82612a2924fc5b06096364a62a6809ae318ccdee6bb812d449653080d32e25f8

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
Size 21.4MB
Sample261017-fp197sdc34
SHA256 82612a2924fc5b06096364a62a6809ae318ccdee6bb812d449653080d32e25f8
MD5 decffc4c0c50e453c83792fe720e1472
SHA1 81e3aea2c185a66fc993bb91bfdc31e69f2eba36
SHA512 3f80ddfbdb95e012c73010ad817f95b2b73388c4fc2a4e46adc24ffb0a1dac938f1cb2f0946e0513070a62414a41e6e60bbb413a5b1f8e538c353523419c1374
SSDEEP 196608:GE4kqFdW10JFK7J4bjEo30xouTpa0AeL1GWDyLh8xg5okh7JRXYVKUZXhrf5og:2W10JRbwokGuNa031WFQg2kkXhL5og
TLSH
T16C37D083F79390D9D0AEC47483559133EA33BC99092472AB6B94FB212F3AE505B5D34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4748	launcher-update.exe
5136	echo-launcher.exe

Loads dropped DLL 6 IoCs

pid	Process
4748	launcher-update.exe
4748	launcher-update.exe
4748	launcher-update.exe
4748	launcher-update.exe
4748	launcher-update.exe
4748	launcher-update.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	echo-launcher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_2005145144\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_2005145144\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_2005145144\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\Part-DE	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher-update.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\ = "URL:org.echofn.launcher protocol"	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\URL Protocol	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\shell\open\command	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\shell	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe\" \"%1\""	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\URL Protocol	launcher-update.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe,0"	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\shell\open	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\DefaultIcon	launcher-update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Echo Launcher\\echo-launcher.exe\",0"	launcher-update.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\DefaultIcon	echo-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo	launcher-update.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\shell\open\command	launcher-update.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo	echo-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Echo Launcher\\echo-launcher.exe,0"	echo-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\shell\open\command	echo-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\DefaultIcon	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\ = "URL:org.echofn.launcher protocol"	launcher-update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Echo Launcher\\echo-launcher.exe\" \"%1\""	launcher-update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\ = "URL:org.echofn.launcher protocol"	echo-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\URL Protocol	echo-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\echo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Echo Launcher\\echo-launcher.exe\" \"%1\""	echo-launcher.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4640	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
4640	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
4748	launcher-update.exe
4748	launcher-update.exe
1000	msedgewebview2.exe
1000	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4120	msedgewebview2.exe
5884	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	4748	launcher-update.exe
Token: SeImpersonatePrivilege	4748	launcher-update.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4640	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
4640	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
4640	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
5136	echo-launcher.exe
5136	echo-launcher.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4640	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
4640	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
5136	echo-launcher.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4120	4640	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe	89
PID 4120 wrote to memory of 3516	4120	msedgewebview2.exe	90
PID 4120 wrote to memory of 5508	4120	msedgewebview2.exe	91
PID 4120 wrote to memory of 5508	4120	msedgewebview2.exe	91
PID 4120 wrote to memory of 5508	4120	msedgewebview2.exe	91
PID 4120 wrote to memory of 5508	4120	msedgewebview2.exe	91
PID 4120 wrote to memory of 840	4120	msedgewebview2.exe	92
PID 4120 wrote to memory of 1652	4120	msedgewebview2.exe	93
PID 4120 wrote to memory of 1652	4120	msedgewebview2.exe	93
PID 4120 wrote to memory of 1652	4120	msedgewebview2.exe	93
PID 4120 wrote to memory of 5516	4120	msedgewebview2.exe	94
PID 4120 wrote to memory of 5516	4120	msedgewebview2.exe	94
PID 4120 wrote to memory of 5516	4120	msedgewebview2.exe	94
PID 4120 wrote to memory of 5516	4120	msedgewebview2.exe	94
PID 4120 wrote to memory of 5516	4120	msedgewebview2.exe	94
PID 4640 wrote to memory of 4748	4640	2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe	95
PID 5136 wrote to memory of 5884	5136	echo-launcher.exe	99
PID 5884 wrote to memory of 5852	5884	msedgewebview2.exe	100
PID 5884 wrote to memory of 3048	5884	msedgewebview2.exe	101
PID 5884 wrote to memory of 3048	5884	msedgewebview2.exe	101
PID 5884 wrote to memory of 3048	5884	msedgewebview2.exe	101
PID 5884 wrote to memory of 3048	5884	msedgewebview2.exe	101
PID 5884 wrote to memory of 5040	5884	msedgewebview2.exe	102
PID 5884 wrote to memory of 3540	5884	msedgewebview2.exe	103
PID 5884 wrote to memory of 3540	5884	msedgewebview2.exe	103
PID 5884 wrote to memory of 3540	5884	msedgewebview2.exe	103
PID 5884 wrote to memory of 4160	5884	msedgewebview2.exe	104
PID 5884 wrote to memory of 4160	5884	msedgewebview2.exe	104
PID 5884 wrote to memory of 4160	5884	msedgewebview2.exe	104
PID 5884 wrote to memory of 4160	5884	msedgewebview2.exe	104
PID 5884 wrote to memory of 4160	5884	msedgewebview2.exe	104
PID 5884 wrote to memory of 5556	5884	msedgewebview2.exe	108
PID 5884 wrote to memory of 5556	5884	msedgewebview2.exe	108
PID 5884 wrote to memory of 5556	5884	msedgewebview2.exe	108
PID 5884 wrote to memory of 4236	5884	msedgewebview2.exe	109
PID 5884 wrote to memory of 4236	5884	msedgewebview2.exe	109
PID 5884 wrote to memory of 4236	5884	msedgewebview2.exe	109
PID 5884 wrote to memory of 1000	5884	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4640.1116.14267180727248105883 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView /prefetch:4 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x190,0x194,0x198,0x16c,0x114,0x7fff3a4e5fd8,0x7fff3a4e5fe4,0x7fff3a4e5ff0
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1760,i,12344500584204090669,1264940112265932022,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1760,i,12344500584204090669,1264940112265932022,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
    3⤵
    PID:840
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1760,i,12344500584204090669,1264940112265932022,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=2026-10-16_decffc4c0c50e453c83792fe720e1472_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3504 --field-trial-handle=1760,i,12344500584204090669,1264940112265932022,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490 /prefetch:1
    3⤵
    PID:5516
- C:\Users\Admin\AppData\Local\Temp\launcher-update.exe
  "C:\Users\Admin\AppData\Local\Temp\launcher-update.exe" /S /R
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- - C:\Users\Admin\AppData\Local\Echo Launcher\echo-launcher.exe
    "C:\Users\Admin\AppData\Local\Echo Launcher\echo-launcher.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5136
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5136.3832.18029605392152901761 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5884
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView /prefetch:4 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x19c,0x7fff3a4e5fd8,0x7fff3a4e5fe4,0x7fff3a4e5ff0
        5⤵
        
        PID:5852
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1768,i,15068555114639665403,11567049124330777750,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
        5⤵
        
        PID:3048
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2000 --field-trial-handle=1768,i,15068555114639665403,11567049124330777750,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
        5⤵
        
        PID:5040
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2392 --field-trial-handle=1768,i,15068555114639665403,11567049124330777750,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
        5⤵
        
        PID:3540
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3568 --field-trial-handle=1768,i,15068555114639665403,11567049124330777750,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490 /prefetch:1
        5⤵
        
        PID:4160
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4544 --field-trial-handle=1768,i,15068555114639665403,11567049124330777750,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
        5⤵
        
        PID:5556
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4648 --field-trial-handle=1768,i,15068555114639665403,11567049124330777750,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
        5⤵
        
        PID:4236
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4476 --field-trial-handle=1768,i,15068555114639665403,11567049124330777750,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path C:\Users\Admin\AppData\Local\Echo Launcher\assets\config.json
Size 50B
SHA256 fb35eadf481ff138696e5fe920674d0a37087a24bbdf0cf9602be3647868a535
MD5 d13c77549117a22a2bedc8cea19d29c5
SHA1 5c028e9c22c1c00d90542913901593b31c61e74c
SHA512 449e7663ca68ac07081f1c1774c2cc1e792034fe779e4f43cbfe72f6241f38229c9dab419dc371dd98aa7b93c3b44080eda13c8362687637e149716f4b54bc95
TLSH
T1E090026694081855972085C5D235AA0BDA4B441B1D50D585D145500D0D145609041509
MD5 SHA1 SHA512 TLSH

Submit Download

echo-launcher.exe

Path C:\Users\Admin\AppData\Local\Echo Launcher\echo-launcher.exe
Size 21.4MB
SHA256 3a8c7ef34090e5a4d08e8c98839c97469f8ade73ef50bd7493e7af45d0ec4208
MD5 d4c77ad8119741191041154f94bdd9c7
SHA1 f43b2c52788dc3db23d44d9f04da601b7789e9d6
SHA512 8a21347c4f5852d7e2986a1464b5fd61dadebeb70354cab287271941e176a56acbaa0ff19c94348e462517ebed3832f5fd195b6c67a254212d0f84a03c035b4f
SSDEEP 196608:I2unhZDsxk0JFK7J4NXEo30xouThg0AeL1GWDyah8x1jokh7JRXYVKUZXhrdz:xcNsxk0JRNUokGulg031WKQ1skkXhRz
TLSH
T14337D083F79390D9D0AEC47483559533EA33BC99092472AB6B94FB212F3AE505B1D34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher-update.exe

Path C:\Users\Admin\AppData\Local\Temp\launcher-update.exe
Size 13.9MB
SHA256 8ea449f3457bcf590d3ed611d6094854f0bf48eb81778d4c03903dfd7666bae9
MD5 0753af10ba40b5124a7b30f26d6d8860
SHA1 48367114693ee4abf3f4cdd45c81f74ebf6ee9b1
SHA512 d139a0e78d3c382db443cf1b6995ee381bf08ccdae44141453797d4b1f1c6255b7bdac0b8d5ea2a718ea67ba9847bfe442166e0e4fde2529e6498691fa9f4e5b
SSDEEP 393216:QpxAKyG2k/kvxV9KmCv/Jd0ROGPLwEH4PbStcXqr39vHLL:QX9yGhkRV2WzLF0bV+39
TLSH
T191E6339965A3007CE04A3E7C8FA812C273F982D10B767D89D729C3E5A4F0FD555BC2A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2CF4.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2CF4.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

169b38ae-c18d-4778-85fe-7fe0bb2fbfcf.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\169b38ae-c18d-4778-85fe-7fe0bb2fbfcf.tmp
Size 4KB
SHA256 7a94ac30086e3fadae5d4cb08b37e43939c3a8ee0593a84a646ccc1258ad25f8
MD5 114d121a955ae9cfa237a08533548ff0
SHA1 26db9fdc23424ee4e0c3d027b22bef0e320ed2e0
SHA512 2e988a2ce048c618c58bb61238653f3a8f06f4cb51c3a8321604993e36e8ba86a968ffbf7c73ccf02fc6dafdc22d2293d189a8d0e02a8893e45e58e29fd1f73a
SSDEEP 96:WB3NkGSC2Nlf6gMh/5oS8kh/cI9URLl8DotoN56EBjSO6zCZWyZwi+JYa:63NBSxWthh1eiDUavjShK5W
TLSH
T18A8172666C78BA378CF2D505B98A3B13E6B49027A4C13F94D6EC0F1C02CB3D91382827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d7344ac-8f12-4d69-b916-a0e003e19fc1.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\6d7344ac-8f12-4d69-b916-a0e003e19fc1.tmp
Size 3KB
SHA256 cb2caa584c919ec528288050fce794f6a95c140c43cb10c7d10581ed78b7b1a3
MD5 bf817060341f1efdb083ed04595aa0b2
SHA1 290f4d7d768eaf1fd35135fc271c4a95a1029cfe
SHA512 53abec3a8251199a996eff7c858e30430ea6596cb33f92e587d24c460e466c2ec989d79a43b95b35f4fc5a4b9e1c32115bc9cb6d4d1784c60937bd813c688a78
TLSH
T1BA6171776C28AA378DF29A15F8CA2B16F6A59027E5D13F55D6EC0F1C01D72E82382C17
MD5 SHA1 SHA512 TLSH

Submit Download

8f65c5ab-7f07-47a9-9fad-0c2ce29412e2.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\8f65c5ab-7f07-47a9-9fad-0c2ce29412e2.tmp
Size 2KB
SHA256 ac3dfb0f471f9d38e5a31b0298996377d96323bc5b36ae4a2056d8d1c84a337f
MD5 5ec9ae1b2ac2920663190dddbebf8566
SHA1 5b8222ba8dd77dd04396b53ab1498944aafb502c
SHA512 5d9953253682c8d1338cf8589416d95ad1f7d7be946f3ed9657743fa45372bade9c17ad502f8a285062868ba44524685d37e9cf8e3d6627d4e2aafd19a573244
TLSH
T15E5194736C18BB37CDF28615F98F3F23D935A051AA922F0096ED0B1800D72AD2782C67
MD5 SHA1 SHA512 TLSH

Submit Download

9fb4bd15-64ff-427f-b27c-9f615e9330a5.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\9fb4bd15-64ff-427f-b27c-9f615e9330a5.tmp
Size 16KB
SHA256 9e2c4518856f344c407bc06b4612b2ee22899c80d4e75b6fb11831c4cad012e7
MD5 b45d752cc2e1085dcafe6e304115da96
SHA1 b988dd3d03331a235eb9943ba7a1411304324dcb
SHA512 470a2a27413c2b2d35d7bfda80e8d4f8e5a3168bc2c22f6afc90ba8f6d37fccea7049cc0e15028f8f965a219772f8e87f0dacef3c6368382728e7da310515fc9
SSDEEP 384:o+OBqImmJvGBLx3NaFMJFM3NBS/VH++6BAg6rh:RcvGtlNMK976Q1
TLSH
T15972AE7A1C293A236CF7C60AFECE2797CA712153C4E56FD5DDEC8F0E125A1941382946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 486a1b8506d19af12c17f578f5676e59337c0ee1164107df9b55b0e8dbeb35fb
MD5 9c55ebf764b6e3dc33170e3a66fc0768
SHA1 f5f5032e4550d3e17112f18945427153f82e54a6
SHA512 896e6b4ee2220bcc53fe5292322edd4a6d8bc759cce6908594dac19a02fe96cd6122c025b3a76ba238267bde7a03c1837f4fb14f8803917e8128fbd98cf38338
TLSH
T1F2D012177B014534C0102033084271491401C31F410580409569C91D2E484782D02451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9ba2d8d74522337da63f0f51f28f34962049ff3df225ba89d46b336fdf9f25e7
MD5 76378442290683af688a0c4a221eb4f5
SHA1 1e18f83261d49e6f88f4cdaae34df1513c717e47
SHA512 a82612b1015fdaf73760842f7af61ca7470a9871d498a37e550d81c34bf9159a8cbabbe234c3a197ff83d09405ab68fb6bf8fdd7d425499e948495a27abbb359
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1a20bb3dc0cc8a85af885dfd2b0eaf947427ce4ad3fb428a003dc3eb6542ad84
MD5 df86164d56570e6c2bd2c06069ec99b7
SHA1 1fdb8260e9e322137cb2348fba0aaa94d619de3c
SHA512 a21d72662201ca0f93ae393ded979e9a5acbd025f60b034bd9e8dd4fcac7114a0cd076cea517e1fbeeacf91511f30df32326c97f523c21c763cc8039b838f304
TLSH
T191D012177F015134C0102133080171491501C21E420581409569C92D2E484782D02451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 cf91d57eb6bb76ca72699dbf8b3c6b09d9dc59dbf6fedbc6f442db4d0fd1b5c1
MD5 e1573f35ee9d5e68e5d7362f57a8fbd7
SHA1 4b357861a6a085b35ed92c2f07ee5a6332840924
SHA512 2a7881ca3e21118804e07e5910085f44028f904613a6fa8a1c808b84d0183bdab0e35ba13dfe94efe6decc65555f0a388aac8458971efc3ae602c1b3af013339
SSDEEP 3:LstlNllkll/l4ZKtll:LsX3lEt48/
MD5 SHA1 SHA512 SSDEEP

Submit Download

001bb6190c10a5f4_0

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Code Cache\js\001bb6190c10a5f4_0
Size 246B
SHA256 04b7c7cdd1d0d2731bf481a8f74c86d28507f29afa5f1d36589c6d2dbaeb8ca3
MD5 fc4756a7378bd656f51bfc217d75b799
SHA1 a8daf925589ee5ab12b7e1c2b1ebd6501518fc72
SHA512 715788a8ae166443132524223cb6b53b10e7a8ea71c608fe22bf8ef673b4a6f422330254df41eebd3670d4e9fb38531bc2c71bd861f0ba8ca44fff8948fcb4fc
TLSH
T1BDD0A74F55146989CD2565F49EEE592F871B81D9C55C94221510ED6731816247728306
MD5 SHA1 SHA512 TLSH

Submit Download

0f65c3f1e02110f9_0

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Code Cache\js\0f65c3f1e02110f9_0
Size 241B
SHA256 f1b9b7650d7d19c7240047aa0735dde182a2d56cf7e258e94a5b9231dfc12e29
MD5 bdc4bf03c44bec366bc73a8bda217e3c
SHA1 6a781e918e66d6fc69d4afc6ea2882039c0da9e5
SHA512 40445450fa4c97b524cbd6f9b29fdfe69398e41fbd32c7f04240c239e49b5dc964b5af4e60bdb6954c7cb7d373439a7c43e53eb68c61e9205c59f4eac47a0264
TLSH
T143D023DF43541504C5666DF0F7FFC569CF0AD0D5108D51134009FC62714471C7206234
MD5 SHA1 SHA512 TLSH

Submit Download

1397e86eca56a692_0

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Code Cache\js\1397e86eca56a692_0
Size 242B
SHA256 55ef05d07d7dc3e59b65fc8ac5ac2c0a7689ea2749fa4f6296948b4a8f34425a
MD5 e227ba93547e3c3a876c124cf4bcc5e5
SHA1 872464c5cfab49a761bfe23aaf9f6759d53fe9d6
SHA512 10b1c8079d238733ca468937862c160ab0a5f49a686af3ca307654661f23b2454aedfa2ada781ea8c22d6be67eda7202d6ad8bade6048b08866642bce98aa9cb
TLSH
T13CD022CF8AB1D684C7268DF5E6BE467BC327C0F4002ECD499019ECE150C0B287549314
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 456B
SHA256 bc1b54bd4d4e28b74e9fd7eaaa59c895589c57d56908a193e2fb719f8b18dfe2
MD5 2d5352f06c2659bc025bef7bb3e4bb30
SHA1 1d68dbd10ccab9b2392a6bec442a009b26398bb7
SHA512 fc08e89af5b4de77fcacd4d01ce3c06fc3ff05701b4abfe7a872f4e39ab7894d1f413bd115f7ef1d8790141b8b51cafa145ca160207d8b02e5f9d913ab91da7b
TLSH
T18DF012FCD985C159DB24F578A5DD94493D7B440300F72D158B2770F49A2679071B5114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8719b17c4cecbf103472645dea40f590c0dcf64447411a8840c2ca7f34e8e943
MD5 ed727251494b6b7d0b045a0f38752dae
SHA1 d1aa2a795f2e908af4f636150e3347d57f78da04
SHA512 5a43404b1764c55fd496399c2d00b5524ce8fa2c8f2d1fec9bb010e93348a24755d6bed6c55f069ac72f79c1360e08ce641916f4b069ceb7e0c17940eed45ce7
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\History
Size 164KB
SHA256 34a255308664c0a01cbd0199ce1e3ae6a67db67b364bba2828efab7ab535ec79
MD5 12b17ff73fe7c7c98d1a18a72102e171
SHA1 2098ca34092c07d6eb0b6c26e75c8e749044fdad
SHA512 03726a2197e538215a730af905c164ef3ab075cc44d15e6b829dac9e28e0efb92f4b3193997e8b6292e2f92e8e7ff737b088d3cf5e88fe09953e15db8647428b
SSDEEP 96:8BVH25LqL/uejzH+bF+UIYysX0fxQp97aEHt/DfLVVVN6zRk/E0JEV:8Bg5qL/tH+bF+UI3iWGVaWNVVV63JV
TLSH
T10CF3EA5E5F243712CDBD923768E745B3597CF03F87236A866C6204B1CEE2656A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 d9a5060e0343b77c2acc9c244302b0cd214524ca7aa260d956b105fceeb8816c
MD5 c827e5d95d4cba4b783aa2e53cccb266
SHA1 ff7cb78cb5b8e5380ad863732de2a5f731ea6422
SHA512 8e882832c42add40aa3da0f3f3ca027261778deb71f1ddf2e9dc2a97ddf79e6682d65a6f90d63b1ba8512dadcf50b63a19debf5555cea352f90c512d96ad048d
TLSH
T138C022A14069F036203805392C80AD88AF3AB030008270E8C592023960400675103126
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d14856aa-b7f9-4d03-95fa-76103317ee15.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Network\d14856aa-b7f9-4d03-95fa-76103317ee15.tmp
Size 188B
SHA256 30cfd836c562fce9c9bdd0b9d396f7edb8e06805fdbb85a5e37613416603fc62
MD5 530f9fc2fb14a7288c35cc451164e014
SHA1 f20563895df0575087572ccfd4a2fd5b5fa30f0f
SHA512 8a98cfe108a4673c939bd6f0f5a0a7399eb62496a10464069c22ae69008e6a79de58a4d75b78dde7a521ca1fb0a7bbbd1d669dc0181a7e5d9adb4965f9147556
TLSH
T185C022A240A9B036202809A618C0AD006F37B4B2004160E9A6A3823C604026B7503423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 6aee6b8b291335ac212b6a391aad271929ef023ce9eb3aced3506926f0837a97
MD5 d607063c842173d50b301883379d4084
SHA1 1f087e17a0063eccfacf9dadafb12c5f3d112b33
SHA512 30246c9a74dbcc9df0dd52ae16deb317e20d1b682bd3aed79f4d561eda12d051646d6e245582e1cb07a8c0bcf46792569cec83278c9201ae72c7ae4fd9608b7b
SSDEEP 96:stk/d4pQkGbDSuk+Ydo5h16Z0ps7/x+6MhmuecJcqMkkjeKK+g7fCNVd28XM1C7K:stoGp6yonpsV+FdcqwjyJ6dG6K
TLSH
T12AD1B5055E24BA3B4CC7E519BA79BA47E2FA613274D11E48E7F8892C14DB6DC6303D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 7ece61c4538a7232165d60f1f6b5355fcacb9dd6dde0cf89a0d601855a812d8c
MD5 f82ace8dfa0aa78d59f07b376d29501e
SHA1 90f84d618781e22dd61881fac08416736f97f6a0
SHA512 35cd8b267cb6a76a4254aeb957862a1451154edb10f15a0a26794b3e336509adbee4a1f9b73b0326e4ec0dfdd7147bafa36c44a67cd27607d559235748581948
SSDEEP 96:rk/d4pQkeb9Suk+Ydo5h16Z03s7/x+6MhmuecJjY1ejeKK+g7f93N4I8XM1C7K:roGpkyon3sV+FdjYQjyJQg6K
TLSH
T130D1C6055E24B97B4CC7E119BA79BA57E2F9606270D11E48EBF8892C04DB6DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 45f8d1d51db2e3e50bdf35d8a8a45bf5139faa26b3bdd722a761dd394c8b463e
MD5 ec8ac94edb619e463f26b322d860c34d
SHA1 58192d3a66d7db688f21d57387ce9054a58fb1a6
SHA512 195f1fe36638ec3060b08ac13270b4f60768321951c3bf4241b85ff4b5537e9685fb1976eb411ba2651b1d67689874f6bfa290f1aed491b8441947fa73cff4f1
SSDEEP 96:v/iVPlf/ROo1pkF5d1/iY7VaTEv9V5h5pg5+e0XPQAYf5CpuOuhwWYdl:SVvjE9l3PQnhCv7tl
TLSH
T17DC181A7056DC174AF458AEBD8387ECBDAA6419F98C9480696E2C4480682FFC21DA8D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 ac827c0c24d6feedbf23636d208829e6aa7f4145beee584e90d7e94b6c624efd
MD5 c77eacb0dc534ebe7b7fd6091e2772d6
SHA1 e2887a7cc3d16e6f98855ea9ab3cb4481e5b341b
SHA512 ea46c187f604bb9db9766e816f58c92d2ee41fcdf38ceafbb6dc3f9a4e1c428ea3765cd07a84ebd1f35edd14c318aec887ca52dfd12329ec19dd7ca5506c85f8
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 174ec7c67313d6d9a7c1947c1ff613410f9759d0f2cb22bb684e215004178ebf
MD5 8df768cc04d27731fc5d8b693adc737b
SHA1 13287a2da1bec7538782030d137a81f60368f932
SHA512 5ffd1aa5925d37aac2a9110e99bd0e95456cac038ae6f368a6bfcc533c22a038b27259fb940b573ade2208e8e52e06b4e9ee0486fc244c95835083d17d7f0e56
TLSH
T1C8B01280FB009137C1D80F3D4294C7A16320E203651124234C458FA10EB63E93F418D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Site Characteristics Database\LOG
Size 319B
SHA256 d92997ce89955f2c0423421e28e87dcfc2d1c53f80a2c089928fa7fcb29fd012
MD5 f0beab305711dff257881c3216f9b23e
SHA1 64aafefcd5acf896d0de9e95f1b7eb0b8f01ed39
SHA512 c0565895b9477a66e2a811a5cdab20c28e530bd7a558a967c21ef21e8c4f1a3f88fcd5ea6f759f8270348cfc44bdc41d43e876ef0bada584f2576a381bb0a171
TLSH
T1E0E0D8102485823B53C556DE0AA2E359CB527805E5D736550F99E64C710F64CF401301
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Sync Data\LevelDB\LOG
Size 295B
SHA256 442b51cbdfc6afbee603305e231cc1dc9ba0651faa68112a6b3c5f9eae1cc6c5
MD5 4dff0055cf69b1e59560ef555c35b4af
SHA1 9f0105fba709949b7f0f191074016679a7dde6a3
SHA512 6c3d7c366e0ecafde29baa4a46dd7c6f31388b67a3d633bd75f2e10a9736fc070c77990b5a0c1c172c135d3f44ab5b0d618e3c53c0fce4e0552d4bdab6eafe93
TLSH
T1A9E0CD3168C5C23A96448ADB06F5A36FCBB07C1667C33B494B8DE54C740B70CF950781
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Visited Links
Size 128KB
SHA256 9296a9eaebd371b89125753e7a53cb0bf2931a977bd076b18ea443a14da79378
MD5 33c3030a9c508380875b3a9a7e8fa12f
SHA1 349e1f596fddceedb3d7e4795bb4adec07fe9694
SHA512 76deef74dfe24b3e8da1045e0d8d4b3fde0000463221ea336e241a4f58415b8c58a2df6605f879ad9397fffd0ed0c1923a0ff0cfab2688a6ac2bbd16239aa3e3
SSDEEP 3:ImtVua2Y+lXhV/:IiVua25hV/
TLSH
T1DAD3045C03434410D11C517444031F151034FD130437010107355711CDC150F0F07DD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c15ed486-80af-49d0-aef1-1722da23804a.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\c15ed486-80af-49d0-aef1-1722da23804a.tmp
Size 6KB
SHA256 2d761c697faadd303f08ca8a22c33be47f736be953432e95b2557dd725a82f2d
MD5 5a8b727d069d02e8b18be91cb8b34e2e
SHA1 d219ec3febbe147e2e7eb384e79268d40c161a81
SHA512 a8c86d4ae6599cc96b004b3ad8aa43c930124f2db9fec58ef8089f3af10a2ae8e4b0993f00a7a589f909b26ff5b0203813d2e85158f0d7398a228f3921ccbcd9
SSDEEP 96:stk/d4pQLGGbDSuk+Ydo5h16Z0ps7/x+6MhmuecJcqMkkjeKK+g7fPNCd28XM1CO:stoGpgyonpsV+FdcqwjyJQdG6K
TLSH
T125E1B5025E24B93B4CC7E518BE79BB57D2F9607274D12E48E7F8892C14DBADC220390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Local State
Size 1KB
SHA256 81011e7d11eea26d0c24d20528ea27ec2e0176eddbf212da529144e2c66efb34
MD5 466d7c78af91eff57e522dff2a9c246b
SHA1 0a20fbcadc29b2bdf2af54e0b2e391e9b0ace42c
SHA512 cdc14f19e51bb5804029d45a27fd7c9897f0d086e88468cf9af615817b3e5c0704e6dfad5e987af63746e76cecfac7c980a9cc73af78eaff82c4bef953d1d3ad
TLSH
T1492168B29C286B33DCA26217F1CF7B57AD31605691914D00A2DE471811D71AD6696833
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\ShaderCache\index
Size 256KB
SHA256 ba44aadc81b356e8f2a6153c01c799943b7eb58074539fa80e2c6d40c8b0b770
MD5 94b2cff67662f197590596e4e71ccba6
SHA1 b7f09d93ba359ff62e909139117ce59a2b517727
SHA512 a4f8b3cb80b5e323cc31258fab4deded475ea10b17c399a6f7b064e407133630f8dd68d13662e28dfe2532e082ef42e8b390ca15fccf5c359159b3d8010b2bee
SSDEEP 3:LsOllllklkXlilll:LsUlPil/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

a7a42182-c973-4723-84cc-d7dac96bd66f.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\a7a42182-c973-4723-84cc-d7dac96bd66f.tmp
Size 4KB
SHA256 0fa8015f9cc5086bf89bcee73d53e3fca83cc2af72c04bdcf3325d8e82fade31
MD5 22c8e01d4214393b2a78417020896764
SHA1 f94bb09d5b54c41743897c1135ec1f93aeb37adb
SHA512 9a5136f78558c29295cc3996406197d9aa11e9da6ada477ae523b8fddfa70d006d661b8d98046bb7c22a48a18676489a1bfa918cedd61de0d7e876770eaf0ad8
SSDEEP 96:WB3NkGSC2Nlf6gMh/5oS8kh/cI9URoDotoN56UBjSO6zCZWyZwTmJJYa:63NBSxWthh1eoDUa/jShKIU
TLSH
T1678182626C78BA379DF2D505B98A3B13E6745027A4C13F95D6EC0F1C01DB3D91382827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 41B
SHA256 f7cc307e88b6963287ca334653358b0ea0d519c117a083327ccbb6092e718587
MD5 fa7594cfa6b1dc25c78b047fee195960
SHA1 e0ac91d209d66c46c5f389f765509ab4f474b046
SHA512 e84a70e103f2a4e24a7f025a2f5ebacb365f9b77e6f1154d2f180d731279cb973fab182a2c98e18f7c6dc06de2e03dff9f23549cab9e73c4c2aa04c7cbe6a4f0
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 67B
SHA256 a3765c413da5d186ddcd651bce7630b3dc715acd684de9684ff8b1da62b523bc
MD5 bf95c880b5594e478a755573d4af1dce
SHA1 0821301f7f88d76d158af0735b8211a8f6a465d5
SHA512 b88c2ce7d27ae1932ecbc918dcb3759fb19f54ab812aa90c27b8557b74fa6c42abdbda479ed22cefaeefc6e353c0ddee89e22ded17244ad13e97e5cdc5e38338
TLSH
T1C5A0022CD790447B24F795250831729288A40E22D1F519ECF61B8519299E6915A74E09
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 86B
SHA256 0bc51f3bbb1d56afacabd4952d8f10789d1ab1ed9fea4e2a503f399466bdd85c
MD5 1c566fa842a2967fd407b541a4e98047
SHA1 10b59dbcf9c7844fdcc35922654698e940df1a61
SHA512 a522d9ac871bb624fb00094548a5d2922824942f5b40dd45efc301073ead4cd22924ffdc2ad45de183529612e4ca079db2e9522029cc098cbbacb1853dfff942
TLSH
T1BAA0121CC250803614F340100424319148B44D25C1A014ECA5174009144D3421930D05
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 111B
SHA256 f2967b61df957d6c49ba5195c80165df393721e06124df126490f21f635760a2
MD5 489ea718ac15ee58564fd9aa2af1b01d
SHA1 fca502890aed2d7745f48f45596e7447da1a3ec0
SHA512 5d339a5f2490b4154db4085f20a9463e1b383b7a4cb57ef33c82058e2e4823049902b6ed7cfb7439b4f8e102f88daa57183d7327d2a9fe2f0f74769912167a65
TLSH
T19CB0121DC678803614FB401004783BD18CB48E39C5A134FCA527500A184D3436931E66
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 197B
SHA256 03f6889f45529c7d30018d3effde22146e220bb5763707066dc78e1c7ad844a7
MD5 a09c90257fd3f3065e96435ede0c0945
SHA1 0d7eb50c1fc3cb60f22587f0ccec6ec8f9622f5e
SHA512 786fda54d4cd46d326b72102a4d7bfcf6f0da7e8b5ca627f83c78f1b2a81db3d5461c97d78a9c3505e068c287e4f4c6c5a8cee16294ef410554bcac721792e9d
TLSH
T1AFD0C00DC938403B10F70005003D3EC184A0CF3BD4D9389B4B5700061C4EB0324B5D9E
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 171B
SHA256 88a5e97b04c526510b216c5a182fe27602f552c0c12c0c4ec9eda12590e57250
MD5 fbef4d7214abfadf94eb76513b9250c2
SHA1 36bd64821b470143c8240d1efe38c877aa6406ba
SHA512 5a9daf69d2761ad147841b51f028fa3c155ca5f7be992e87e1bec9482e9e4f4874a54be98ed9122073ccb8e2cf3157981ceb72caa57b19545cd2bf565f89404e
TLSH
T187C08C09C978803A20FB4019046E2A9189608F3AC8E939AB9B5B50061C8EB132976E9E
MD5 SHA1 SHA512 TLSH

Submit Download

config.tmp

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.tmp
Size 149B
SHA256 944289e92cbe740e3da1e12782e6efe243c7516ca620e1544a6ebdda8c437b21
MD5 d8caa98d5a7973f8a0903e592469d1c5
SHA1 a4c411b65eb029e1917cdb579c1f0023bfed4957
SHA512 cf2f7ed0ddfb1846b7f6904f31d4548565977a9af18eebd34137581507e46c78817be5256e5027e4705f9d86cb82c2625b364da97cb614305eda3476af2352d3
TLSH
T1DAC02B09C974803900F74014047C3AD1C8708F38C4E434ED97175006188DB132871DDE
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.log

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\launcher.log
Size 500B
SHA256 ae81c033e254cf832f2639cddc38cf05cd87921528d42ea77005f9cdbade9c89
MD5 d47f42c274ad2190109a96f98280ceac
SHA1 653ab4f6226a0fd31fe16e3f2da564e395975d6a
SHA512 eeef056448b376095a11a83a126c55f136686641d9591a955b353874b702ca6436f96923c2a69faec68375858f4b43b758785e94900d1a0891b7caaee974d685
TLSH
T133F0E98A4A418E1E05D6D383111EFEBB4D2F3B25E47A62A437C3D71C984AECD1891491
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_2005145144\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_344608732\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1000-726-0x000001C72AD10000-0x000001C72AD11000-memory.dmp

Download

memory/1000-732-0x000001C72AD10000-0x000001C72AD11000-memory.dmp

Download

memory/1000-730-0x000001C72AD10000-0x000001C72AD11000-memory.dmp

Download

memory/1000-731-0x000001C72AD10000-0x000001C72AD11000-memory.dmp

Download

memory/1000-733-0x000001C72AD10000-0x000001C72AD11000-memory.dmp

Download

memory/1000-734-0x000001C72AD10000-0x000001C72AD11000-memory.dmp

Download

memory/1000-724-0x000001C72AD10000-0x000001C72AD11000-memory.dmp

Download

memory/1000-735-0x000001C72AD10000-0x000001C72AD11000-memory.dmp

Download

memory/3048-663-0x000001CB66A30000-0x000001CB66BF3000-memory.dmp

Download

memory/3048-602-0x000001CB66A30000-0x000001CB66BF3000-memory.dmp

Download

memory/5508-409-0x0000026FC7080000-0x0000026FC7243000-memory.dmp

Download

memory/5508-27-0x00007FFF5C2B0000-0x00007FFF5C2B1000-memory.dmp

Download

memory/5516-112-0x00007FFF5C2B0000-0x00007FFF5C2B1000-memory.dmp

Download

memory/5556-641-0x00007FFF5D3D0000-0x00007FFF5D3D1000-memory.dmp

Download

memory/5556-640-0x00007FFF5C480000-0x00007FFF5C481000-memory.dmp

Download