EchoTrail

Ashampoo App 2.19.1

by Ashampoo GmbH & Co. KGinstaller signed by Ashampoo GmbH & Co. KGValid

Sources: observed in the EchoTrail lab on Windows 11 on October 27, 2026.

The install

Installer
ashampoo_windows_10_esu_login.exe
Installed through
the screenshot-and-model clicker
Install directory
C:\Program Files\Ashampoo
Launched
AshampooLauncher.exe
Windows
Windows 11
Date
October 27, 2026
Executables dropped
8

installer sha256 ddaebfef269abebbeeca1ae55fa47ef7446600692f119c2854569b683d129d04

The lab used Ashampoo App for 1 minute, changed a setting, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to Ashampoo App's own windows.

Ashampoo App 2.19.1: First window
First window. Ashampoo App shows a 'Log in or register' screen asking for an E-Mail, with a disabled Next button and a language icon at top right.
Ashampoo App 2.19.1: First window
First window. The Ashampoo App login screen is showing with the language dropdown open, listing dansk, Deutsch, English variants and more.

What it dropped

Executables

  • ashampoolauncher.exesigned by E=admins@ashampoo.com, CN=Ashampoo GmbH & Co. KG, O=Ashampoo GmbH & Co. KG, STREET=Schafj�ckenweg 2, L=Rastede, S=Niedersachsen, C=DE, OID.1.3.6.1.4.1.311.60.2.1.1=Oldenburg (Oldenburg), OID.1.3.6.1.4.1.311.60.2.1.2=Niedersachsen, OID.1.3.6.1.4.1.311.60.2.1.3=DE, SERIALNUMBER=HRA 3618, OID.2.5.4.15=Private OrganizationValidran during the lab session
    C:\Program Files\Ashampoo\Ashampoo App\launcher\AshampooLauncher.exe
    sha256 eb8812f0d4e6961b93e36cb583ef3f7432772635f79ba16223fd790868b1b79b
  • ashampooservice.exesigned by E=admins@ashampoo.com, CN=Ashampoo GmbH & Co. KG, O=Ashampoo GmbH & Co. KG, STREET=Schafj�ckenweg 2, L=Rastede, S=Niedersachsen, C=DE, OID.1.3.6.1.4.1.311.60.2.1.1=Oldenburg (Oldenburg), OID.1.3.6.1.4.1.311.60.2.1.2=Niedersachsen, OID.1.3.6.1.4.1.311.60.2.1.3=DE, SERIALNUMBER=HRA 3618, OID.2.5.4.15=Private OrganizationValidran during the lab session
    C:\Program Files\Ashampoo\Ashampoo App\service\AshampooService.exe
    sha256 6f009393979d59f357081d6d11daa770869c8da6595bef0127295361656edb99
  • vc_redist.x64.exesigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValidran during the lab session
    C:\Program Files\Ashampoo\Ashampoo App\redist\VC_redist.x64.exe
    sha256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
  • unins000.exe
    C:\Program Files\Ashampoo\Ashampoo App\unins000.exe
  • e_sqlite3.dll
    C:\Program Files\Ashampoo\Ashampoo App\service\e_sqlite3.dll
  • aspnetcorev2_inprocess.dll
    C:\Program Files\Ashampoo\Ashampoo App\service\aspnetcorev2_inprocess.dll
  • webview2loader.dll
    C:\Program Files\Ashampoo\Ashampoo App\launcher\WebView2Loader.dll
  • webview2loader.dll
    C:\Program Files\Ashampoo\Ashampoo App\launcher\runtimes\win-x64\native\WebView2Loader.dll

Run keys

  • com.ashampoo.app"C:\Program Files\Ashampoo\Ashampoo App\launcher\AshampooLauncher.exe" --hidden

After the reboot

Started on its own

  • ashampoolauncher.exe started by explorer.exe
  • ashampooservice.exe started by ashampoolauncher.exe

Autostart entries

  • run key: com.ashampoo.app"C:\Program Files\Ashampoo\Ashampoo App\launcher\AshampooLauncher.exe" --hidden

What it talked to

Destinations

  • 127.0.0.1:50470asked by ashampoolauncher.exe16 connections
  • 127.0.0.1:57985asked by ashampoolauncher.exe8 connections
  • 63.182.189.227:443asked by ashampooservice.exe2 connections
  • 18.159.17.42:443asked by ashampooservice.exe
  • 3.122.22.96:443asked by 5e09.tmp.tmp
  • 63.181.122.18:443asked by ashampooservice.exe
  • 63.186.25.238:443asked by ashampoo_windows_10_esu_login_47379.exe
  • 63.187.117.144:443asked by ashampoo_windows_10_esu_login_47379.exe
  • 99.84.105.5:443asked by ashampoo_windows_10_esu_login_47379.exe

DNS

  • analytics.data.ashampoo.comasked by ashampooservice.exe
  • gateway.connect.ashampoo.comasked by ashampooservice.exe
  • anon-analytics.data.ashampoo.comasked by ashampoo_windows_10_esu_login_47379.exe
  • cdn1.ashampoo.netasked by ashampoo_windows_10_esu_login_47379.exe
  • et.ashampoo.comasked by 5e09.tmp.tmp
  • linktarget.ashampoo.comasked by 5e09.tmp.tmp
  • www.ashampoo.comasked by ashampoo_windows_10_esu_login_47379.exe