8ea449f3457bcf590d3ed611d6094854f0bf48eb81778d4c03903dfd7666bae9

Analysis

user interaction
yes
max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EchoLauncher-Setup.exe
Size 13.9MB
Sample261018-pre97aba36
SHA256 8ea449f3457bcf590d3ed611d6094854f0bf48eb81778d4c03903dfd7666bae9
MD5 0753af10ba40b5124a7b30f26d6d8860
SHA1 48367114693ee4abf3f4cdd45c81f74ebf6ee9b1
SHA512 d139a0e78d3c382db443cf1b6995ee381bf08ccdae44141453797d4b1f1c6255b7bdac0b8d5ea2a718ea67ba9847bfe442166e0e4fde2529e6498691fa9f4e5b
SSDEEP 393216:QpxAKyG2k/kvxV9KmCv/Jd0ROGPLwEH4PbStcXqr39vHLL:QX9yGhkRV2WzLF0bV+39
TLSH
T191E6339965A3007CE04A3E7C8FA812C273F982D10B767D89D729C3E5A4F0FD555BC2A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4828	echo-launcher.exe

Loads dropped DLL 6 IoCs

pid	Process
4664	EchoLauncher-Setup.exe
4664	EchoLauncher-Setup.exe
4664	EchoLauncher-Setup.exe
4664	EchoLauncher-Setup.exe
4664	EchoLauncher-Setup.exe
4664	EchoLauncher-Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	echo-launcher.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
218	discord.com
219	discord.com
221	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3340	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EchoLauncher-Setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4112	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\DefaultIcon	EchoLauncher-Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Echo Launcher\\echo-launcher.exe\" \"%1\""	EchoLauncher-Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\ = "URL:org.echofn.launcher protocol"	echo-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Echo Launcher\\echo-launcher.exe\" \"%1\""	echo-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\ = "URL:org.echofn.launcher protocol"	EchoLauncher-Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\URL Protocol	echo-launcher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{AD9C2927-1770-497E-9D8A-7A3367B5860A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\DefaultIcon	echo-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Echo Launcher\\echo-launcher.exe,0"	echo-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo	EchoLauncher-Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Echo Launcher\\echo-launcher.exe\",0"	EchoLauncher-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\shell\open\command	EchoLauncher-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\shell	EchoLauncher-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo	echo-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\shell\open\command	echo-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\URL Protocol	EchoLauncher-Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\echo\shell\open	EchoLauncher-Setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4664	EchoLauncher-Setup.exe
4664	EchoLauncher-Setup.exe
4828	echo-launcher.exe
4828	echo-launcher.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4076	msedgewebview2.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4828	echo-launcher.exe
4828	echo-launcher.exe
2056	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4828	echo-launcher.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4076	4828	echo-launcher.exe	107
PID 4076 wrote to memory of 5716	4076	msedgewebview2.exe	108
PID 4076 wrote to memory of 3348	4076	msedgewebview2.exe	109
PID 4076 wrote to memory of 3348	4076	msedgewebview2.exe	109
PID 4076 wrote to memory of 3348	4076	msedgewebview2.exe	109
PID 4076 wrote to memory of 2968	4076	msedgewebview2.exe	110
PID 4076 wrote to memory of 3776	4076	msedgewebview2.exe	111
PID 4076 wrote to memory of 3776	4076	msedgewebview2.exe	111
PID 4076 wrote to memory of 624	4076	msedgewebview2.exe	113
PID 4076 wrote to memory of 624	4076	msedgewebview2.exe	113
PID 4076 wrote to memory of 624	4076	msedgewebview2.exe	113
PID 4828 wrote to memory of 3340	4828	echo-launcher.exe	114
PID 3340 wrote to memory of 3472	3340	cmd.exe	116
PID 3472 wrote to memory of 2056	3472	msedge.exe	117
PID 2056 wrote to memory of 3524	2056	msedge.exe	119
PID 2056 wrote to memory of 4112	2056	msedge.exe	120
PID 2056 wrote to memory of 4024	2056	msedge.exe	121
PID 2056 wrote to memory of 4024	2056	msedge.exe	121
PID 2056 wrote to memory of 4024	2056	msedge.exe	121
PID 2056 wrote to memory of 4616	2056	msedge.exe	122
PID 2056 wrote to memory of 4616	2056	msedge.exe	122
PID 2056 wrote to memory of 4436	2056	msedge.exe	124
PID 2056 wrote to memory of 4436	2056	msedge.exe	124
PID 2056 wrote to memory of 4436	2056	msedge.exe	124
PID 2056 wrote to memory of 6012	2056	msedge.exe	125
PID 2056 wrote to memory of 6012	2056	msedge.exe	125
PID 2056 wrote to memory of 6012	2056	msedge.exe	125
PID 2056 wrote to memory of 1620	2056	msedge.exe	127
PID 2056 wrote to memory of 1620	2056	msedge.exe	127
PID 2056 wrote to memory of 1620	2056	msedge.exe	127
PID 2056 wrote to memory of 5740	2056	msedge.exe	128
PID 2056 wrote to memory of 5740	2056	msedge.exe	128
PID 2056 wrote to memory of 5740	2056	msedge.exe	128
PID 2056 wrote to memory of 3984	2056	msedge.exe	129
PID 2056 wrote to memory of 3984	2056	msedge.exe	129
PID 2056 wrote to memory of 3984	2056	msedge.exe	129
PID 2056 wrote to memory of 4700	2056	msedge.exe	130
PID 2056 wrote to memory of 4700	2056	msedge.exe	130
PID 2056 wrote to memory of 5832	2056	msedge.exe	131
PID 2056 wrote to memory of 5832	2056	msedge.exe	131
PID 2056 wrote to memory of 3292	2056	msedge.exe	133
PID 2056 wrote to memory of 1456	2056	msedge.exe	137
PID 2056 wrote to memory of 1456	2056	msedge.exe	137
PID 2056 wrote to memory of 1456	2056	msedge.exe	137
PID 2056 wrote to memory of 1812	2056	msedge.exe	140
PID 2056 wrote to memory of 1812	2056	msedge.exe	140
PID 2056 wrote to memory of 1812	2056	msedge.exe	140
PID 2056 wrote to memory of 2356	2056	msedge.exe	142
PID 2056 wrote to memory of 2356	2056	msedge.exe	142
PID 2056 wrote to memory of 2356	2056	msedge.exe	142
PID 2056 wrote to memory of 1788	2056	msedge.exe	143
PID 2056 wrote to memory of 1788	2056	msedge.exe	143
PID 2056 wrote to memory of 1788	2056	msedge.exe	143
PID 2056 wrote to memory of 3956	2056	msedge.exe	144
PID 2056 wrote to memory of 3956	2056	msedge.exe	144
PID 2056 wrote to memory of 3956	2056	msedge.exe	144
PID 2056 wrote to memory of 768	2056	msedge.exe	145
PID 2056 wrote to memory of 3784	2056	msedge.exe	146
PID 2056 wrote to memory of 4068	2056	msedge.exe	147

C:\Users\Admin\AppData\Local\Temp\EchoLauncher-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\EchoLauncher-Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4664

C:\Users\Admin\AppData\Local\Echo Launcher\echo-launcher.exe
"C:\Users\Admin\AppData\Local\Echo Launcher\echo-launcher.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4828.2948.11172939007461023402
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffed85cb078,0x7ffed85cb084,0x7ffed85cb090
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1760,i,12477711061838871594,9056052566371044242,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2068,i,12477711061838871594,9056052566371044242,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2396,i,12477711061838871594,9056052566371044242,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,12477711061838871594,9056052566371044242,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:624
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" "https://api.echofn.org/launcher/oauth/login?challenge=-r-YnMUkh_1WYe4T_VgijDjeY0cs3FhLTmwy6gceaO0"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.echofn.org/launcher/oauth/login?challenge=-r-YnMUkh_1WYe4T_VgijDjeY0cs3FhLTmwy6gceaO0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://api.echofn.org/launcher/oauth/login?challenge=-r-YnMUkh_1WYe4T_VgijDjeY0cs3FhLTmwy6gceaO0
      4⤵
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ffed662c188,0x7ffed662c194,0x7ffed662c1a0
        5⤵
        
        PID:3524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,992887431678732353,10535209798212014817,524288 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,16170436263112776879,3990909069445963768,262144 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
        5⤵
        
        PID:4024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,3297574755722800737,8517183656139906956,524288 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:8
        5⤵
        
        PID:4616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,10325599944007618118,14063244537981813753,2097152 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
        5⤵
        
        PID:4436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,3545141799417575124,957508173013021914,2097152 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
        5⤵
        
        PID:6012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4884,i,8942311985455797400,15134296112979293237,2097152 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
        5⤵
        
        PID:1620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5064,i,3300771018593179029,5288438513317689416,2097152 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        5⤵
        
        PID:5740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4740,i,951361477157422260,16355197876311030150,2097152 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
        5⤵
        
        PID:3984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,11368909522494344663,8906543577287861289,524288 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
        5⤵
        
        PID:4700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,11544993506806546100,9856271564179585070,524288 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
        5⤵
        
        PID:5832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5410358219779222434,13444324317721669041,524288 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
        5⤵
        
        PID:2312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5410358219779222434,13444324317721669041,524288 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
        5⤵
        
        PID:3292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4868,i,287008630396742592,10575862066422940525,2097152 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
        5⤵
        
        PID:1456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6656,i,2379751307595952706,8758560941565027974,2097152 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
        5⤵
        
        PID:1812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3460,i,9630467043422776325,15202937096941957359,2097152 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
        5⤵
        
        PID:2356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6916,i,11033092593070268787,10919759469662999952,2097152 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
        5⤵
        
        PID:1788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4880,i,12404700987857333007,5854954072343885082,2097152 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
        5⤵
        
        PID:3956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,17922975913012550390,5458864639279704279,524288 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
        5⤵
        
        PID:768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,1983584944475668468,16900328809242551103,524288 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
        5⤵
        
        PID:3784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,13944440406935883168,2270042996685724325,524288 --field-trial-handle=2324,i,17264927074899546883,13813992175143637343,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
        5⤵
        
        PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path C:\Users\Admin\AppData\Local\Echo Launcher\assets\config.json
Size 50B
SHA256 fb35eadf481ff138696e5fe920674d0a37087a24bbdf0cf9602be3647868a535
MD5 d13c77549117a22a2bedc8cea19d29c5
SHA1 5c028e9c22c1c00d90542913901593b31c61e74c
SHA512 449e7663ca68ac07081f1c1774c2cc1e792034fe779e4f43cbfe72f6241f38229c9dab419dc371dd98aa7b93c3b44080eda13c8362687637e149716f4b54bc95
TLSH
T1E090026694081855972085C5D235AA0BDA4B441B1D50D585D145500D0D145609041509
MD5 SHA1 SHA512 TLSH

Submit Download

echo-launcher.exe

Path C:\Users\Admin\AppData\Local\Echo Launcher\echo-launcher.exe
Size 21.4MB
SHA256 3a8c7ef34090e5a4d08e8c98839c97469f8ade73ef50bd7493e7af45d0ec4208
MD5 d4c77ad8119741191041154f94bdd9c7
SHA1 f43b2c52788dc3db23d44d9f04da601b7789e9d6
SHA512 8a21347c4f5852d7e2986a1464b5fd61dadebeb70354cab287271941e176a56acbaa0ff19c94348e462517ebed3832f5fd195b6c67a254212d0f84a03c035b4f
SSDEEP 196608:I2unhZDsxk0JFK7J4NXEo30xouThg0AeL1GWDyah8x1jokh7JRXYVKUZXhrdz:xcNsxk0JRNUokGulg031WKQ1skkXhRz
TLSH
T14337D083F79390D9D0AEC47483559533EA33BC99092472AB6B94FB212F3AE505B1D34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

803a2a7b-bf0e-40dd-b524-4a5092b4009f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\803a2a7b-bf0e-40dd-b524-4a5092b4009f.tmp
Size 26KB
SHA256 e7fd85156525afb160e944b019cc2ce8183071ff94196ce01c1a08aea63eb9c4
MD5 f8d5edda8f16c9f359cb7356800f38a1
SHA1 c3d7858644ba966b6950916b1045374718c88753
SHA512 c53b65316d33bf97f9bec433b4dd8c3a9a012165297d13ddeb9f9a93c39021376b9926beda2ce9378790df5086af199192f38e05152c86c27e15ec4eb068611d
SSDEEP 384:nniFzQkUSva3sNT8TUNTUlI4FaKMO/Euw2f0BCUvPAVG9gtuLIiZ9MT0gL/7Iz18:iFda3OwgvW0BCUwVAgtoIiZ9MTCLY
TLSH
T13AC24A36ECA9DAABEDE60FD5A74E3643DEE04163D98C4AD4D6D91D2C00C719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

47b54340-ca1f-454a-affd-dd69d602a99a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47b54340-ca1f-454a-affd-dd69d602a99a.tmp
Size 12KB
SHA256 40cae0899aad3fac0712703a239c06adbc68a0ffc66736eee3ef01791be48d46
MD5 1f9574e1978f4dd8deda96ce80aea34d
SHA1 e2c9731a2f3b796a5db64e48aabc5fe4e2d544d5
SHA512 5d50c2f109d69f5c5fae8ebf1b6ede4c093fd12e9117a74c44f9fc15ae0b376f270363912854493579edaed4414d7e13975d1a11ac8517127c58b517f170163e
SSDEEP 192:sxZ+R6wji/fgslXaQZLjN8azodpkKOwHW6+WN7r4HS/z0oQ80ISVFvIg5TtEJ:sxZ+00i/fgs4OPSh5fHb3CS/qMS/ltI
TLSH
T13E52D819AD38AA3B4CCBD619FB55BF53D3F91072A4911E84A6FC8A2C14E7ADD120341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c447487-1f5e-42b6-ad12-8d43f5b87eea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c447487-1f5e-42b6-ad12-8d43f5b87eea.tmp
Size 32KB
SHA256 c197dae08a35d8acfa7269b4b54140e7e1466709aa3c942b48a26cc478da81f4
MD5 ac7205aa1ece3caf10a0322425f18a08
SHA1 8f88c4060fdd721740ce2aad99a9c28cd2c53368
SHA512 c8887b0d5d1a1843e5d5813155c142f53b26a266eb36f89a6cbdbcf7b423f646a3b18008b8a882e61df31acf0a13957a9efc7897781bb3e06d7a1624eae200df
SSDEEP 768:Px6r8sW7pLuLbG+Wviy8K8F1+UoAYDCx9Tuqh0VfUC9xbog/OV01qpLlvVajYro3:Px6r8s2EbG+Wviy8Ku1ja11qpLd4jjoK
TLSH
T106E2E97B780CCF7E4FC05A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c8eba88-ef16-47ff-8aef-aabb5a50a05a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c8eba88-ef16-47ff-8aef-aabb5a50a05a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

98a122d2-2780-4f9c-8e3e-70f845ba57dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98a122d2-2780-4f9c-8e3e-70f845ba57dd.tmp
Size 12KB
SHA256 47c4f1e53d15ebd9e6184e8255b02853718f00873384dbcae3febee2ed17d073
MD5 40d5b288bfd387da2629084a7b8c97e8
SHA1 4a6d1f5403626658eac84dcb8a81c892f6a42de4
SHA512 9c0ea742c6dfa274e0ea37450f31c6a8b04ff224b3c981271276d2e001683e59a3d599b688dc706c3aa68263cfcb8a1a2476b34c88dba7a4d67aaa9699dc12e2
SSDEEP 192:sxZ+R6wji/fgsGXaQZLjN8azodpkVOrpHW6+WN7r4HS/z0oQ80ISVFvIgjtEJ:sxZ+00i/fgsZOPShK0pHb3CS/KMS/jtI
TLSH
T17042D955AD38693B4CC7D619FB557F53D3F91032A4901E84A6FC8A2C14EBADD120741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ef9ee5e-2104-481c-8a7c-10347d425e60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ef9ee5e-2104-481c-8a7c-10347d425e60.tmp
Size 414B
SHA256 b61ccea21d8df7d04fd3901797cc31c3e83eb24cac5c0df7d3aff6e93e603d10
MD5 3ab06afd8f68d294e229fd2826f35f0c
SHA1 536996ce8f38749fad5663e775dd8c235163be97
SHA512 dc9f1b0d173afb125cbd4e66d14e90ef2bfd18741b7512a548a3ae647e2894a8744745d911c9f31e618c7d403b9f32a2f96c094d73d3e20bf9f25455f906af8b
TLSH
T197E02BAAD825EC3B08FD0B7950940646F70423672A519D4F3B3D81088FF0A37459696C
MD5 SHA1 SHA512 TLSH

Submit Download

9ded497a-0857-4619-9c3b-fe6185bc34fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9ded497a-0857-4619-9c3b-fe6185bc34fc.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5db22661-f1cb-49fa-807b-78b06a508960.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5db22661-f1cb-49fa-807b-78b06a508960.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 913676f13b02b6e30f1626f37216aaea2a5c3244eff4f7d1d99a6c420bf5be95
MD5 a8e985ed6ac6fd6e417b1d66b2c46c09
SHA1 84456d68e95f57eb7036c63df023a5af623955ab
SHA512 2161aa587c7974241d67eda28532927ab53c89f75667a546499023acd7bee0a3293255821ad279845541ab42795ffbf81305f89c9e385e44f804dac9216b55d8
SSDEEP 768:SL29ObJffppdNlrtEoHWL31R9oRkj/DBrd4X3E1+:SL29ObJffppdNlrtEoHWL31R9oRkj/D+
TLSH
T16DB2211571BB421039FE294891B6972E168231B33119E66F7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

cfc0c978-71ab-4ca1-9aac-cedbbff4757e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cfc0c978-71ab-4ca1-9aac-cedbbff4757e.tmp
Size 25KB
SHA256 704886db85e308ceca56652b75ad2a87280800cf7f5f5a0ac5d71bb4bc0ef690
MD5 3ca00e73f32fb393f5913ef1ae3fb029
SHA1 71e51ba055f7c8686fdeabed6c5d5cf975dbb911
SHA512 b7cd1270836afae8a068c3178f8e5243bc1b629697f6703d3c22282b02679f3519e743ad814eb647f01379f82dc5422818f631003cba9b1af4d44873bc95d106
SSDEEP 384:nCiFiZcI63sNK8TUNTUlIm2aKMiX4w2f0BCUvPAVG9g7Ff7O6R2FeoSqgL/7Iz7Q:JFQ63DwgcUZBCUwVAg7Ff7TRXyQ
TLSH
T124C25C36EC99DABBEDFA4FDAA74A7A03DEF00163959C89C4D5D81D1D00835AD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcb7d0d4-0839-4cca-b9d5-9bfb54cfc502.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fcb7d0d4-0839-4cca-b9d5-9bfb54cfc502.tmp
Size 26KB
SHA256 79487034cb31c60c944469e4620d257ede0d8397dda56e724cc48bcdb87ea40e
MD5 8093f259e5e1b45b741d1cef84073ed2
SHA1 37959e1f7961f6afbe9bb04f485ace814f485c14
SHA512 e4582c0752cfc95330686ad88c6f92468ac2d098b38ae29915ec1a9aaf1eac3dce50a8f8c18aa2a1da594400af66f43ac8b7ffeae1e89f79b89f19ee9fc97119
SSDEEP 384:nuiFiZcI63sNv8TUNTUlIm2aKMOpew2f0BCUvPAVG9gtuLKiZ97O6R2FeoSqgL/x:FFQ63ewgccrBCUwVAgtoKiZ97TRXyQ
TLSH
T189C25B32EC99DABBEDEA4FDAA74A3A03DEF04163958C99C0D5D81D2D00D75AD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f1324be8043598aa0b2e1f552a17c250374cf2d13fa3d44b94559985baf77458
MD5 89abee8decb0d1f11bda7473e7c313ba
SHA1 b610e463a0f295b7b5254858edaaed50d40efb54
SHA512 b3854d0ff08387cb916b56054cb14f64371c9e3cd12d4e41f5c56f9dc9e118c239fbfb20186aa8b42a24188f89cdc70e4c38157d29e403f47b15a23a1745f48d
TLSH
T17741E758A6F91158B3B37F5A9BF6B86E487BBD372E06C4AE10110D4E0A62B40D971733
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 67e440aacb4dcd9e0c5ac394743c0ad2a3f199341244980a649f39e85da06533
MD5 d2f96ce4385996503e6b851843444a76
SHA1 91cfddd86e2c90e0d778a36dd8109021a6938537
SHA512 00082a989a9fce21e8305120f06dfc720ceb55a2374d2399bfdc833c55f013a99201b31585a11493da71c03c66c4c91f17fc2c2beec96d967d67268f4e8c414f
TLSH
T16241F858B6E91048B3736F1AABF6A86E487F7C632E46D55E10120E4F0A62B45C87173B
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 c22a2663979cf31a3f832645d82d9ea069eaf90e7daf772c74c93fba54204350
MD5 fed0006cb7dcd6145d8d5b77c198362c
SHA1 33c116de51184d49127cfd52b2b3f7498b191a5a
SHA512 2b5db2054b9b58f03281639950fa17e8cb5e484890b67da6dc3d7ae645af816ffb7aabf57b01244fc3fef4ec14c1eb2759a06d2b7eb8309b49bfad53565a38d7
TLSH
T131514B58A6E91148B3777F569FF6B9AD487FBD732F0AD49E10010D4F0662A40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk1054.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsk1054.tmp\modern-wizard.bmp
Size 150KB
SHA256 4d12ec038a6e111bde5c62286a3ba6c71314f44aa7f005927ccdb123279b5097
MD5 eaf61ca41389ff65e338732e4884de79
SHA1 ce5799f73bcf948cf68e3024f8d77209d3fe6337
SHA512 fdcde8f8ce71780715a77c6adfa7718def4888201762da3dcc4fed6cc679fee36efc036cea286c439f70cddd5654628f823a51e1e9eab871b038c4f9da72ef7d
SSDEEP 384:PTJvxlW5rXstHu0gWAZ2wGATu4jpDxnnzK:NvxlW5rXs5u0gWq2wrTu4jpDxn2
TLSH
T106E36FC0203950B058F60E907A2F0185DDDDBD65BEF8F69D2E2075510BFBAEAEA47D01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk1054.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk1054.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e08f727-98bb-4264-b7be-eba98f32a6ed.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\4e08f727-98bb-4264-b7be-eba98f32a6ed.tmp
Size 16KB
SHA256 63616e01e144a62a1ff776790a3598646ff49e38f2e03334fa629b217fb9c32e
MD5 59724e36ab9a9642e22f9c7576c2f6ca
SHA1 0e9af4c5a2461f4e7cb42ed2c1d2feda59d79a41
SHA512 3051ba1989f05c31ace15d6142567be4e68a49191f8f7b4ebed9e96aae07090cd8ad34957a727fbdaffb6050b5ea06fc8c80b6bda7446299e0a8698b4e3df433
SSDEEP 384:z/+OBqImmJvGBLx3NaFMJF9NbV3mzgjk6g6rO:icvGtlNBigjkcq
TLSH
T126729D7A18696F332CEBC50ABA892747DB616297C0E56FD9CCED8F0E01AF1981342D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9261112d-9f19-47c9-87e9-730ebc826388.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\9261112d-9f19-47c9-87e9-730ebc826388.tmp
Size 3KB
SHA256 cc19bfa750ce198424cb5b7328deb07b1a6379795b5150465ee1eab8771b3ec8
MD5 9c7c13654ded53c1c1cf852d50056bc0
SHA1 4337d7e5d8d53b810354de789aa73000252e2cb8
SHA512 a5c8ac18e3123b05c6d9db6fa926a41f7f4242cb72276c9c1dfc726edbe9ab46c012c99088d6875ca38311e4077c75cf8c0d6efd14a1738ee9d42b19a4e82b58
TLSH
T1F171A536A468EA374DF6D904B9C92B12BAA55166E1A53F94C5ED0F1C01E73D81342C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8e75d636d67426c9dc145adf71d9869e4ca7c49636773fd2105e8a8495edd6d7
MD5 73120f78c8c4de88ad4e83ccbf66ce6a
SHA1 72bbec95d0bf3d7c72951a14a5bc091806696d5a
SHA512 69c7b82f6dfce274259b1299ced396bc15f15589414527597e3310c3b429d2b7d4acccc94ed7f3ff0b3dc2350532ebac0c0e6ee021e39c7d975d4bff1c07ccc4
TLSH
T1EFD0121A330101BCC82025730412620C0940C15BC009C000F428995E6B440D00A12452
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b846103a568d659d28c4dd9e91e98eaa80257a5ae6f853a795f2d4bbc8199c50
MD5 bb028f34e5fe2c4dd0cdd26ec17f110f
SHA1 7080b461a35618f10961d0e6b160527f1a378185
SHA512 b2ed3aee13b80573d29f97674daefe8c07396d618fa0b589c22badccd191c096281752797d0c8a0103556c362ac7febda6000403e7bd3f19c08ebe8105f71fb4
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 456B
SHA256 f51806c395847fa73c2e74f4666f2f80dca56e4cfe4d8090465033859a6d8c39
MD5 728101a8bc903155b5c9b2b4d56ec242
SHA1 27639346e20a421a9ce6c24060d0397584579b75
SHA512 3425846651e9821ce2d33fac7e021cc930b9785140a00a195310f487dd94da8f05d42ce724245611f8a4ed6a3fc61b094e13ad55fa35e40ec0e801aa814e385a
TLSH
T1D3F046E0878CB039DB1CF77C64D2550031B64407C0272E129EDAF3B0EB2A3B061741D4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 b5638b78e4fa833ea3429f284b40793a57d10a28fc07b13fa7a45192506c4bad
MD5 b999da20b7f77f3c19af07f056542146
SHA1 bcb982d74a6fa9091bfb0fbb14f6bd400bba9dcb
SHA512 62c06514d72374c44d543a55fc1c1f9c4aab1f6baf67c079d8826ffa275e8d3103b4c1591af4437d4e0ca11fbed12dababb00142538e7fe2a3c0a9bfcb7dcb2b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 5e41d84c08066af287e73b70d8916f5f5dbc4b42fb216dcf053135c69288296a
MD5 c8e70c8c5254fbd43ac1767f06d7ea43
SHA1 49f24d7445cc8daac2ffe585b507cbf092110216
SHA512 e7902964f596741a4d6c84fec6c9fd6b12ddfe20d6201f5844060d63fa9a722c0480bd81a1d915153dde9ec464351db3210e124a0643a4c16c86dbfd1f11bef1
SSDEEP 3:LstlNllkll/lQ5JEtll:LsX3lEtQXEt/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Local State
Size 1KB
SHA256 4ab2d560da69b1b30716d91401f94c975fc35c80326e973e8dd8a3bec5e5b7b5
MD5 69416ea102b005fce1fa14b2e4047978
SHA1 6d32db7d92fa02067bc3f0253dcd401583e28700
SHA512 41b64133c643c11efd80dba192f58148af28ace850e897982695a9372cc906948cb8b27890ea1b17549676b3b2a99566929116c89e848d71f2008e6d4506c1d6
TLSH
T120216576C0EC6F7758996845B2A5BB873E9051B9E1200F0891EF031402E75DCD517C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Local State
Size 1KB
SHA256 51c750e510ce08ab9d1e98699c650033b23cf703204aa96016ca745239782ce0
MD5 a648130d6a0a2a462bb7b675b7ffb233
SHA1 c835fa1557498a4e8fd1cd291d327327c8bb1540
SHA512 1f8fdab923740cf9582db138aca697432a24ca99171f9e709859fee1df6e48ca6fa8df6391a53c99525734f01f7895998eb2854f15fc33af71ef78fca1a3dbb0
TLSH
T1EE316572D0AC6F334CDAA54572E96B577E6150A9E1210F4491FF071802F75CC9516C33
MD5 SHA1 SHA512 TLSH

Submit Download

fb1b7c02-0794-41d4-9531-a5dfe8573dd1.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\fb1b7c02-0794-41d4-9531-a5dfe8573dd1.tmp
Size 2KB
SHA256 09440cde84262208bec299ee244eebb94c4bd4ba894ac3baad59f8e8e8fa7b42
MD5 afb01e10e9dc396bce3ceb29275553b3
SHA1 a3520c1115d09138e6943b575979b7262e65072b
SHA512 00cb7c4a189a90cb03586102fa48f7b1996faa7db2fd2ef7a24749df363d85e8fe7d8e4c77fec0de06e9829ccc63d7e78b3d822f4df8f0bc85a704ad82fa5e0d
TLSH
T1DB51D833A85CAF3789E7994479993F13EE7651A5E2712F9095ED0B1801E76DC2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 41B
SHA256 f7cc307e88b6963287ca334653358b0ea0d519c117a083327ccbb6092e718587
MD5 fa7594cfa6b1dc25c78b047fee195960
SHA1 e0ac91d209d66c46c5f389f765509ab4f474b046
SHA512 e84a70e103f2a4e24a7f025a2f5ebacb365f9b77e6f1154d2f180d731279cb973fab182a2c98e18f7c6dc06de2e03dff9f23549cab9e73c4c2aa04c7cbe6a4f0
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 63B
SHA256 1e8ba86fc3ec05ec3d4f9f9eec2281efbd123f5965a3a397fc1d9695eabce217
MD5 1a0a0e4a77fdb9f175a3a83884197f08
SHA1 a36b4ba790a2fe6dd7b4d2b7238d26c1ca2acaee
SHA512 5eb46066c7003d91fb67e422e9aa3ba05930c76ce65fb1385872d00d185a06d37129161e9d8487fa61768fd1aa3b7118ef9c3f78ec2acca5ce88783ac86fd168
TLSH
T10DA0220CA038003A20BA0822000B20000C000A20C0A00C3F020F80000C8C322223A202
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 89B
SHA256 5c32474f21e1cbdab0283fb71fa2773aa38c5338e7b7aa1415e32dc731d2e0e7
MD5 0a449119b1a63fd91b1edab13579dabf
SHA1 8af4fdea94768f4426c0936f82845c2cb310a4b7
SHA512 e2266e99538d91f776c185cceb759401b03013421437d48f0f0b6d3d3af30c4feff509f8122b226eb49abc1c2dadd4231f59fa922228adda60dd302bb14b7ff7
TLSH
T1EFB0125C5128003B10B50812002A244108458A15A154282A074B4014194D65251B9505
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 159B
SHA256 be6baabc3f7fa5ed862d5cf50167ef5b722ac66b6c9102d2308d3e9fa828368a
MD5 e77b971fbcb8980ae08fb469af7e926a
SHA1 c21825b2700b7a547986d60e35bd289b4142b6d2
SHA512 9188519952cbaae552aafc841150781c2fb3e153ccffbdcc1e87c2f04e1e1bd8f8fce224b058230123bdabb6e03b3cf491dcb382fa7876b5e080770761a87e53
TLSH
T1C1C08C1DC638403720FA040200393A8148A4CE3B959638AA5B27000A190E3436575E2A
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 115B
SHA256 bbc1b196bf920a3e02db763f0ad46c8f82d76f87127a184dcd9ee892316e7da8
MD5 b91b89a5852521ec05fa4e6b00138fce
SHA1 dfbc02433b311b42d8375cb732b627da3277eab3
SHA512 24201fe28e78917d01f13e564165b94849436880b478da10daa5f97ec995e0988ad7867b43917ffdb3041ec76b41c9e1d2b240d369ae77d152ffb40c02f4c47c
TLSH
T152B0126CD778003F30F74817043A358248D58F27F1E83DAA2B5B40182E4F69366B9E09
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 134B
SHA256 a76e3ad941e1ad9e56d3f661b91f9761d50607b418fe0dd20307f09375d0a98f
MD5 8362d2f8ac5fc060cd25efe8df237026
SHA1 1ea69bece5bee3031fae4410051fefd4cc979550
SHA512 a9e80f9decee23379f7052696f47f70be6c3f628b5e01ecfae78203fafb04be632e9ade14329375289e2ed487797c6dfac79fadd8f47eb2291d905eb61a0d1dc
TLSH
T119C02B1CC224403720F304020039358104E4CE27919538D95B170009190E2431574D0D
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.log

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\launcher.log
Size 500B
SHA256 47a7c6907fe3194aed8007415270a5e5097e77ff7660e8181e4d61b3a403099d
MD5 149acb633cee8bce87ede3131a209cfb
SHA1 ff45a1123dcec513d30691bed3308bca87d952a2
SHA512 8f8587e496260e927998e500ce9f1449e2b4a1f75bb5a1e44553c45307fbb4690dd9c97711d8de052b054db49443448ceb1863435ddaf34051170d610685666f
TLSH
T199F02E02A8438EFE02DBE283211F8EBBEC253535E638E0987393D3580848ACE1C12C91
MD5 SHA1 SHA512 TLSH

Submit Download

memory/624-214-0x00007FFEF4B00000-0x00007FFEF4B01000-memory.dmp

Download

memory/3348-86-0x00007FFEF4B00000-0x00007FFEF4B01000-memory.dmp

Download

memory/3776-142-0x00007FFEF5BD0000-0x00007FFEF5BD1000-memory.dmp

Download

memory/3776-143-0x00007FFEF61B0000-0x00007FFEF61B1000-memory.dmp

Download