wrote to memory of 2924	2560	msedgewebview2.exe	122
PID 2560 wrote to memory of 2436	2560	msedgewebview2.exe	123
PID 2560 wrote to memory of 2436	2560	msedgewebview2.exe	123
PID 2560 wrote to memory of 2436	2560	msedgewebview2.exe	123
PID 2560 wrote to memory of 4156	2560	msedgewebview2.exe	124
PID 2560 wrote to memory of 4156	2560	msedgewebview2.exe	124
PID 2560 wrote to memory of 2208	2560	msedgewebview2.exe	125
PID 2560 wrote to memory of 5152	2560	msedgewebview2.exe	126
PID 2560 wrote to memory of 5152	2560	msedgewebview2.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Eon_Launcher_1.3.5_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2332

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2CE0B22607DE7587A98FD8B07B0C448C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2792
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4044
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F96185D65BFB6B861A83CA95464BA05F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:876

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4816

C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe
"C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --noerrdialogs --lang=en-US --mojo-named-platform-channel-pipe=4356.3772.15309359042523706280
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x18c,0x7ffe03d7b078,0x7ffe03d7b084,0x7ffe03d7b090
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1716,i,2600339696796680644,15799898590782126093,262144 --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:2
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=2084,i,2600339696796680644,15799898590782126093,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=2392,i,2600339696796680644,15799898590782126093,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
    3⤵
    PID:676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3672,i,2600339696796680644,15799898590782126093,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4764,i,2600339696796680644,15799898590782126093,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5128,i,2600339696796680644,15799898590782126093,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=4800,i,2600339696796680644,15799898590782126093,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=5100,i,2600339696796680644,15799898590782126093,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
    3⤵
    - Modifies registry class
    PID:2208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView" --webview-exe-name=Eon.exe --webview-exe-version=1.0.0+d9f91401b382bf0c4b017800b27af1c8a94e0714 --embedded-browser-webview=1 --always-read-main-dll --field-trial-handle=4912,i,2600339696796680644,15799898590782126093,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
    3⤵
    PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58e5a9.rbs

Path C:\Config.Msi\e58e5a9.rbs
Size 66KB
SHA256 70fc48db6b0e5fa45cb70bdfaeec30665e326543b10333cd042cdbf162d312cd
MD5 1d180d5d643e602dbcde1a71ea91956b
SHA1 e7b1e7cd13329d23db350539937fcef32a046631
SHA512 fd7fbbd9ab7665568771fe335f5c989523c865747d6ec9f6b6ddfe56f6e23c975cd7bf1fabedff113dc2ae309b5748aae1653ad60a6e0c0459a1f62016af8dab
SSDEEP 1536:kQCSCQBcLffxSq6GLg5xemtYggG4C+0XyvRL4tyJ3+kJZiH0A6Vy2ozqA9nGTowg:z+Y
TLSH
T19E63DF1020CD9586CBA1F3631B78E16ED66CDE497F40FB184E6ADE3AB62DC5C9CA1443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2560_1207564687\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2560_1207564687\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

MSI8D18.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8D18.tmp
Size 1005KB
SHA256 7b3a4e3e3f58fa49164d49b14bc10c13a9d734846956c8a7a433c8bb6c82d983
MD5 0606e1a2fe0d72593405cafeb945c740
SHA1 641e8cfea8d2203d3127b49939b1ed5f1c97dc9e
SHA512 696152be48a1256c5eda545b8759671117a7b55e49723b437b6ee258a3b568b9440f1592e4abf4eb1aa878e960cc721bdbc55f2a48d77bb1b3315b75cc15946a
SSDEEP 24576:uADREF4f3fy4UpBxQnWh0lhSMXlI5G17n:uADREFClUDxuj45G17n
TLSH
T138257D203A89C436E56D05B3193D9B6BA13E797A0B7154CB93D8BE5A2DB00C2533DF93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

CommunityToolkit.Labs.WinUI.SettingsControls.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CommunityToolkit.Labs.WinUI.SettingsControls.dll
Size 67KB
SHA256 ac16e1516f02c97bb66d244f34a0374cd148b584dea70ca1c918ccdcd6210262
MD5 8b4fca108cabf561961da9a36cc32362
SHA1 ecfd2377bc35985e5887bdc568000e16f5714434
SHA512 ed744a4e57a8184afe4774ed8b582423ae71e3e13452d5dc89a8751b9f824eaa5a19d59a9a3b5099f40eb962ce6ec632a493afb6ee4ee9372d6df4e4f3e93e9c
SSDEEP 768:AaJwJSxe+jCDasjXwJYhfj1C9EcjmqWjrOffKu:TJwJgkasjHh4CcjmqQrOffKu
TLSH
T19F63A53433F86328E2FF0FB6A4B059154EB6FE96E812CB1D8905005E45A7B8316B1F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.WinUI.UI.Controls.Core.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CommunityToolkit.WinUI.UI.Controls.Core.dll
Size 247KB
SHA256 ff2fe35249a9bd995914634241051fe77a598e058720300027e5744a6c648613
MD5 80bee57b21236dace87875cdd1a65d4a
SHA1 0a05ff344a9a4ee301a41a9d59fe0dc0b70ba3d7
SHA512 f9931260d8bd49ae3fb0f1c6568a084865db9a837a2176cfe7d013712d66e49e711ccebf8ceea4d179c6d7f1ffe24dadd7bc3d687f6615ed3e81f74a246f5ffb
SSDEEP 6144:LbmQIsOPG+oDfpWiKEEMwsEkuaFYUULTjGNnfP:XmNnAEMEXaFYUULTjGNnH
TLSH
T16834D66033F84329E3FFAF36B4A9541005B6FAA3ED96CB4D521210DD04E2B42E661B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.WinUI.UI.Controls.Primitives.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CommunityToolkit.WinUI.UI.Controls.Primitives.dll
Size 65KB
SHA256 6be7263b5e8261fe70855c948db46b9994d11d4284ccb8c1e9a67eb6e507b87d
MD5 0019394a334fdda9333cd9be486cc5f2
SHA1 b4f0e6695c151e1ad29f96c9fbc286b590b2b1aa
SHA512 8d794491843cc2a6589c71191f5d6c23351c70d2d4aa749d8d40714081d75bbf59987deb431948ff2686cb9d99d215a134d58e6df2494dc75e683435cbc9059d
SSDEEP 1536:4spF0IwOBYWykHd281DTkRzDM6EvBpebLLWuMJ8uDoCyx+kMgpnM+5Xzo:4spF0IwO+WhHdD1DTkRz41UDWuDu1sNu
TLSH
T111635D6513B4862BDAFF1A39F4A0152807B1E543BE31D3C9AFC990EA4E8778105A47F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.WinUI.UI.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CommunityToolkit.WinUI.UI.dll
Size 179KB
SHA256 7681211efdda49b17263044708800d5fa4d5499a73bdee2d0c5a21183ee2a484
MD5 274445448258b4b076e8eced16e13210
SHA1 c8b7c3c0968e264a31c0cabe3383bb8e6b0a3d59
SHA512 49badbb3db60fff4778241b200b589da857cc2f49d76978afbcf58919bc8f31781a9e17c4c98aa355f74024fa66d87f93743ff26b4f71da5c93786f560c97523
SSDEEP 3072:KrO2e2BEZgE7f9gSRKwFw9DV84wjG4RrR7+wOs7/OqU:Ky+EJT9ZKuwjUEjl
TLSH
T142046C5113AC8A2AC7FF1779F2B441508B72E243D1B3DBDE5988A9FC09833825D563A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.WinUI.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CommunityToolkit.WinUI.dll
Size 115KB
SHA256 337c94f9d2b14cda497cea04c5b5b0bab44786862765af8f628d14eb380a2bcd
MD5 a02e51464ace847e9d2ae1a32e7c6464
SHA1 4dfaad702fd9ddd585c7322375b72fd78a5da119
SHA512 865d32868cf3d6fc8c7607daa55d6f0db6b185491fc0e46e4ac3995ea159b7b4c1e7ec9b89da694732440c6eb807d50f3233adbe1c66c8e69bcc3d35d99d5919
SSDEEP 1536:kWf0RjWwXIgKvzKQZ5ishveb9h6LV7HcvN1IzSTwi9Dh4zel00PXkfnHImgaeJqo:kW5v5phvehOIvzIzSn9dDMfn0ae6jg
TLSH
T112C37C25C3688E13CEEF97BD706052528733A34EF416FB8E588CA5E934577A06D423A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreMessagingXP.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\CoreMessagingXP.dll
Size 1018KB
SHA256 99390cf8c5a02c63c7f540a882830432fa9ca470b886e1f9c88c9d91556e9bc9
MD5 7d786522234e6d35b656034625749262
SHA1 ff14c1cf175b01839ddbb2ef6a9289221ae2181b
SHA512 722dd77a8b33db71239bdfdd6425deccbf3cda1ec75ce045b1f0ce7528c84bf0a9f4f02ddb7d664f68f83d69833bbf04a0dca96eac6f23929c8194fc43279607
SSDEEP 12288:YkPHWUyciZyULptTGX7GSnXRGfcJYejJw4TINlWVcW7TL0I:YmHWxcvUL67GSecD5StQLJ
TLSH
T17D252B6F6FE88497D16AC27E86BB8A4AF2F1B852173147CF0451422D3F27BE49979310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eon.deps.json

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.deps.json
Size 30KB
SHA256 4c6648821d35a6b26b7728e88cf042c0db13ef0903afd74f6fbd406000fcb1b4
MD5 adf88eb7ddf104bab2794228e5579d37
SHA1 0e72a6d51886bc8428a55b8624ce74bcba32c1ef
SHA512 5be5673f08c15e93e971349f102916f5298e1877241c4ecc6e51b1972e82a346d1e4e3ca18848f07bb907595edfc54b88a69c3781ddefc82ec50dbf6f24a4306
SSDEEP 192:YLMKVyXdx1d9fpZDUDi5UhI5QB+l2/swhVubVcLfMkq4Ip8CULjYOgn5YAlLh0:YIKSx1d9noi5UhI5QBAPyyVAoRGYV5tm
TLSH
T141E2AA11D4604DA348B167A52D3F4A86FA55136FA0005A8F74FC206DEF37EABB252F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eon.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.dll
Size 507KB
SHA256 b0f666ffab61b278bd8f988e9ba2a9f0d9fcd7330560fe651ddd741ae4938403
MD5 155770df6f47e731cab006cb1c03b334
SHA1 5a59dc1c486804252cbfb5c383a3d3b7c1f3d177
SHA512 3ff0b888a3b29e00e53810b223056ef6d5df2ff7c1b3f639a13e90e98f7d0a834ad0461c8f6f44c868475a4bf7a9070fcdb56ed9de6acc7edc3c5662979468cc
SSDEEP 6144:lOYYmzzv7XU0ZVMabbqJh4gY5OS2E9CkFaqw/x8eJNuo9EnfvtY99Rwmc:LYmnpVMa6Jh7nj5x8eJNuOovgRwmc
TLSH
T10DB42C0063D975BDEAE78E35F4647B420E6FB19BE804CB7D6812DC8F8A5A3D15801B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eon.exe

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe
Size 424KB
SHA256 3dcd5ccc7faae84e8fbc63f71ef6ba040d87e6ad62e8064821692f286bbc839f
MD5 a55b3114a11e3d46f36448f5e342b6af
SHA1 3249f39bf6c1824c0f33450973c94951673273ec
SHA512 d409ed390e93008c46962909edb6b3036f3d1171a7982e2b7a3158788b801b6c4fb5fc0dbb9217f969d256117a9f5142b0e692793d5223ef1a7164723edd18c0
SSDEEP 6144:pBKjK2LFzZNfIULMyCkFaqw/x8eJNuo9Enfv3Y99Rwmc:pMjnNfYj5x8eJNuOoviRwmc
TLSH
T15D94F702629635FCE993C935E4687B425E6F309BDB08CFEB6992EC5FCF1A1D11C1160A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 083f60f5ada8317d882ce461b4ef1b4466e057ed7797b67766489234bafa972e
MD5 eb325f7bf1d874925529454564af3f36
SHA1 276ac7ef1116afda23693584919c4f2565147eb4
SHA512 01be5f4b25e3db210c7da7b22f33f7f978446e69ff9af1450d126c6a4d31a9efa72eca8c20b8ac2e57943a11d9fa12727f699a81a02bd94b1f124fe9ed460d76
TLSH
T16BD012127341033CC01034730413E10C4841C60F40094048A468DA2E5F040546A06841
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8270.TMP

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a8270.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 690B
SHA256 4e43a74498ec21dcb29509fd2f16628063eb6145542ef662b0ad8d1e793a6ad8
MD5 8a6c03654b3f8f612da6387f89dfee60
SHA1 bcadc41d6e60037bc502f9efe6b6644667ab4bcf
SHA512 97d6af01ac339a27968e0affbdc4fe72d2b2a76ca16f48e39daea6b8932cb396d55e64798a1962e608113f578d2dc97ed5856194ad4aeab43dfb0587d0cb01b9
TLSH
T1F4017BD357BFF5371078496B1DC978096B7BF439015194F4CE66802CA0C69B74F02832
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a889a.TMP

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Network\TransportSecurity~RFe5a889a.TMP
Size 356B
SHA256 55f5dbd17a0b0c97b42f3e17de8f53beebebd502d8e32347119b8428a5902595
MD5 c4ef8825e3a393d80e34b53b4b2d0f6d
SHA1 99ea8238e12a8bbe14edfe89c10c5194e08cd606
SHA512 6f4bb8070e2924edd499c90f361d6107198b20137b6547fd9c4d6d8b9a645d21b095b0180fe8f87be4a8b3c22ad5bcdfcf0494c2251db0ef57d26d4439bd3c25
TLSH
T189E020D3467EB6B720784A2B0C807C055E36F13A115158E8EE5340ACE0C61F75A16422
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 623a8e961c6e293f2c4ce3742b63372eeeee66da775475c5665612bc35182bbd
MD5 4943b31e45abc370bdd662538ed7f4d5
SHA1 ee1538b2ac6fb8be4e2892548a2fe6927a52c82d
SHA512 2957ae90b84259dc6c55b1832616482a75c4677f6626efe5e43671c3a9950e230d8db08c58bea9f7f2811c4f1056f715a67923e7fffd22241245d9fdeb05e867
SSDEEP 96:stQ05EBHqyb90lffCZ8i0vhErklm/7qx+WVHMSm+uecadQjt+gvwMAB:stQ0OB2lfqZ8paR/S+Wi8dslwMQ
TLSH
T1B3D1B8025F6869775CCBF61DBA36BF02E2FA602265D50E58EBFC861C08E65CD530780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 298d76711761e39d3213b3349742a1680ee3596a47541e41fb07ca6f801da141
MD5 a88963fdcf30776bb4faf41a36508eeb
SHA1 759226df1d9515fef7066816feeca61c4339d64a
SHA512 4ce56678dcd67fec0fbc70b4e265cd3e54cc3f8e3362b04acfe4b33caa15f99a9dfedbd67a8fc6f81ca622ddaa84e1fcd8f4c27a4f9b78875376547427c95a1d
SSDEEP 96:stQ05djaqyb90lffIZ8i0vhErk7Xm/7qx+WVHMSm+uecadQjt+gd/wMAB:stQ0DjzlfAZ8paa2/S+Wi8dszwMQ
TLSH
T1AFD1B8025E6879775CCBF619BA36BF02E3F9602155D50E94EBFC861C09EA6CD5207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59f747.TMP

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Preferences~RFe59f747.TMP
Size 6KB
SHA256 6fd8b81f114cca6ed2c368db12bb39dfa2e324b1dbba8d67589d77584b31c2e2
MD5 a5883666ca53a91074143b65f8c70571
SHA1 050fd745e82244edc299ef80a12570d29f1ea1dd
SHA512 b9099db9b54c7bbe2e362d1a9d2dcf40901180a6afc484ed1264179c640f9601f1a01d2e21f178324cadca41a163b40f30d4a7e2e27e29a151cd23640e30fd96
SSDEEP 96:stQ05EBHqyb9ZlffCZ8i0vhErklm/7qx+WVHMSm+uecadQjt+g4wMEB:stQ0OBLlfqZ8paR/S+Wi8dsywM8
TLSH
T1E0D187025F6879774CCBF619BA36BF02D2FA602265D50E98EAFC861C08E56DD520790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\f026a6a7-6ae2-47c6-9941-5dc05ed8f97f\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 177B
SHA256 3aa2ce3e368fff3259b8bc49a4a67d07f0f4ba11e056fe23db018df2933196a9
MD5 8f6be8e93b3466988dfd594f2c549639
SHA1 a5855b3290421b32e6c8918a3138a3a44bbac8ad
SHA512 2f4c718effcbad36f7822c95f6faf90c154dd20fcb68e890317875b9544e6dd3fd1dc3e081837217d3f759809e266e074a05ff37466bff5590ea4b2e1908077a
TLSH
T1B7C0225F910074C03B2B0791C82290ADC7000E88482CE485E12770052839302A201EDB
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a6d90.TMP

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a6d90.TMP
Size 114B
SHA256 146f8bac2d20ad5e1b058809e180754cc5d3d7a60cf0e3755e4edd20ccbf155d
MD5 f45a0b3dee5d2e56647833f04a24c73b
SHA1 f73e81567a25a3885eb63f220e1a459dd9639f13
SHA512 869e6ca7dfbcdfdfd5272ef8f7585ba7b818c614ecad346916cee02b81d20bbb1c91c67377811bb8d1333f086708d57e275a49cffda78c7c773a269584b65407
TLSH
T118B0929B820559902B2A02D58A22D06E83090ECC5C5AA98AB14770462834623230ADE7
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 1c2f0432cfb2794eac74fe9f70b680b41d17aa01989d9be0acd00cf0c79a6057
MD5 a7cdbb11425532b52774ebe2b09d71d0
SHA1 586f38cd0d514bbafd0ced432770d20b9bfca8a9
SHA512 f68b36aac0bc50efa8677ff20c42f534cfbb8cb7ff478960f257b34b57a16b1b13cdea43e55b2b3e2bc7ed0e6349a31f9c8df91ca171338809f5ceaa80d7792e
TLSH
T189318573E4A47B319C906446B517FE472F71F07A81154F48A6EE8F1C01FB58CA622C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 a98e5bdf50a94e000e8f415887a6e69f2833bc40d324ebc09760474f0d03d40d
MD5 92b5201bdf7fe12ac13ce3e2c6257516
SHA1 368474623df06addef962cb1fc34940cf0106508
SHA512 4ff839e6ffc6ef4fdaf542f335c41e33257e87f52367b543830b5f7c62f2695fcb187d2bea9f065b3646d698fc76a137416def2bf87ef06f9076b65dd3c50f93
TLSH
T122518473B824BB3689E2A905B91B7F139B71E16996521F549ADD0B1C01EB59C2302C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 275e73b19c1eb84b0540005b904473c4bf78e052a8a812883ac24eaa357f88fa
MD5 c7a7cb1a0a1bfdd0b3dea5c2bab4eff7
SHA1 e770a339ef0e0555bcef468f57015715264fdc10
SHA512 c728262bce0512020a9b6455db6674dd43a311feea54ad7387b3ddb0b5f2cd737d484015028e405b35bd23817e31bbce4e15d723a4a50af1fdd0464e0bdaf176
TLSH
T174719832A974F5274DF2A905B8477F06B7A1A137D5953F94CAED0F1C01EB2981342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 1fdd4488e7f70e1e116f1d78553eecc468a51c0b152c3791d49a44d561813bd2
MD5 54b3b7d7b9b28b99e5ef7603c4da4470
SHA1 6c83719a1acf9393d8f7ddc0a35efecb395590c6
SHA512 a6cb47e61bba24ea0c97e13fc7a04a22952fc19a680be9d1f80851fe702bfe6c49420e06e3215c130fec10dba67efed1b38e4ae80ff43f7f0541dc48c8f85dbe
SSDEEP 384:zR+aQikB+z/xvxjg/qhEwNb+4mb+Fl4ef9zD:w/UxvxjgC+P6Fl4eFD
TLSH
T10A729E2B55787E2395F7F505794D0B4BDBB4D4B690C16AB84EED5F0905DB2D81302D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe596807.TMP

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.exe.WebView2\EBWebView\Local State~RFe596807.TMP
Size 1KB
SHA256 3d783404ca48a65596a42816e8d25809620bbc852e64352711d5376b582c0fbf
MD5 4be445370f7c9b7898d1176b71946818
SHA1 1b52b5375e94ec991a059fc81ad679547d7e5a19
SHA512 91618f893b7c66f4d83ba74ee64fbf0bba38f15c88f18b33ef1d48300d4b7a758af9d5ff7713af2d83b66be196c6bedb4eb46b77b534fa0596718d7cf060dd4f
TLSH
T1D4216273D4A4BB31A8906406B523FA472F60F17A81144F08D2DE8B1D06EF49D9B63C33
MD5 SHA1 SHA512 TLSH

Submit Download

Eon.pri

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.pri
Size 2.0MB
SHA256 020194c93158c645c17483b833c8011b48f587224999f0818aedeb5e68849775
MD5 be27b37b2e2d50576dc003d5c32130c9
SHA1 50c47786de1c96dccdc19fc69a541d5d25a70fdc
SHA512 3934eb11e1a6e42c692fd20ee0125a6f8507a45c83cb341ba702da3e56ac6f77ce2a2ac43945eb419a3327bae0b018456aa68c873e28d19d140406df7f40f531
SSDEEP 24576:QkNQBc/a8/6GfavOkNQBc/aL/6Gfajsc9eFCp4VOL:Q5q/6GfaW5R/6GfaeCp4oL
TLSH
T141A51D01E3FB0108F6F76BB1AEBA4B2518B7BE666931C07F1144174E2E71B855AE4723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eon.runtimeconfig.json

Path C:\Users\Admin\Documents\Eon Launcher\Data\Eon.runtimeconfig.json
Size 340B
SHA256 feeff745ba1e8cc27d50546cffb499788e3ce8aafded81cc789fb4f39900128a
MD5 8c88cf0c6f912ba8598fca08650f74b9
SHA1 9046c66f681ab25b0973d9416207effc378370c6
SHA512 0cb08857803f582c50bc531af56ac9fd372c6edeaeca920540169c54a6fd6017d702268817da7397cecee0075629049d3791d004732909d38dc05c82c949ebbe
TLSH
T122E02665CE006CA701FA727BC531C183EB30632700101891B4FC080C2F7BAB50112F56
MD5 SHA1 SHA512 TLSH

Submit Download

MRM.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\MRM.dll
Size 298KB
SHA256 10070cc02a778d8ae04a82e3592aec3304107b92b1b07f5ed1c5745fab950051
MD5 2a6e03215376f77b7f9ada8b5fb470e8
SHA1 3d7f3ee73057885002bf8f8512ab6bd8e8e7d047
SHA512 722eb74a204fe22c3c0d25a24f99626c0658b21d07fe783ccf66d06b4ca2484bdd58c717939dbb893c25979aff13012a7c88aa0d227d7f1d471a820a86ef7ca1
SSDEEP 6144:yA0sC5hebJ9hHX7dWOHeumBR+9FSsKx+ZbUVbYG7QGille+Wz:yQC7ebJnXJ7+umBRyO8GTPie5
TLSH
T197545A2B63D814E6E17AA23CC5974A4AE7F2740113619BCB07B1414E7F1BBE89E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.InteractiveExperiences.Projection.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.InteractiveExperiences.Projection.dll
Size 1.7MB
SHA256 bdec197bb97d9836cba83487195f4795927ab1bf351374c4911725e45a7c51ce
MD5 f9262627c19815f0551e432c4cfb3b51
SHA1 2e68989684bcbbc43df52616d61341f6275221cf
SHA512 81946a89d86ed015429eec6dac4966759e62c1da34629eab8937612adf2b2d3ab39692d924cb062ebf3b1dbdce2f2b31bafa68291da3dcb6091a6fbe8d2c71f3
SSDEEP 12288:UNksUaU+1zdNeKalyWBN5WQWbn6PN27UbYesxeKMrNB09f:UNKEvoyWBN0Qengb2lZ
TLSH
T12E853915773CEE3ECA8F1BB6E29252146239E78B7347E346104DA6790FA37810F445EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Internal.FrameworkUdk.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.Internal.FrameworkUdk.dll
Size 997KB
SHA256 9241e0dfdc4d7f843dc1ed362d115aa964b51fc13ede292c20e32e668b4d67d3
MD5 e0879017e7ee3c6b587e2a85be0e893d
SHA1 7206ed84b90c4d8c8e29746bbc13b5ca2789a20b
SHA512 fe5d58311237e67d0cf565080067bf3e06c6c870cfe436d50d7594be844b09a6543005908601fe3918367d7cd7e58a95244df0b7b5fe75062c1a91c9a5c33a7b
SSDEEP 12288:5C8jIUBYbf81sQQPo1x2FcfoGJtPeumaNICB:A8jIUB2f81s61so8ulBB
TLSH
T19F25961FAE7951E0C4B9C0389596622FF8F130E68B3457C3E6919A1B6B32FE4A53D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Windowing.Core.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.UI.Windowing.Core.dll
Size 530KB
SHA256 c150e900207cfe5a979b67236eb5aacd3c9412f51e5b31fba68802c6f2bd2a86
MD5 6cc5412c486487ee96a24d2d83436e11
SHA1 4448f20fdee172f8088722f6816bbcf6f5cd8acc
SHA512 b9e9ba2f30b2fadfcf05f183d8b03ce1f4fe22e2fbaffc989e1b0693651398e63e0939469065d1fac9b5493758c4e83b81fa389409c36efb0931621f7cd00038
SSDEEP 6144:8+6A4LtjFUUwb0efDm7GZL+n82dzzyUX78nAknywHpNqzoCWu8+6H:56RLt5bWFL+nfdzzytnAkyw7EoCWuCH
TLSH
T108B44D6F6BE84496E22A913D85978B0AF6F174125732CBCB0121D13E6F27BE85D7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Xaml.Controls.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.UI.Xaml.Controls.dll
Size 6.4MB
SHA256 2d05531c93c4b16d3673cafcf8daf3330c6ec5962e1c6d3db3110b730ed6903d
MD5 08b47709cb49b6ec8c83c53d4b283c60
SHA1 2d4c2ea0952a939e6637630b1ca3e9107339bec7
SHA512 6c067ef65e1b945292857dec320a3681ea227eef76175da6b6f01423e679a245111fe134fe5bbfe6924f553d03771954843619e13c050542215c634aab48b072
SSDEEP 196608:/A8CTjD5fxWXQSzCRRe5Ds2auhze6mKZZ+GDFHOahWJ4Q92k+ZTTr8F1uSmafRy:/A8CTjD5fxMQSzCRRe5Ds2auhze6mKZR
TLSH
T109665A5AA6BD02E4D0F8E97C96A3880BF5F2386A8731EADF0135415E4F1B7F1463E611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Xaml.Phone.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.UI.Xaml.Phone.dll
Size 1.0MB
SHA256 8af7cac4aa9398b9dd726a639bda0e4609dfa3c9e4118adeade66be38c9c403b
MD5 f41874fa3cf245e80bdb277016c8c3a7
SHA1 37e0732c6d1f34950579de1d56432e25c6f4810a
SHA512 69164d5c1483b0928114a77010703565466f202b35f75e999124c3aabe6346cbf7fed2a7ea917a844eb8cd60a9c297e6cd2f8b3a52040a0c71aa818cf18a725c
SSDEEP 24576:4jPVVgQ8RBq4FJeTLSmLM9BnnT90ZXoU:4Bsu4F9J0Z
TLSH
T14A35F80716EE0992C5BC663CA563594EFAB1B8422773B6CB0294025D4F3FBD19B3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Xaml.Resources.19H1.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.UI.Xaml.Resources.19H1.dll
Size 553KB
SHA256 b00cc68ba9fbdef4e6ac47935dedca893bb291f7ac2d88fc8dd0fb830c90c934
MD5 1293316c940de42780c1cee128b8aa45
SHA1 df3ebf54dc3e8bf734737222588d72503567bbe4
SHA512 5da465d1a4d8ef321e9204064b63d97deacd9754b26f9e28f4d4a30608dc254fce1afb79c00d099d279ed42b9f91bc55a051cee4854f8098b456a6b8f9ef7569
SSDEEP 6144:R33u9Ra+DIY8EGc0aeGPh46AdtUJyDJAg0ZCzstVskouv:R3ufIY8EUdAzVskz
TLSH
T18AC40C01E7FB1648F2F76AB06FFA496418B3BE536E31C07F40141A4E0A72F859A95763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Xaml.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.UI.Xaml.dll
Size 14.4MB
SHA256 6b92fff94551e5e2d4c40079ecb42abb315c7e4ccc5c6c246fffe723dcbd758f
MD5 5a872570af1c38d5e37d20a926dc56af
SHA1 8c7f4c69d2f2ad93c8a4c0bc6f3d637779e3c18c
SHA512 83f4645b364ee3b02ed9a230dbd80cad461710d5d4492af2163beeb142659d774752cd1116f7044841b84e7cd65479ebb96b44db0fabfa4f27917c535932adc8
SSDEEP 98304:OKKEHgHgXkfeCG4eP+UmDQXXqhJJjI8AgnGcvI1KgWtuEznxEiyyH:pHSg0feCGbGUmi6BI8j9I1Kg2uCCFyH
TLSH
T1CFE6284626ED4591D5B9A638962B738FEBF178211371A3CB0231015D8FBFBD28BBD211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Core.Projection.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.Web.WebView2.Core.Projection.dll
Size 652KB
SHA256 1468bb8e4233c6fef6667fd8a3fb214fcf4feff9a1f70fb4e338335dd87a5350
MD5 86680c697ba7e36c55add405e330cf77
SHA1 03d007a48983194fb0259f62d914c9029e2cb87a
SHA512 e53736d18fee03557f543b4c9ef9b45903cd10af73f9c3d637aa78f0b0bc520479cd522d60e939d717ce4197960d221f5a712436d4b6f47b58ad0b5c6986d7ef
SSDEEP 12288:0G+xOfDfrn+HvelBQLsnbgTM/tYUWdCZJLzoTMr99/DF2cbxSpWDSplq+1lqVaKN:z+grIeqyX7
TLSH
T1E5E4E72127AD872ACDCF6FFDE6A0829DB33EC24B719B67522D49A4A10F433506D085F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WinUI.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.WinUI.dll
Size 7.3MB
SHA256 667e51a0993459357d4d79cbd6f4a92ea57f4d17c88e44416076ff4505767439
MD5 bc67cb7c543b8a8f9a4f8692f2f1e001
SHA1 a012f40b1d65fa3e3563d2eda7f84b2603eb57ea
SHA512 466793fbc66b6efddd6316ba4b0eafc0083861a34601e124e303c30438b22cee00fe153727e07b34daed357b9836c5b58b44e1369b18ea7f185a3e9ec1d7fa91
SSDEEP 98304:3B8ofpumztYZ844bySCfMrUe/gRUjlnJFjqE9lnizJjqg:Mk4V
TLSH
T12E760802DBB8DF3BCE4E22BAE162523C8A24D6878353D7575409D8B72D63354374A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Windows.ApplicationModel.Resources.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.Windows.ApplicationModel.Resources.dll
Size 153KB
SHA256 fe7d05bb004898ac10adbd3ccb3a4386600b5190b2a0bab59d9111f2483b60fc
MD5 7d131b8f5190043cfb6d6012bcd80b1d
SHA1 6d8f39cdca59edc4440f881db891c247ec2f4d3d
SHA512 3df3b3a53e13575d942af44856a86deb0357b9c6367727de3b059f743eae50bd3cd3eae6f920c04d02a02502a54060230f5ba1c650969f594ba01579c071fbd7
SSDEEP 3072:gwpvv37QUU4TowW6s1mzSZJRXZNWn2KjcLIR4:gwFQCw6scSZ0rjcZ
TLSH
T19AE34B96B5BC40F5E97B957AC4A70A06FA72B0254321A3CF0235433D0F73BD5EA3A651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Windows.SDK.NET.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.Windows.SDK.NET.dll
Size 24.9MB
SHA256 b8d8ca8cea228f4c93d923f095e20660baaa8d5399bcb3c7863433a386df7adf
MD5 e72ed1c8f8236e6d68386d7be08d28d9
SHA1 e6047461a89bfd07f8583585ea5ae09785cd6e89
SHA512 d2a45f7d691dfae6495369615d744649f7c414066ea39c720f3df5a9871b9feb261f8b448f884d4a12974ef892396525aeb9eba1428cdcd869729845a4144855
SSDEEP 196608:+nZtrfkqJLQgVHQ+qNXkmS1rfqDrVpP0BeatVvLwt5:ofYgVHClkxf+r3mZo5
TLSH
T155474A026776CE3EDA6F13B6B6980F11C231DE89AB8BBF11445CC2A41CAB3551B495F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WindowsAppRuntime.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\Microsoft.WindowsAppRuntime.dll
Size 2.0MB
SHA256 ec567b500e44fe27da9ea40dffac6fa206d42896c0745948b23c13daedf7f1dd
MD5 341cb0116c34cd52f276a1dc1d64c4c3
SHA1 be19d55658dd361de3182c996d72be07992c69e1
SHA512 58b9f2b620a2ff44661a4bf18ce65dcf8a5d19992626bbd782a326ee5f48f729451ba70400493c7947b89669de21088ef7f87edee0a86a856c13297f4bf41fea
SSDEEP 49152:pGhEL4D+/QrTMthMzL3QEL6hMYQ/BefdrLsbzcRHcmEF9fIy46F7H8g2LmXGeOJ8:stMjEeMpG+V
TLSH
T133A53A42B1BC81D5D8BBE87AE2270902FB3370260335A7DB011643296E67BF3967F655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRT.Runtime.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\WinRT.Runtime.dll
Size 508KB
SHA256 1dc0dd3381e1e9432c96e6426469edac9acaf369a5c87343fcba778713791487
MD5 1fee0b1fe3a70677e15dd884b36af17d
SHA1 013d8cb3e877843f740dee343162db830380c8bc
SHA512 3e0540cf1dbb2e0836cd0761167ad1457f0ce45646248f49f6bb016bf65dbb1cef354eb63c23a1bc6ebba09f218e7f0ccb69944217eeaf71e070891fd37ddd8c
SSDEEP 12288:GeqzsFhcRq9FlwXYq8vH2NHav96iTtqJe:GFzsnjlwXJ8H2+
TLSH
T196B4288127FC9A1BD7FE17B8B43026048672FC53A196E76F268894B90F62741DE407F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinUIEx.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\WinUIEx.dll
Size 519KB
SHA256 25b22ce6d8a79e6517efefc7e7ad4ad898f2af7dddaec4738ec3172efd87d42c
MD5 7e97c6f6627e64529f70f374102fbd48
SHA1 4c31e1c68b3720bf5edc00ec48e1beee9ad0c779
SHA512 596cc52f275ff00ad02658cdc5e168b063fed00231c0932320fd8731d35e321663ddb1f1311533208d8aa2d8f9692cb2bbc1dcf7d7fcb1676c378290b2e5d2f7
SSDEEP 6144:Fbx55y51GT4XLTV9NIAhp2Oa+WwMAOCR06xiCpbbWjeyxv7eY81G+BBN28l:FbtyqMLTBLOC+6PbbW8ZLV
TLSH
T120B43A2A77E98F33EA5E2F36E0124205FA72D4406617F74D105493B09CA5FF1AC1AAF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcompi.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\dcompi.dll
Size 1.6MB
SHA256 c7314f35344808d78fdaa2ca53e1cada6c750570c80505177e4acdf13a8b9426
MD5 af04274019d569261530340afe6ea81b
SHA1 7c3febe614fcf051175039b5514bebd2ca204af6
SHA512 852d3cbc7172660eb7f65048cb0c44ee3223c81c450d4f858a9345f0c093480d0ef6d463a608c408195e059d2cb92e6188577b48d2ba984d4675967f4fa8ba51
SSDEEP 24576:TENXrsxFzN6CUlaiLTWC/jaUblEcPdUUKCaLGkIC7VfVJtEpHY/Sl5UMBS:T/atbaUblfPdUUKCQG1C7jJe9Y/SHM
TLSH
T136755C5A6ABC0099D6BAE178C9A7861ED3727C110F74D7CF012442AE9F37FE5483A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.UI.Xaml.dll.mui

Path C:\Users\Admin\Documents\Eon Launcher\Data\en-US\Microsoft.UI.Xaml.dll.mui
Size 25KB
SHA256 269aa55378f2b582f4b329d3661837413d10ca2f60f5cb68a33bdf87b9c61c97
MD5 95c14bec271e50b7faae7f41650f0604
SHA1 8eebbfc7aa9dcef266357f37d232a9781d390371
SHA512 4fd4b703abddfb39837d63aff58a5aeb3a582be9b393d739ddb2550e603504cc3b6eb36b274c2c8a9421213bc4ece90f2a0e890ef0a9c49b1c5b9f7da6eae495
SSDEEP 384:gWmLMouMtn73JA1F+zg2PEzXT7nHRN7OzxIPaR9z90h:iJ7n73M2PErOzxOW9zOh
TLSH
T1EBC25391A7FC0505F1FB6F746BB996516E3ABDA3AD34C61E0150A04E0CB2B81ED20777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

marshal.dll

Path C:\Users\Admin\Documents\Eon Launcher\Data\marshal.dll
Size 494KB
SHA256 efc12f8b8db772970e96a581cdda6e5e58b83802f1404b9961923729294b2850
MD5 41c89f4382ee7e45f35611d0d3dd8a83
SHA1 46439bacdfeb647dd54bb2e14d02cd6e69f2e912
SHA512 54e9a28e86d4d30ad1cd65e6ff3dbcf4b4a1ef7ae8b2e2cbb5021bf5b4814e09b7e8976b08a26d6086d7dd80b0fa178c805b0b6a1c6aa237008454c4d3433973
SSDEEP 6144:KFSpCRIb7zvKS03UP0V/KLzXq6pMuSEWRM6v/2ALcT7dfLA/7g:cSpCIb7j7J01Kf5euSEABPLcTZzA/0
TLSH
T179B4F48F696844A3C426423CC5678706DBB9BB9517D487CB037082ADDFDBBE42C3B625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 f56d4c21bb57976ae3b60f62e331e4984381a5891438836c8d34a88f59ae1f0d
MD5 5e303d700e7219594a587dd933fdd8ff
SHA1 fb7bd1f5a083955871c4177c5b9bff033800463d
SHA512 a50b170b1f2e046570b3150ef372c9bfd172d5cb75c945da092d645962072f66eb1db637f11fbd824303191d6936fb1fe7227658c865dcd986ec08c9e93bdc1e
SSDEEP 24576:du8m+1zxdoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:f
TLSH
T17447D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3171e505-c193-47fa-aeb9-3a1c3772a2e2}_OnDiskSnapshotProp

Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3171e505-c193-47fa-aeb9-3a1c3772a2e2}_OnDiskSnapshotProp
Size 6KB
SHA256 df8fae9ada27926f548fb9094f8c1d1f0ba05b33c682c8aecd1e9c56a491ba1a
MD5 36aa838d6c65c7bb123758cf73aaa6a0
SHA1 d557e6483a83354c4dd931c28e45b4675c55af69
SHA512 5f2f65b8f8ba4b632bcda3c0b004e6aba06799294f6bf2c69fec3a15ee135b454816e2eac913ed91d3e5ada97d4cf2fe2f8059089e41115491186372e3ec403a
SSDEEP 96:FeoV9vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:0Sb++ZVmN
TLSH
T191D19A185AE54711E2F3AB7128F14557A877B911EF33CB8E0298638E6630910F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/676-500-0x00007FFE29A20000-0x00007FFE29A21000-memory.dmp

Download

memory/676-690-0x0000024B26060000-0x0000024B2608B000-memory.dmp

Download

memory/676-501-0x0000024B26090000-0x0000024B26091000-memory.dmp

Download

memory/2436-1250-0x000001A8F1040000-0x000001A8F10DB000-memory.dmp

Download

memory/2560-672-0x000001C5A5770000-0x000001C5A578D000-memory.dmp

Download

memory/2924-779-0x0000021BA5940000-0x0000021BA59DB000-memory.dmp

Download

memory/3312-495-0x00007FFE29640000-0x00007FFE29641000-memory.dmp

Download

memory/3312-675-0x0000021044F40000-0x0000021044FDB000-memory.dmp

Download

memory/4356-1193-0x000001F6DEAB0000-0x000001F6DF912000-memory.dmp

Download

memory/4356-499-0x000001F6DEAB0000-0x000001F6DF912000-memory.dmp

Download

memory/4356-674-0x000001F6DEAB0000-0x000001F6DF912000-memory.dmp

Download

memory/4356-437-0x00007FFDE7450000-0x00007FFDE7460000-memory.dmp

Download

memory/4356-702-0x000001F6DEAB0000-0x000001F6DF912000-memory.dmp

Download

memory/4476-573-0x00007FFE29640000-0x00007FFE29641000-memory.dmp

Download

memory/4476-691-0x000002A319A10000-0x000002A319AAB000-memory.dmp

Download

memory/5152-1233-0x000002781AF80000-0x000002781AF81000-memory.dmp

Download

memory/5152-1245-0x000002781AF50000-0x000002781AF7B000-memory.dmp

Download