3a8c7ef34090e5a4d08e8c98839c97469f8ade73ef50bd7493e7af45d0ec4208

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
echo-launcher.exe
Size 21.4MB
Sample261018-pre97aba36
SHA256 3a8c7ef34090e5a4d08e8c98839c97469f8ade73ef50bd7493e7af45d0ec4208
MD5 d4c77ad8119741191041154f94bdd9c7
SHA1 f43b2c52788dc3db23d44d9f04da601b7789e9d6
SHA512 8a21347c4f5852d7e2986a1464b5fd61dadebeb70354cab287271941e176a56acbaa0ff19c94348e462517ebed3832f5fd195b6c67a254212d0f84a03c035b4f
SSDEEP 196608:I2unhZDsxk0JFK7J4NXEo30xouThg0AeL1GWDyah8x1jokh7JRXYVKUZXhrdz:xcNsxk0JRNUokGulg031WKQ1skkXhRz
TLSH
T14337D083F79390D9D0AEC47483559533EA33BC99092472AB6B94FB212F3AE505B1D34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	echo-launcher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1900617457\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1900617457\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_616128807\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1900617457\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_616128807\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_616128807\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_616128807\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\echo\URL Protocol	echo-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\echo\DefaultIcon	echo-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\echo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\echo-launcher.exe,0"	echo-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\echo	echo-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\echo\shell\open\command	echo-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\echo\shell	echo-launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\echo\shell\open	echo-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\echo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\echo-launcher.exe\" \"%1\""	echo-launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\echo\ = "URL:org.echofn.launcher protocol"	echo-launcher.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4128	echo-launcher.exe
4128	echo-launcher.exe
4108	msedgewebview2.exe
4108	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4824	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4128	echo-launcher.exe
4128	echo-launcher.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4128	echo-launcher.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4824	4128	echo-launcher.exe	90
PID 4824 wrote to memory of 3372	4824	msedgewebview2.exe	91
PID 4824 wrote to memory of 5108	4824	msedgewebview2.exe	92
PID 4824 wrote to memory of 5108	4824	msedgewebview2.exe	92
PID 4824 wrote to memory of 5108	4824	msedgewebview2.exe	92
PID 4824 wrote to memory of 5108	4824	msedgewebview2.exe	92
PID 4824 wrote to memory of 1960	4824	msedgewebview2.exe	93
PID 4824 wrote to memory of 5572	4824	msedgewebview2.exe	94
PID 4824 wrote to memory of 5572	4824	msedgewebview2.exe	94
PID 4824 wrote to memory of 5572	4824	msedgewebview2.exe	94
PID 4824 wrote to memory of 5904	4824	msedgewebview2.exe	95
PID 4824 wrote to memory of 5904	4824	msedgewebview2.exe	95
PID 4824 wrote to memory of 5904	4824	msedgewebview2.exe	95
PID 4824 wrote to memory of 5904	4824	msedgewebview2.exe	95
PID 4824 wrote to memory of 5904	4824	msedgewebview2.exe	95
PID 4824 wrote to memory of 5704	4824	msedgewebview2.exe	100
PID 4824 wrote to memory of 5704	4824	msedgewebview2.exe	100
PID 4824 wrote to memory of 5704	4824	msedgewebview2.exe	100
PID 4824 wrote to memory of 4276	4824	msedgewebview2.exe	101
PID 4824 wrote to memory of 4276	4824	msedgewebview2.exe	101
PID 4824 wrote to memory of 4276	4824	msedgewebview2.exe	101
PID 4824 wrote to memory of 4108	4824	msedgewebview2.exe	102
PID 4824 wrote to memory of 2196	4824	msedgewebview2.exe	103
PID 4824 wrote to memory of 2196	4824	msedgewebview2.exe	103
PID 4824 wrote to memory of 2196	4824	msedgewebview2.exe	103

C:\Users\Admin\AppData\Local\Temp\echo-launcher.exe
"C:\Users\Admin\AppData\Local\Temp\echo-launcher.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4128.4932.6950455800192068912 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView /prefetch:4 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ff99d4d5fd8,0x7ff99d4d5fe4,0x7ff99d4d5ff0
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1816,i,2941302738521477595,3874841659703338154,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2000 --field-trial-handle=1816,i,2941302738521477595,3874841659703338154,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1816,i,2941302738521477595,3874841659703338154,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3504 --field-trial-handle=1816,i,2941302738521477595,3874841659703338154,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490 /prefetch:1
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1816,i,2941302738521477595,3874841659703338154,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4504 --field-trial-handle=1816,i,2941302738521477595,3874841659703338154,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4492 --field-trial-handle=1816,i,2941302738521477595,3874841659703338154,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView" --webview-exe-name=echo-launcher.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4640 --field-trial-handle=1816,i,2941302738521477595,3874841659703338154,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:dc65984b878f4a034c89a4fe55696c9dff75a490
    3⤵
    PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0bed9093-6457-4205-951a-f48914faccb9.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\0bed9093-6457-4205-951a-f48914faccb9.tmp
Size 15KB
SHA256 7cec5ebca2efce821964389419c76d2e26eb50621e4022eb96ca48408e3c91b6
MD5 c7caa32059d292de9689be8f89cb6b77
SHA1 1ae08b2ea5d9b8da36fb4dce4ba9468bf51ccdbe
SHA512 16cb18bf932be7d583a0b9f590ae70fe88ef375e8a803195bd2a8aefb76bd55b8f817faf13a30d34339ec3c8b0f4a0e6bb5d1cbac4fdc77bf84991c06159b564
SSDEEP 384:M+OBqImmJvGBLx3NaFMJFoNBSwt3j6D6MU5/WvPGg6rIc:tcvGtlNY0FzvPQN
TLSH
T1E872AE7A18756B3328FBC509BA8A37478BA56253C0E27FD9CDFC4F1E11AB0850356D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7258ac2a-89bb-4b9a-9116-4b9eb1d59474.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\7258ac2a-89bb-4b9a-9116-4b9eb1d59474.tmp
Size 3KB
SHA256 120c572f626504b3613a0e09d7d9eaba9a74eaf164ada88d5854cd40bc3c88ad
MD5 b7304a6c58b5f27f38b3399710450a45
SHA1 9abf09e043edd4180a41b53b48b4d1fa5b49453e
SHA512 797d80c7fc16638dacd8a62d29d7f90d7d71a35cb478b5bebc5b930a1319a18bf4e887c7be834d8566162cb5c304f4462250e21a3c02c95067a7aad9968acf24
TLSH
T17161853B9974AA374DE6CA05B9C63B12A7A98063E4953FD9DAEC0F0C01D72DD1345C27
MD5 SHA1 SHA512 TLSH

Submit Download

762d6920-022d-44f3-b8af-80901cfe356d.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\762d6920-022d-44f3-b8af-80901cfe356d.tmp
Size 2KB
SHA256 a6f371c7fe29dfeb0a092dfa576a6bca1f58882297510486900f6d9be105fb08
MD5 80ad007de0c0ba5328511ebe7ed32570
SHA1 c18432dc0a1fd5cf172b854bf75329798489b22e
SHA512 186080ff017651b020d3750ca9df30b2ee73a6ac6494e1d44d6ea65258aef6a9d467f9cce0b3af1cc8f097204101603b1ddae761f9d5e2238e56c234dba377c7
TLSH
T11451B833AC286B3789E68704798B3F139A7C8092E5622F945ADC0F1801D759E2309C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 61417e9dc6be7bef34ea16bef3c1a87ac9c95c0e094c824184c4bc23413edac7
MD5 b7d11913d169fd0a8584d22fa34d2cdc
SHA1 12cfa77bea88f27ebc5cff726532e39345cac36a
SHA512 a7a580702909d31a71d0114de4e2e0585a2796b44f4e65e1f73cd80d40e4a5be3d8b17c2f346c1edffad066356f624a58858ffa92cd8526cb50c2031fc534f30
TLSH
T15FD0121272110634C42036330126614C2801C10F400545406C28952D3F1405409124C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3fbd6b39f62dea898ed7936568c343e59a84db6ac9f15e79c85d088c7bd4e0ee
MD5 7c7bbb31663eb1dc906ebbde66bfa1b4
SHA1 8145daa70e18cf30718d1db4a77d616fa88a05da
SHA512 320378406fc1a1ef88b0838e574c2efea3aa4c5b9f95dae7e0d198e526f4e987b497a90a8dae4a5153a4e7173a99a7b6aeeeaf46239f61698fc6ef3c4963f0ba
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

4a975280-becc-4b58-bbdb-37b397f200ec.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\4a975280-becc-4b58-bbdb-37b397f200ec.tmp
Size 6KB
SHA256 54f0416fb3f45aae7302577d3e0fceed92fd1a3849c7fd2e746da24908b3c45b
MD5 70c3392b445cc4feb2c70cc64eadd9fc
SHA1 9d1e90bc661cd6e1fa5c781a76f0cf2213505e80
SHA512 179fd89431dcbcbfd24a0c95011cef85f42f69a91a085dbe44065a3e2d99626be2fae1b4c0e762d317e252b008774372b1d92dcf9b680b090dd077a870468c5c
SSDEEP 96:stM/d4H6GLb9ukwo5h16Z0ks7/x+6MhmuecJXM1ejerK+gR+28XM1C7K:stAGqfonksV+FdXMQjVz+G6K
TLSH
T198D1A7155E24797B4CCBE519BB267B13D2F9607171E11E98EBF84A2C04EA6CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74ce2015-15d3-407e-9065-55974ae5fc0d.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\74ce2015-15d3-407e-9065-55974ae5fc0d.tmp
Size 6KB
SHA256 b4dfe9bba1b6ff6f298d19a963231175e3a9ce63f04c8b0501c8fa5750fe4c72
MD5 8d41f8ff232b7932356e7c45cf3bdb8b
SHA1 b2e819e3e9838ad1e9b2c590c144ed0606e6ca08
SHA512 82ffb95518954aeb5d93fb3f61975ccd73f5faf8e46e1b42217b78cce249d4fc122304eade80c18ea4c22643864fff995ccb70d6523b97f02b016e7732e7015c
SSDEEP 96:stM/d4HrLb9ukwo5h16Z0ks7/x+6MhmuecJXM1ejerK+gL+28XM1C7K:stAGYfonksV+FdXMQjVd+G6K
TLSH
T131D1C7155E28797B4CCBE509BB257A07E2F9607170D11E98EBF84A2C04E66CC2307907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 456B
SHA256 701b72a1ff331ed1195818723ca08279000a5646b5b98f6aba5fc7340006c515
MD5 37a6005695bbf0306302393a7db0f057
SHA1 571eb91b6a44f6d710f04119f7e6e4ae0754f0c9
SHA512 b0607a7116fb9df0411887fc8ad8c36a3b8bc60271087ac80002b1c12d76102bd83bd778b4a97a2c3ea67a5bbc726b944aab7ce709791d3f3f4915dcb69c5e19
TLSH
T180F02B249A84853CDB5C36F447E385B53131080340B7ED044F2637B0FA62B606571110
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6203b2915f30e102dfe031814c9eeb27ddaa12e0858e381936dfc5f5bd0c245d
MD5 77c03c2db72d29c79ff2fc50440eb7bd
SHA1 5d7bd7656fecb00f48ee7fab4382f6101e371803
SHA512 a069f51605315ac4cb5b170e088150480ac7ce316dcbbb1c8c6f05d091746e64c501f13ae88c62516cb57f0dc8462446aff9a9a8dc2142d5cf776397d76c5c59
MD5 SHA1 SHA512

Submit Download

7730c8e9-8e77-49c4-9deb-9aa034d3fc95.tmp

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Network\7730c8e9-8e77-49c4-9deb-9aa034d3fc95.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.echofn.launcher\EBWebView\Local State
Size 1KB
SHA256 08489d6b834d898891d859c40309df57cfe2ae386fa5a3a37480786bc0a9ee32
MD5 4300c19abc28a7104b1780b690c0e4a0
SHA1 8500b90212edcd253b69009aca27888da0704548
SHA512 ad61a0f9e27f05139f11b1647fb4dd636fde55d010c03db6504480433cdd43e9bae7073c7571a94b4ec872befb7e1e5a79c62050bf20d78b388fb367e7d31bff
TLSH
T1332184B7D8786B33AC86930622973B535D6480A7C1214F4C6AEE0F1902E748EE62DD37
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 41B
SHA256 f7cc307e88b6963287ca334653358b0ea0d519c117a083327ccbb6092e718587
MD5 fa7594cfa6b1dc25c78b047fee195960
SHA1 e0ac91d209d66c46c5f389f765509ab4f474b046
SHA512 e84a70e103f2a4e24a7f025a2f5ebacb365f9b77e6f1154d2f180d731279cb973fab182a2c98e18f7c6dc06de2e03dff9f23549cab9e73c4c2aa04c7cbe6a4f0
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 63B
SHA256 1e8ba86fc3ec05ec3d4f9f9eec2281efbd123f5965a3a397fc1d9695eabce217
MD5 1a0a0e4a77fdb9f175a3a83884197f08
SHA1 a36b4ba790a2fe6dd7b4d2b7238d26c1ca2acaee
SHA512 5eb46066c7003d91fb67e422e9aa3ba05930c76ce65fb1385872d00d185a06d37129161e9d8487fa61768fd1aa3b7118ef9c3f78ec2acca5ce88783ac86fd168
TLSH
T10DA0220CA038003A20BA0822000B20000C000A20C0A00C3F020F80000C8C322223A202
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 89B
SHA256 5c32474f21e1cbdab0283fb71fa2773aa38c5338e7b7aa1415e32dc731d2e0e7
MD5 0a449119b1a63fd91b1edab13579dabf
SHA1 8af4fdea94768f4426c0936f82845c2cb310a4b7
SHA512 e2266e99538d91f776c185cceb759401b03013421437d48f0f0b6d3d3af30c4feff509f8122b226eb49abc1c2dadd4231f59fa922228adda60dd302bb14b7ff7
TLSH
T1EFB0125C5128003B10B50812002A244108458A15A154282A074B4014194D65251B9505
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 159B
SHA256 be6baabc3f7fa5ed862d5cf50167ef5b722ac66b6c9102d2308d3e9fa828368a
MD5 e77b971fbcb8980ae08fb469af7e926a
SHA1 c21825b2700b7a547986d60e35bd289b4142b6d2
SHA512 9188519952cbaae552aafc841150781c2fb3e153ccffbdcc1e87c2f04e1e1bd8f8fce224b058230123bdabb6e03b3cf491dcb382fa7876b5e080770761a87e53
TLSH
T1C1C08C1DC638403720FA040200393A8148A4CE3B959638AA5B27000A190E3436575E2A
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 115B
SHA256 bbc1b196bf920a3e02db763f0ad46c8f82d76f87127a184dcd9ee892316e7da8
MD5 b91b89a5852521ec05fa4e6b00138fce
SHA1 dfbc02433b311b42d8375cb732b627da3277eab3
SHA512 24201fe28e78917d01f13e564165b94849436880b478da10daa5f97ec995e0988ad7867b43917ffdb3041ec76b41c9e1d2b240d369ae77d152ffb40c02f4c47c
TLSH
T152B0126CD778003F30F74817043A358248D58F27F1E83DAA2B5B40182E4F69366B9E09
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\config.json
Size 134B
SHA256 a76e3ad941e1ad9e56d3f661b91f9761d50607b418fe0dd20307f09375d0a98f
MD5 8362d2f8ac5fc060cd25efe8df237026
SHA1 1ea69bece5bee3031fae4410051fefd4cc979550
SHA512 a9e80f9decee23379f7052696f47f70be6c3f628b5e01ecfae78203fafb04be632e9ade14329375289e2ed487797c6dfac79fadd8f47eb2291d905eb61a0d1dc
TLSH
T119C02B1CC224403720F304020039358104E4CE27919538D95B170009190E2431574D0D
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.log

Path C:\Users\Admin\AppData\Roaming\org.echofn.launcher\launcher.log
Size 500B
SHA256 ca1a53a158b56ef836dce6b483b39120e5c3b198077763879912525b41318d5a
MD5 79cc3daa56820f8cab87909fa34f7968
SHA1 3a146f1da70744981d823142ded106c7a34a1681
SHA512 d9e286711a050f85facc5d1be3bf1cbfe766c410c1f306079ebcda2321ae2cab239614abe7fb850b395d0f17df8443848dee868b1b2b4cecbdfe75053bf91b5a
TLSH
T109F0E246E8429FBE05D7D283211EACBBFD253579E778E0583713D728184A8CE1812CD1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1321776634\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_1900617457\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4824_616128807\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4108-427-0x00000240EBE50000-0x00000240EBE51000-memory.dmp

Download

memory/4108-416-0x00000240EBE50000-0x00000240EBE51000-memory.dmp

Download

memory/4108-418-0x00000240EBE50000-0x00000240EBE51000-memory.dmp

Download

memory/4108-425-0x00000240EBE50000-0x00000240EBE51000-memory.dmp

Download

memory/4108-423-0x00000240EBE50000-0x00000240EBE51000-memory.dmp

Download

memory/4108-424-0x00000240EBE50000-0x00000240EBE51000-memory.dmp

Download

memory/4108-422-0x00000240EBE50000-0x00000240EBE51000-memory.dmp

Download

memory/4108-426-0x00000240EBE50000-0x00000240EBE51000-memory.dmp

Download

memory/5108-276-0x0000027D82570000-0x0000027D82643000-memory.dmp

Download

memory/5108-27-0x00007FF9BD6C0000-0x00007FF9BD6C1000-memory.dmp

Download

memory/5704-343-0x00007FF9BE960000-0x00007FF9BE961000-memory.dmp

Download

memory/5704-342-0x00007FF9BDCD0000-0x00007FF9BDCD1000-memory.dmp

Download

memory/5904-112-0x00007FF9BD6C0000-0x00007FF9BD6C1000-memory.dmp

Download