» EEStartupLauncher.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

EEStartupLauncher.exe

EEStartupLauncher

Robin Hood Software Ltd

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Evidence Eliminator’. This is installed with Evidence Eliminator.

File name:

Publisher:

Robin Hood Software Ltd (signed and verified)

Product:

EEStartupLauncher

Description:

Evidence Eliminator Startup Launcher

Version:

1, 2, 0, 0

MD5:

209b4b9e6b7760deaec30a8a3d54c15c

SHA-1:

3b2c7c93ad6ce21aae6e6ccc2a69bcd3eaa876f1

SHA-256:

d9e26b1061213ed1d259675f3cdd5acfb22965d967729a35e4df0b4f48a65bbf

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/18/2024 11:03:51 PM UTC (a few moments ago)

File size:

20.3 KB (20,800 bytes)

Product version:

1, 2, 0, 0

Trademarks:

Evidence Eliminator (TM)

Original file name:

EEStartupLauncher.exe

File type:

Executable application (Win32 EXE)

Language:

English

Common path:

C:\Program Files\evidence eliminator\eestartuplauncher.exe

Digital Signature

Signed by:

Robin Hood Software Ltd

Authority:

The USERTRUST Network

Valid from:

4/20/2009 1:00:00 AM

Valid to:

4/20/2012 12:59:59 AM

Subject:

CN=Robin Hood Software Ltd, O=Robin Hood Software Ltd, STREET="2nd Floor, 145-157 St John Str", L=London, S=London, PostalCode=EC1v 4PY, C=GB

Issuer:

CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:

00915443F2FED47D777E78D3E457B9893F

File PE Metadata

Compilation timestamp:

11/11/2011 2:20:43 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

192:+mN04mzwzYBbyZrB+a+2jFJJ9OqUpeGy7+eG02eGunH6yMrj6rTOg2YDXDB:jmz888gahjFhGRjOHJMCH

Entry address:

0x14D9

Entry point:

E8, 7A, 04, 00, 00, E9, 37, FD, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 40, 31, 40, 00, 89, 0D, 3C, 31, 40, 00, 89, 15, 38, 31, 40, 00, 89, 1D, 34, 31, 40, 00, 89, 35, 30, 31, 40, 00, 89, 3D, 2C, 31, 40, 00, 66, 8C, 15, 58, 31, 40, 00, 66, 8C, 0D, 4C, 31, 40, 00, 66, 8C, 1D, 28, 31, 40, 00, 66, 8C, 05, 24, 31, 40, 00, 66, 8C, 25, 20, 31, 40, 00, 66, 8C, 2D, 1C, 31, 40, 00, 9C, 8F, 05, 50, 31, 40, 00, 8B, 45, 00, A3, 44, 31, 40, 00, 8B, 45, 04, A3, 48, 31, 40, 00, 8D, 45, 08, A3, 54, 31, 40... 
[+]

Entropy:

5.4541

Code size:

3 KB (3,072 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

Evidence Eliminator

Command:

C:\Program Files2\eviden~1\eestartuplauncher.exe

The file EEStartupLauncher.exe has been discovered within the following program.

Evidence Eliminator by Robin Hood Software Ltd.

The program deletes hidden information from the user's hard drive that normal procedures may fail to delete.

www.evidence-eliminator.com/support.d2w

50% remove it

Scan EEStartupLauncher.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.