Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    116s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    24/03/2023, 12:21

General

  • Target

    apowermirror-setup-gg-b.exe

  • Size

    1.9MB

  • MD5

    95f99a7a6ee16bdcc0a8fe120116d7d7

  • SHA1

    ccdb752544c3b1c3cb12319374a3fd0807f2585e

  • SHA256

    7999a1eb0af8b4448598c1e3ace49eaa44cbe2b6266a63e19077e3fb9608c40c

  • SHA512

    de20942292e8e0fcf613d1f3c0eee504fd1426e3cfe8e1a92ae0f207e3b7bc4fbd8a78ee121fec94a7e7fe534bfe4b40a93b11a59d8473222d8bc66ec90e69d8

  • SSDEEP

    49152:myIO6XrnRNm5zuXp7jRG6wLvSpDiTEO3xTuDB14:XIOqrRXG6wL603d

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 1 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 16 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 38 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\apowermirror-setup-gg-b.exe
    "C:\Users\Admin\AppData\Local\Temp\apowermirror-setup-gg-b.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Users\Admin\AppData\Local\Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\installer.exe" /VERYSILENT /SUPPRESSMSGBOXES /FORCECLOSEAPPLICATIONS /DIR="C:\Program Files (x86)\Apowersoft\ApowerMirror" /LANG=Spanish
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Users\Admin\AppData\Local\Temp\is-C0SSK.tmp\installer.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-C0SSK.tmp\installer.tmp" /SL5="$80186,133368584,912896,C:\Users\Admin\AppData\Local\Temp\installer.exe" /VERYSILENT /SUPPRESSMSGBOXES /FORCECLOSEAPPLICATIONS /DIR="C:\Program Files (x86)\Apowersoft\ApowerMirror" /LANG=Spanish
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4304
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-UE7D7.tmp\KillProcessWithName.bat" "ApowerMirror.exe""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4152
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c tasklist | find "ApowerMirror.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:976
            • C:\Windows\SysWOW64\find.exe
              find "ApowerMirror.exe"
              6⤵
                PID:4492
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:4748
          • C:\Windows\SysWOW64\taskkill.exe
            "C:\Windows\system32\taskkill.exe" /f /t /im "ApowersoftAndroidDaemon.exe"
            4⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4888
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-UE7D7.tmp\KillProcessWithName.bat" "ApowerMirror.exe""
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4164
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c tasklist | find "ApowerMirror.exe"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:492
              • C:\Windows\SysWOW64\find.exe
                find "ApowerMirror.exe"
                6⤵
                  PID:2492
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4508
            • C:\Windows\SysWOW64\taskkill.exe
              "C:\Windows\system32\taskkill.exe" /f /t /im "ApowersoftAndroidDaemon.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1996
            • C:\Windows\SysWOW64\msiexec.exe
              "msiexec.exe" /i "C:\Program Files (x86)\Apowersoft\ApowerMirror\Bonjour64.msi" /quiet
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2512
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="ApowerMirror" program="C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe"
              4⤵
              • Modifies Windows Firewall
              PID:4980
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="ApowerMirror" dir=in action=allow program="C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:4300
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="ApowerMirror" dir=out action=allow program="C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe" enable=yes
              4⤵
              • Modifies Windows Firewall
              PID:3876
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://r.aoscdn.com/jumper?type=install&product_id=113&language=es&unique_id=17f90d5c5848880bf67f358fee7e06d3&apptype=ads-gg-b&appver=1.7.21.4&first_install_ts=1679664177&ts=1679664177&wxga=&ct=1677161727&mt=1677161727&h=95f99a7a6ee16bdcc0a8fe120116d7d7&hash=44876332da9ca9f66f456f09f8d523ca
          2⤵
          • Loads dropped DLL
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1900
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8ad5546f8,0x7ff8ad554708,0x7ff8ad554718
            3⤵
              PID:4332
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
              3⤵
                PID:2448
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
                3⤵
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                PID:3056
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
                3⤵
                  PID:5004
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
                  3⤵
                    PID:2320
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
                    3⤵
                      PID:3036
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
                      3⤵
                        PID:4436
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
                        3⤵
                          PID:3520
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
                          3⤵
                            PID:4080
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
                            3⤵
                              PID:4576
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                              3⤵
                              • Drops file in Program Files directory
                              PID:3216
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7f4f95460,0x7ff7f4f95470,0x7ff7f4f95480
                                4⤵
                                  PID:2272
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4108
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
                                3⤵
                                  PID:556
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
                                  3⤵
                                    PID:4368
                              • C:\Windows\system32\msiexec.exe
                                C:\Windows\system32\msiexec.exe /V
                                1⤵
                                • Blocklisted process makes network request
                                • Registers COM server for autorun
                                • Enumerates connected drives
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                • Drops file in Windows directory
                                • Modifies data under HKEY_USERS
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:3488
                                • C:\Windows\System32\MsiExec.exe
                                  C:\Windows\System32\MsiExec.exe -Embedding E6A8213314B4A78C7B39ACA20BE68770
                                  2⤵
                                  • Loads dropped DLL
                                  PID:1660
                                • C:\Windows\syswow64\MsiExec.exe
                                  C:\Windows\syswow64\MsiExec.exe -Embedding 802CB92A9A0BE89ED4163467DDD75CA4
                                  2⤵
                                  • Loads dropped DLL
                                  PID:4032
                                • C:\Windows\syswow64\MsiExec.exe
                                  C:\Windows\syswow64\MsiExec.exe -Embedding BA731A6441DB117A2E2A1BC96455F9D0 E Global\MSI0000
                                  2⤵
                                  • Loads dropped DLL
                                  PID:4080
                                • C:\Windows\System32\MsiExec.exe
                                  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"
                                  2⤵
                                  • Loads dropped DLL
                                  PID:2788
                                • C:\Windows\syswow64\MsiExec.exe
                                  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"
                                  2⤵
                                  • Loads dropped DLL
                                  PID:976
                              • C:\Program Files\Bonjour\mDNSResponder.exe
                                "C:\Program Files\Bonjour\mDNSResponder.exe"
                                1⤵
                                • Modifies firewall policy service
                                • Executes dropped EXE
                                PID:1192
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:1432
                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe
                                  "C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe"
                                  1⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  • Checks SCSI registry key(s)
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2164
                                  • C:\Windows\SysWOW64\netstat.exe
                                    netstat.exe -aon
                                    2⤵
                                    • Gathers network information
                                    PID:1776
                                  • C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowersoftAndroidDaemon.exe
                                    adb -L tcp:5037 fork-server server
                                    2⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:1372
                                  • C:\Windows\SysWOW64\netstat.exe
                                    netstat.exe -aon
                                    2⤵
                                    • Gathers network information
                                    PID:2728

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Config.Msi\e576bbc.rbs

                                  Filesize

                                  126KB

                                  MD5

                                  ed1000dd31854c65ffe80dcc0319eb84

                                  SHA1

                                  f79ce68ebee1151280ce71e00f00af79a8e15a1c

                                  SHA256

                                  9e4d07676afde9e7e271c646ade1457448e818930679dbceca78022927539fba

                                  SHA512

                                  802648f4a08e403deb6b1f2000208d7fe8faab58664e5adca7aafe50d28d4b8670bc2ab46e4c9dfeb88715ff43b4c2ccf5ccb612f3870e1120a26440b7126726

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe

                                  Filesize

                                  10.3MB

                                  MD5

                                  480bcbfd7d00480eac1fe7cdad928c44

                                  SHA1

                                  a56788852992ee6ab71ffe6a15c18ae967ccc203

                                  SHA256

                                  6cb5d78ed9b22f9d3c7c2215c70f57d5024962175d84011bd9590e4318f2d80f

                                  SHA512

                                  0a7443fe1f55ded9a23df592da5bbb541cce459aef15c830805d3f48c73dcc8412ec18ff93531173da18927134fcdd6047661a4af3d5f55e843f25d1e3f5fb90

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe

                                  Filesize

                                  10.3MB

                                  MD5

                                  480bcbfd7d00480eac1fe7cdad928c44

                                  SHA1

                                  a56788852992ee6ab71ffe6a15c18ae967ccc203

                                  SHA256

                                  6cb5d78ed9b22f9d3c7c2215c70f57d5024962175d84011bd9590e4318f2d80f

                                  SHA512

                                  0a7443fe1f55ded9a23df592da5bbb541cce459aef15c830805d3f48c73dcc8412ec18ff93531173da18927134fcdd6047661a4af3d5f55e843f25d1e3f5fb90

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe

                                  Filesize

                                  10.3MB

                                  MD5

                                  480bcbfd7d00480eac1fe7cdad928c44

                                  SHA1

                                  a56788852992ee6ab71ffe6a15c18ae967ccc203

                                  SHA256

                                  6cb5d78ed9b22f9d3c7c2215c70f57d5024962175d84011bd9590e4318f2d80f

                                  SHA512

                                  0a7443fe1f55ded9a23df592da5bbb541cce459aef15c830805d3f48c73dcc8412ec18ff93531173da18927134fcdd6047661a4af3d5f55e843f25d1e3f5fb90

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe.config

                                  Filesize

                                  1KB

                                  MD5

                                  7aded013c74be010099ce8aa161b1e23

                                  SHA1

                                  f5052c44c3e0d184ce9d401acdadee6e5c16803a

                                  SHA256

                                  b4de84a6088db0f6b34b77f4819dc6c1b7f8ccceb65c33b2648706ec4f03272b

                                  SHA512

                                  2d36182b68287f8c0778bfcb413200fc7bf90f5b3cfd1d7ade3779440c235ec19799a6a489a659c2e8b85b13401f6bd4d4a724f688bde780f8f3c86b658ec950

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Bonjour64.msi

                                  Filesize

                                  2.6MB

                                  MD5

                                  86e2b390629665fbc20e06dfbf01a48f

                                  SHA1

                                  d9f4697a6f4eceea24735822cb1df501268ca0b0

                                  SHA256

                                  46e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1

                                  SHA512

                                  05ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\AssistiveTouchTutoralHelp\.history\is-JEOLD.tmp

                                  Filesize

                                  1KB

                                  MD5

                                  a9306e38bb978bdd36b26d5c0e68fa06

                                  SHA1

                                  4b80f8c1306f4d5687d51fd30e9513a73efca264

                                  SHA256

                                  268fa650496a2d20c9a8d08719da6737a85b88b7f9549f8fa60e2aa2264c4c86

                                  SHA512

                                  82c87405cfa58c383e7472857ba9e5eff9f90b075b2eb26cc4b99ab11cc042a06a9c385facb2918685e047215573233b30a75c6d0d93d9fb8617f23262c2f673

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files-de\is-R1KTC.tmp

                                  Filesize

                                  1KB

                                  MD5

                                  3170ba902ea3b748103fd662b5742a6e

                                  SHA1

                                  ee7761919f609a2c6ac56c42e8f02f4c819fdcf4

                                  SHA256

                                  79df254f3f3afaf1861aefae760dd70f4fe6c507909ca3ba3724479eab861e29

                                  SHA512

                                  59034eb406e954f72ab09a022ccd53d2c5569fc425aacb64eccfdfffb75554956654e74472824c3e1bcc96b72ff0e530611e24ba57d11bc9ecd8f05aadf2fe26

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files-es\is-5759T.tmp

                                  Filesize

                                  1KB

                                  MD5

                                  5d3b2a67c313c3ae6ccd130e546e0959

                                  SHA1

                                  d9188b2b6a3724edd4c5b9da0c8f22047183c913

                                  SHA256

                                  bd122717680d42e7287aa0ed55fe37e3652fd45553232ac4c8f0c7d5ee3fa3ff

                                  SHA512

                                  16c2339f79aeb3a64cdbb9e0d2a4eeb42b7afc70c3e4865dfcb71d0ca86c2617f63b159514bbcf414f4b982fb46800e68dd151ebfd210c390f792b90f85c2e51

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files-es\is-9E79U.tmp

                                  Filesize

                                  102KB

                                  MD5

                                  cda0a264757834dca56a62422bbc8262

                                  SHA1

                                  822eb6f338a080ab3d5fa6aa57ad06cf652f1edf

                                  SHA256

                                  1499087f081f31a4910780b87f65b98fdb51eecf9bf171b4a1ad5db87adb4c5e

                                  SHA512

                                  8e95a584ba5a1940f139cf7ee258e6a64174c70bb934988309f854d64a59289c7de2a7a56803f39036017c49330c30eee1580cad1eb069c157183a10f9dd4be5

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files-es\is-A3OKB.tmp

                                  Filesize

                                  770B

                                  MD5

                                  be27f3cf33ce1536dd46fc784df02fc4

                                  SHA1

                                  a357666525f3ea5c84c985c116987f1f2bd4f7c7

                                  SHA256

                                  2b9b9e61373f72d2efb6a503120a96992e74c91cf5398dfd4e534481823045e7

                                  SHA512

                                  0faf1840dcae7dd071282b120e452a8571d81f637fa067b804c56de22d3084eb247df3f454607012eb3b5338f5e8bf5eae6ccad9ebaa9437c6a9cf28caca067a

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files-es\is-JVP44.tmp

                                  Filesize

                                  1KB

                                  MD5

                                  49d080badfcb3cb76958257c14c5bf92

                                  SHA1

                                  c44163514205ccac0edad80bd5d7d55032f8c64b

                                  SHA256

                                  3ad5ac1a6cc6b84f5e45068396999592031d3de3d9111f932405257a727f96ad

                                  SHA512

                                  6b7723b8054cad74abbfc6582e131a1da9f12f85b726c13ec2cfa1cfae7d6d47d91b6436cfb40f6d6994782805de0ea770570de834ccc7dae57350df03097d3a

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files-es\is-LOHH8.tmp

                                  Filesize

                                  267B

                                  MD5

                                  78f36b85d4d4a1c5b5132a79f6539dc1

                                  SHA1

                                  08787dd0252ed15e74d6474672d4fdcea3772b00

                                  SHA256

                                  c176760f862ef58c6339ff497740d17f439cd3f1105af3de4aad60c164a72a2f

                                  SHA512

                                  093a78c1980a108a63350b2410bf786720b07887b9cfd23d1e8e2567fdf19d48fe827f944e9a46fd9b2bb6127e85a018dcdcf656e968fb9dc9c5b8576f493b3b

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files-es\is-RFO7A.tmp

                                  Filesize

                                  489B

                                  MD5

                                  bf09951f73abf4a8eb88a9adc3f4405c

                                  SHA1

                                  b93f8f73ef7cca09f9b63955b3b384caa3112e77

                                  SHA256

                                  7cface45764acf3d93cac17965a001471e23944323ccf0e01a30972e7e511370

                                  SHA512

                                  90197bf55cec02c183aa4e9f5d2af2c44e9daa672fde40fdcbdf4186386ece85ffc4e8f3ad0c60c07acb582e6c35195f93f44fd174476e752e495e7c6c9517c5

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files\is-ICECQ.tmp

                                  Filesize

                                  823B

                                  MD5

                                  2b3bb5f256bfa0ddd73c349e8ae20310

                                  SHA1

                                  3d356b0ce64198ca8419cdbcb25fc93fe5adb136

                                  SHA256

                                  e115de560e98872f17e271d713a4daf1a18a745071c960e1139e136ba184862f

                                  SHA512

                                  ad64614fd47d99219f7631734c1482a899a2f3c648073312e3320b15f35faf57c40267f29c123c59c7d9021ca098b9fd8463201d6706faf7cf9a16989df7ca4e

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files\is-T26P8.tmp

                                  Filesize

                                  245B

                                  MD5

                                  3cd8b19ba2796cf3310d8b592cb76e5d

                                  SHA1

                                  0e26f535cfecf6ccceb919df514ccd3e80e21325

                                  SHA256

                                  339f6d2288fa6822c28b412f067ad8ce81c076a8d55af8c1390e0ed9b4f465d5

                                  SHA512

                                  ee7af0ca8673a0d3c6690c94755fd35f6b59c6d9544881f1b4c946a5ca921bd6f1b4f387ed4134c39b00dba0dd950c1f13bb71a6c9d829a8d858688b66158268

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MI-SUB_files\is-MTD8D.tmp

                                  Filesize

                                  1KB

                                  MD5

                                  bd4d726d4da8ce648fe5a3e99b1d94d6

                                  SHA1

                                  6336759301cd5642fa1c703cd86c5c65db1fdfba

                                  SHA256

                                  9705566585f3a57968483fa6e2455ca5c144d360ca6069305d1bb086cc4c6d9d

                                  SHA512

                                  497a12f53adfdbf46b02178e0d5a03782a6cf3051d32b8f24e21d8fdfb364214d62129a2fb7efb36dafe32458d0e3324ec38f6fa10c9c79ec9503a1b69ce6022

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MI_files\is-KCADF.tmp

                                  Filesize

                                  615B

                                  MD5

                                  df069a5a885a1bbea3339d9efa9f91c7

                                  SHA1

                                  c5ade3a1af4d2e2cd57ff2a33928a6c75ca59437

                                  SHA256

                                  235d7b4ab38274e7ead460ece92cfd9ea1c2502a2abfd2d9b8ca544b4c9f7797

                                  SHA512

                                  ac47adccb1d3fdcb6a71e4739a8c438de8e2855d67e03a4b0a8ffc63f2ebfa02b4ab011fe683de9dee3675ca30f04258c9905f116a5d9c87b106a4975241e63a

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\OnePlus_files\is-4BB47.tmp

                                  Filesize

                                  281B

                                  MD5

                                  4d392a0946827656c57745fb43432df3

                                  SHA1

                                  eb9d0aec190d4018cb117a89826d706a5b9c47f1

                                  SHA256

                                  d815dc663d3004ea75ca6d19be08b792658ff055a8fb580380c249ed996b9957

                                  SHA512

                                  4a007ab0f2e33bd41bb0ed4d57fc5a2c8216bc9eba3495c88c38a97d0fd2f8fb8afc230b366df33b14aece1b15325416e26c9cf966b3032da350f74fd4ea8d9f

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\VIVO_files\is-N3AV0.tmp

                                  Filesize

                                  267B

                                  MD5

                                  91c10ed1537ae6251380c0f8aa59ddff

                                  SHA1

                                  0438fffbbc81e6cd9660ffd80af2b772e3cce081

                                  SHA256

                                  0763f6aa9c7f4b2d3bcd86242f44068c9adc63c95d4754597aac797f1d1e1324

                                  SHA512

                                  adc7d2d1c3a748ff533e55d9378cc43578791a2807b1ee25411f465b11938725bca7287f2622abccb70fc4a065a31c387bc7dae78004b6620ef1e0b92199bc01

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\LIBEAY32.dll

                                  Filesize

                                  1.3MB

                                  MD5

                                  22277c5bcba6da2a6e4092cbc517ce59

                                  SHA1

                                  10d2e327123973b00f80258458c453eaaccb68e3

                                  SHA256

                                  e24cc86d09c27e2b365913a662181636292381eb74daebe8400da4079eb0bc94

                                  SHA512

                                  8fb887b1f6d24348c281590aaef489a772a253589f275d894b59250eed408ee6453118d454817d02ac1f7023d11904724e1872018a3a1ad9a0a5b542aaa42007

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\WXMedia.dll

                                  Filesize

                                  2.6MB

                                  MD5

                                  8e4a6e33762f41cfb4033e7bf9005cb6

                                  SHA1

                                  3f209562ed82a5a57abbcf0b2e10aa46a9200448

                                  SHA256

                                  28200a3561d896b8a32887bd081a040ec3f74e534f4e79bffd2094e3f9069f65

                                  SHA512

                                  823f5a04f22c8889564fffa3865fb84a3cb49585c3a79cdea7487ad34ade5d6616a4819b6e3d8591f808a6fec6b4e2e986dfd77e222bd86faaef678277c443a2

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\WXMedia.dll

                                  Filesize

                                  2.6MB

                                  MD5

                                  8e4a6e33762f41cfb4033e7bf9005cb6

                                  SHA1

                                  3f209562ed82a5a57abbcf0b2e10aa46a9200448

                                  SHA256

                                  28200a3561d896b8a32887bd081a040ec3f74e534f4e79bffd2094e3f9069f65

                                  SHA512

                                  823f5a04f22c8889564fffa3865fb84a3cb49585c3a79cdea7487ad34ade5d6616a4819b6e3d8591f808a6fec6b4e2e986dfd77e222bd86faaef678277c443a2

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\d3dx9_43.dll

                                  Filesize

                                  1.9MB

                                  MD5

                                  86e39e9161c3d930d93822f1563c280d

                                  SHA1

                                  f5944df4142983714a6d9955e6e393d9876c1e11

                                  SHA256

                                  0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f

                                  SHA512

                                  0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\libairplay.dll

                                  Filesize

                                  936KB

                                  MD5

                                  d1bb2c4947c150a5922f8d2530a978a0

                                  SHA1

                                  ed34ac4453795e583c3c210853fa20a229280fdc

                                  SHA256

                                  7c5456772c1feb74850ef6ce914d98713fa9cc0be8552423f23b4a3ad9f9956b

                                  SHA512

                                  aa0cec8804d9e5505b6ddad65b0f022a6b8e123d3483ef918e5e40f21b081f849452dde39ede836ec282efc6b2d671269aae9764c19a446f445469057b72a9ce

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\libairplay.dll

                                  Filesize

                                  936KB

                                  MD5

                                  d1bb2c4947c150a5922f8d2530a978a0

                                  SHA1

                                  ed34ac4453795e583c3c210853fa20a229280fdc

                                  SHA256

                                  7c5456772c1feb74850ef6ce914d98713fa9cc0be8552423f23b4a3ad9f9956b

                                  SHA512

                                  aa0cec8804d9e5505b6ddad65b0f022a6b8e123d3483ef918e5e40f21b081f849452dde39ede836ec282efc6b2d671269aae9764c19a446f445469057b72a9ce

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\libeay32.dll

                                  Filesize

                                  1.3MB

                                  MD5

                                  22277c5bcba6da2a6e4092cbc517ce59

                                  SHA1

                                  10d2e327123973b00f80258458c453eaaccb68e3

                                  SHA256

                                  e24cc86d09c27e2b365913a662181636292381eb74daebe8400da4079eb0bc94

                                  SHA512

                                  8fb887b1f6d24348c281590aaef489a772a253589f275d894b59250eed408ee6453118d454817d02ac1f7023d11904724e1872018a3a1ad9a0a5b542aaa42007

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\libffmpeg.dll

                                  Filesize

                                  28.6MB

                                  MD5

                                  0e4557ff6284c74f2096cf8c70210935

                                  SHA1

                                  b4caba3b509707767a8b5ff5901c4827c5f698c3

                                  SHA256

                                  423b897bd250df587d75a411c867d313529f16307120b2c0b0d90663066d0c7f

                                  SHA512

                                  ac3d32246bfbe7c33bfde9d1b7dffc5ccc755d4866c1939f03f34511c1acdc2621c9bd361c24db0275e68a6add69a1c72af2ea7eb12ab45906b662c9eb19b8c5

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\libffmpeg.dll

                                  Filesize

                                  28.6MB

                                  MD5

                                  0e4557ff6284c74f2096cf8c70210935

                                  SHA1

                                  b4caba3b509707767a8b5ff5901c4827c5f698c3

                                  SHA256

                                  423b897bd250df587d75a411c867d313529f16307120b2c0b0d90663066d0c7f

                                  SHA512

                                  ac3d32246bfbe7c33bfde9d1b7dffc5ccc755d4866c1939f03f34511c1acdc2621c9bd361c24db0275e68a6add69a1c72af2ea7eb12ab45906b662c9eb19b8c5

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\libplist.dll

                                  Filesize

                                  175KB

                                  MD5

                                  681c4f68020521ae38ce6998fdfbf09a

                                  SHA1

                                  36253533c1fdab1bece8bf8cdae5da28d585538e

                                  SHA256

                                  d25a1aa4a8bbab4fb7e6216b648b073d18b8e668f7f10e2390dd6204d504a2f4

                                  SHA512

                                  fd16b07c160ca484a1d3ab13185bfe9fcd124e219d4a6d314e5882c070c7575ece0c31e3049c84432e49641b52ef199872668c526e2fdc4c0641e8e5b4ae04c2

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\libplist.dll

                                  Filesize

                                  175KB

                                  MD5

                                  681c4f68020521ae38ce6998fdfbf09a

                                  SHA1

                                  36253533c1fdab1bece8bf8cdae5da28d585538e

                                  SHA256

                                  d25a1aa4a8bbab4fb7e6216b648b073d18b8e668f7f10e2390dd6204d504a2f4

                                  SHA512

                                  fd16b07c160ca484a1d3ab13185bfe9fcd124e219d4a6d314e5882c070c7575ece0c31e3049c84432e49641b52ef199872668c526e2fdc4c0641e8e5b4ae04c2

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\libxml2.dll

                                  Filesize

                                  3.9MB

                                  MD5

                                  b699e92259e963082f2d8b527a9d49a7

                                  SHA1

                                  d0f6c40e367b3940957fa9c523e94485079218fe

                                  SHA256

                                  32783c830a311429f6e6469c5fab9456d2ad65b13cadfc6578dba858becf2e1f

                                  SHA512

                                  fed1e538eac049e60a6614bac107db3c65a9145d4d2138aad3da026a574f6035e8926c88e619790b29fcae0f6510aa6a044de2af291ea822f11b5d90a1b6fa81

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\libxml2.dll

                                  Filesize

                                  3.9MB

                                  MD5

                                  b699e92259e963082f2d8b527a9d49a7

                                  SHA1

                                  d0f6c40e367b3940957fa9c523e94485079218fe

                                  SHA256

                                  32783c830a311429f6e6469c5fab9456d2ad65b13cadfc6578dba858becf2e1f

                                  SHA512

                                  fed1e538eac049e60a6614bac107db3c65a9145d4d2138aad3da026a574f6035e8926c88e619790b29fcae0f6510aa6a044de2af291ea822f11b5d90a1b6fa81

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\log.xml

                                  Filesize

                                  657B

                                  MD5

                                  cacd85a493cb94b685b1ae9ed9057bff

                                  SHA1

                                  d2ba370521cfb5305d563197ee8052590fbe601d

                                  SHA256

                                  e432cb999303253092c4eb66ed4aec503e9eea02c371e11a9b9f7425f8b80719

                                  SHA512

                                  a327ffc4694632a0db83848e661a41960fa7f074247c477cf08e80564adc7b6d238d71c9770cc04dd18ec9293c259f701d029df73c6e8a64f8fd60165d157a39

                                • C:\Program Files (x86)\Apowersoft\ApowerMirror\unins000.exe

                                  Filesize

                                  2.6MB

                                  MD5

                                  da481f3e7a22e87b4b2df68e286482f2

                                  SHA1

                                  5bb7d4b848f7c7d22c78587242c54d70ea678c23

                                  SHA256

                                  f33068093c66976ebcdf3babef6397c15c5ed58c39c19b74a971178d341cc03e

                                  SHA512

                                  64564ef5a5f8a676677a0c908f50187dfa29b0497eab2d0d95520ee3e8ad8188441234f1418ceb8a015534a0550b381813cc90e8509d59d4a7268702afc2d1cd

                                • C:\Program Files (x86)\Bonjour\mDNSResponder.exe

                                  Filesize

                                  381KB

                                  MD5

                                  5ea9c80f18cbc393ea7d9a2991ded4b5

                                  SHA1

                                  b8917c5ae45d1ba5ca534058f1386fac92f5da63

                                  SHA256

                                  7e5eb1ce44febe93686174058d51581fa00bdff0ebb84bd74bc08f6386019253

                                  SHA512

                                  7fd949b792a40630ca385dd2bc88db9673f9106975b9f55481e2382f67986dd75b03cdf0fbf59846b513a8def0c506ac6561f6ba658775286f11d761b575513a

                                • C:\Program Files (x86)\Bonjour\mdnsNSP.dll

                                  Filesize

                                  119KB

                                  MD5

                                  f6d02735de16705c1ebe6429592cd355

                                  SHA1

                                  c6ee693de2c01cad34012471b70d87869969a0cb

                                  SHA256

                                  356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4

                                  SHA512

                                  1e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13

                                • C:\Program Files (x86)\Bonjour\mdnsNSP.dll

                                  Filesize

                                  119KB

                                  MD5

                                  f6d02735de16705c1ebe6429592cd355

                                  SHA1

                                  c6ee693de2c01cad34012471b70d87869969a0cb

                                  SHA256

                                  356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4

                                  SHA512

                                  1e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13

                                • C:\Program Files (x86)\Bonjour\mdnsNSP.dll

                                  Filesize

                                  119KB

                                  MD5

                                  f6d02735de16705c1ebe6429592cd355

                                  SHA1

                                  c6ee693de2c01cad34012471b70d87869969a0cb

                                  SHA256

                                  356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4

                                  SHA512

                                  1e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13

                                • C:\Program Files (x86)\Bonjour\mdnsNSP.dll

                                  Filesize

                                  119KB

                                  MD5

                                  f6d02735de16705c1ebe6429592cd355

                                  SHA1

                                  c6ee693de2c01cad34012471b70d87869969a0cb

                                  SHA256

                                  356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4

                                  SHA512

                                  1e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13

                                • C:\Program Files\Bonjour\mDNSResponder.exe

                                  Filesize

                                  451KB

                                  MD5

                                  b5c2f92ee1106dfe7bb1cce4d35b6037

                                  SHA1

                                  31070ef84c5355b082873ffc19ff60659637995f

                                  SHA256

                                  e399c390687589194d8aad385055f0cfa7d52ad9e837d8ff95008b8eb2b34e50

                                  SHA512

                                  7f82752b271ee35bad31a8571ae33b8cc83ef48f41937297dfc446f6f9b12da3d8b8336a527f6bbc5bc3c6627deadbd38a5f109b16c7d1386a3db36742c5a9c7

                                • C:\Program Files\Bonjour\mDNSResponder.exe

                                  Filesize

                                  451KB

                                  MD5

                                  b5c2f92ee1106dfe7bb1cce4d35b6037

                                  SHA1

                                  31070ef84c5355b082873ffc19ff60659637995f

                                  SHA256

                                  e399c390687589194d8aad385055f0cfa7d52ad9e837d8ff95008b8eb2b34e50

                                  SHA512

                                  7f82752b271ee35bad31a8571ae33b8cc83ef48f41937297dfc446f6f9b12da3d8b8336a527f6bbc5bc3c6627deadbd38a5f109b16c7d1386a3db36742c5a9c7

                                • C:\Program Files\Bonjour\mdnsNSP.dll

                                  Filesize

                                  130KB

                                  MD5

                                  eaaa2b83c4764fdcfbee4a4d6546de92

                                  SHA1

                                  961a7e7735ee8f07ca54fa7cbfb23399748f8174

                                  SHA256

                                  043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b

                                  SHA512

                                  bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3

                                • C:\Program Files\Bonjour\mdnsNSP.dll

                                  Filesize

                                  130KB

                                  MD5

                                  eaaa2b83c4764fdcfbee4a4d6546de92

                                  SHA1

                                  961a7e7735ee8f07ca54fa7cbfb23399748f8174

                                  SHA256

                                  043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b

                                  SHA512

                                  bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3

                                • C:\Program Files\Bonjour\mdnsNSP.dll

                                  Filesize

                                  130KB

                                  MD5

                                  eaaa2b83c4764fdcfbee4a4d6546de92

                                  SHA1

                                  961a7e7735ee8f07ca54fa7cbfb23399748f8174

                                  SHA256

                                  043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b

                                  SHA512

                                  bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3

                                • C:\Program Files\Bonjour\mdnsNSP.dll

                                  Filesize

                                  130KB

                                  MD5

                                  eaaa2b83c4764fdcfbee4a4d6546de92

                                  SHA1

                                  961a7e7735ee8f07ca54fa7cbfb23399748f8174

                                  SHA256

                                  043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b

                                  SHA512

                                  bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3

                                • C:\Program Files\Bonjour\mdnsNSP.dll

                                  Filesize

                                  130KB

                                  MD5

                                  eaaa2b83c4764fdcfbee4a4d6546de92

                                  SHA1

                                  961a7e7735ee8f07ca54fa7cbfb23399748f8174

                                  SHA256

                                  043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b

                                  SHA512

                                  bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3

                                • C:\Program Files\Bonjour\mdnsNSP.dll

                                  Filesize

                                  130KB

                                  MD5

                                  eaaa2b83c4764fdcfbee4a4d6546de92

                                  SHA1

                                  961a7e7735ee8f07ca54fa7cbfb23399748f8174

                                  SHA256

                                  043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b

                                  SHA512

                                  bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3

                                • C:\Program Files\Java\jre1.8.0_66\lib\ext\dns_sd.jar

                                  Filesize

                                  17KB

                                  MD5

                                  ce9a2f5a7fcfff341d6d901ad919a2ab

                                  SHA1

                                  341f9d9a0b3fd8cfbefe0169b148dcc55688ee93

                                  SHA256

                                  cc36a44467f41cf2dc91c126e368e357b28a0d57101472d2dfd1c06a4091cdf7

                                  SHA512

                                  1f53e652b042ee27fe05b11ccda2ed9ae9a8f44b948b8658aa7a2d7ad2f5bd94ea16f3d9a92e65a8c65b7480517f1d05a066a4fb8d961b927d0d305399ca4e8f

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  aaeb1f5e097ab38083674077b84b8ed6

                                  SHA1

                                  7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

                                  SHA256

                                  1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

                                  SHA512

                                  130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  48B

                                  MD5

                                  73066d04878e7d00c33033df2f44c788

                                  SHA1

                                  7495c647547675bc446c72a8015f8cc9a040e363

                                  SHA256

                                  92d9c7f664bfb85097ad178c95af0cc7944c16e228ab4355ef73c9a2ba2ea89b

                                  SHA512

                                  28662e9990c0e4f2dfbae6b2df25f5e0e14cd2640fe693d19cb6c9b785909dfbd819513c88d0aaab5067e5a11314548755dbb8d4cbf1d214ea056ca188d35560

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  552B

                                  MD5

                                  9d76508a62976cecbd2459b156de3e70

                                  SHA1

                                  c66bbe3a8a519ffcacfceb2f156b34e323d1ca06

                                  SHA256

                                  698ec22848afc90742b3b9298f12dce252cc1f31e08b4449723217f35db12174

                                  SHA512

                                  ed6c6fd558c344c88d03ff4e76be31c3859459e29b01083fa16b1fd16fe38f690e4143b4b706e9d6fc230afc8bd163327b97ce932e89a3d4b8410833ec2458d0

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                  Filesize

                                  70KB

                                  MD5

                                  e5e3377341056643b0494b6842c0b544

                                  SHA1

                                  d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                  SHA256

                                  e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                  SHA512

                                  83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

                                  Filesize

                                  41B

                                  MD5

                                  5af87dfd673ba2115e2fcf5cfdb727ab

                                  SHA1

                                  d5b5bbf396dc291274584ef71f444f420b6056f1

                                  SHA256

                                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                  SHA512

                                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

                                  Filesize

                                  264KB

                                  MD5

                                  f50f89a0a91564d0b8a211f8921aa7de

                                  SHA1

                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                  SHA256

                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                  SHA512

                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

                                  Filesize

                                  2KB

                                  MD5

                                  7689914e443e34e7cc93306a9d88fc8f

                                  SHA1

                                  7e6337515a6b77486bf6a8b9d4f73128ca0d212b

                                  SHA256

                                  9b503d9a096a00bb4cc9ad25d40dc292b204c8030581a91e77a28137c1a92e15

                                  SHA512

                                  e6d6dfdc90507f8d61a44a1c5640a35e698f2dc8217847627768a5a2030f82be2e93913c078986a621c6c5154bd2817e32741b31da224007cf88d869fc4be373

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  111B

                                  MD5

                                  285252a2f6327d41eab203dc2f402c67

                                  SHA1

                                  acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                  SHA256

                                  5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                  SHA512

                                  11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  5c7ced387733e1ce60694d794f24cf08

                                  SHA1

                                  d5bb8f98709bcfcf176ff2b6f7e9cdab42164acf

                                  SHA256

                                  2feea9e884f81c15b4cad8b9a4270c94d79b81ad9215613112c72812f8b877aa

                                  SHA512

                                  e95c2a52d045640c83b44febe2e0c5abfeab5e562a15cb57af101ab1765565262553733eb2199e32a8f3c08f9032dd31f215f91e0686c5f36fcde39b41c41362

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  4KB

                                  MD5

                                  4e5decbb1629f34bce96f58d2aaf5c18

                                  SHA1

                                  635483b85b047ad340e21aa6d595df1e60200723

                                  SHA256

                                  82250ca5443cbf239f935a63c184ada7d8e0df70a2d82015e8efa1842decce39

                                  SHA512

                                  1a3fedc658adef7a28be9cecc42e0203c6b380180a1ab823bb2149e53a9e20f443d3d473cbd98be425008fa3fc32a884712fa20c7a62c9e157e39f53529b477e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  c89ff81b4b5fa5b7d974e6b9c4165e09

                                  SHA1

                                  58679769885e77cc131d7b867ee49728260d0934

                                  SHA256

                                  98ec9e95f502aea5c9e4b033128c33c6791af895ded77f3c0e08845c6e72bcfc

                                  SHA512

                                  552bcafc2db69277793e8fecc41aefe338554c38fcc9a8b7638d0cf2f8d0409bae9c8de9c2e82c963a187364fdb7d3868f3d4ffaef9f42ed55284d35ff4a72f6

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                  Filesize

                                  24KB

                                  MD5

                                  47e94a96372e6f095b8a3fd7edc48ec0

                                  SHA1

                                  377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

                                  SHA256

                                  15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

                                  SHA512

                                  5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  206702161f94c5cd39fadd03f4014d98

                                  SHA1

                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                  SHA256

                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                  SHA512

                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  9KB

                                  MD5

                                  efa046efb084cc2a0092c933c8ecdcd6

                                  SHA1

                                  004171becd48860a27bb06ad21d80546370fc1db

                                  SHA256

                                  2f7a739f85b10277dcd7be6aaf942b1155335e8992c685df3920274556b964b7

                                  SHA512

                                  2b93995327e585ba742ba95f424ffdd347e07802d783389c5dbbbb47c18fc4bb7e1efc1fce468d5fae4e347b44a00c96fd416fd2d7432b2e50044ef92b5bcd12

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  f4003ab5f541d80bb0a588619e7eec0c

                                  SHA1

                                  6979c5f8dcdf18c5104ae1c9b7c85ff12897d5ea

                                  SHA256

                                  f5e45723d7490d03754500de484a148dbc8b7dfbc8469429a619833759bd623b

                                  SHA512

                                  e2cf3907973ae52e722a41386d77c3b3330959364b0568aacb50b46a732621e9123717e0148639eefd07e2951ef68e5b2b0f8dcef1d09f58dae37fa9d993c2c0

                                • C:\Users\Admin\AppData\Local\Temp\Setup Log 2023-03-24 #001.txt

                                  Filesize

                                  183KB

                                  MD5

                                  0bfc8be49343b69a309aad64d55d03c2

                                  SHA1

                                  a4c61c2a7a7c15a98e96cf366776a7bc04886fc1

                                  SHA256

                                  14a36dcf7714cc85c45dd2261d52220daf0d5993cc4f64ebcddcd8a6691294e0

                                  SHA512

                                  fa1c8432e1710b1a05f2dddbc63337489d6935aab0e10a39b380d507eca3a28b2417617bbae70b5d7296017e2e6173fb0c0acb6c99772c4bb2dcef9cc93db5dd

                                • C:\Users\Admin\AppData\Local\Temp\installer.exe

                                  Filesize

                                  128.1MB

                                  MD5

                                  01ce68ba37f5e3be70262a6e1fc35d60

                                  SHA1

                                  348763682ede4910815eafdbeadaf208dca94771

                                  SHA256

                                  a98225ed39d88b6a39144749a807c3df720eaea87fd289c33a1ad8d9e338dc24

                                  SHA512

                                  c9ae5dfd9de63b652364e71ba4632b225063267a03590880de790fa9a95c46abbc9540e1d383bb51da5e6c9deb8eaf2e31f94760507223f87bd8ee442348b109

                                • C:\Users\Admin\AppData\Local\Temp\installer.exe

                                  Filesize

                                  128.1MB

                                  MD5

                                  01ce68ba37f5e3be70262a6e1fc35d60

                                  SHA1

                                  348763682ede4910815eafdbeadaf208dca94771

                                  SHA256

                                  a98225ed39d88b6a39144749a807c3df720eaea87fd289c33a1ad8d9e338dc24

                                  SHA512

                                  c9ae5dfd9de63b652364e71ba4632b225063267a03590880de790fa9a95c46abbc9540e1d383bb51da5e6c9deb8eaf2e31f94760507223f87bd8ee442348b109

                                • C:\Users\Admin\AppData\Local\Temp\installer.exe

                                  Filesize

                                  128.1MB

                                  MD5

                                  01ce68ba37f5e3be70262a6e1fc35d60

                                  SHA1

                                  348763682ede4910815eafdbeadaf208dca94771

                                  SHA256

                                  a98225ed39d88b6a39144749a807c3df720eaea87fd289c33a1ad8d9e338dc24

                                  SHA512

                                  c9ae5dfd9de63b652364e71ba4632b225063267a03590880de790fa9a95c46abbc9540e1d383bb51da5e6c9deb8eaf2e31f94760507223f87bd8ee442348b109

                                • C:\Users\Admin\AppData\Local\Temp\is-C0SSK.tmp\installer.tmp

                                  Filesize

                                  2.6MB

                                  MD5

                                  da481f3e7a22e87b4b2df68e286482f2

                                  SHA1

                                  5bb7d4b848f7c7d22c78587242c54d70ea678c23

                                  SHA256

                                  f33068093c66976ebcdf3babef6397c15c5ed58c39c19b74a971178d341cc03e

                                  SHA512

                                  64564ef5a5f8a676677a0c908f50187dfa29b0497eab2d0d95520ee3e8ad8188441234f1418ceb8a015534a0550b381813cc90e8509d59d4a7268702afc2d1cd

                                • C:\Users\Admin\AppData\Local\Temp\is-C0SSK.tmp\installer.tmp

                                  Filesize

                                  2.6MB

                                  MD5

                                  da481f3e7a22e87b4b2df68e286482f2

                                  SHA1

                                  5bb7d4b848f7c7d22c78587242c54d70ea678c23

                                  SHA256

                                  f33068093c66976ebcdf3babef6397c15c5ed58c39c19b74a971178d341cc03e

                                  SHA512

                                  64564ef5a5f8a676677a0c908f50187dfa29b0497eab2d0d95520ee3e8ad8188441234f1418ceb8a015534a0550b381813cc90e8509d59d4a7268702afc2d1cd

                                • C:\Users\Admin\AppData\Local\Temp\is-UE7D7.tmp\KillProcessWithName.bat

                                  Filesize

                                  155B

                                  MD5

                                  12320b56fad8a52d1fc409d7977637db

                                  SHA1

                                  dee01db8bac192d111d16d3d4505e2464bc6746c

                                  SHA256

                                  daa5b50a7973dd0c49f0cd5f90c2351617146cdc0408e99cf7fcb219d0703299

                                  SHA512

                                  6760d9257eefd8568fbd640a99ed24f4e91b91f6f323ffc7103008084ffeb33e869daf265d74670d62723de771410f5e68d3b9accdef35829068ee0a0fe8e48b

                                • C:\Users\Admin\AppData\Local\Temp\is-UE7D7.tmp\isxdl.dll

                                  Filesize

                                  130KB

                                  MD5

                                  f7b445a6cb2064d7b459451e86ca6b0e

                                  SHA1

                                  b05b74a1988c10df8c73eb9ca1a41af2a49647b7

                                  SHA256

                                  bd03543c37feb48432e166fe3898abc2a7fe854b1113ee4d5d284633b4605377

                                  SHA512

                                  9cf6d791132660d5246f55d25018ad0cf2791de9f6032531b9aca9a6c84396b8aeca7a9c0410f835637659f396817d8ba40f45d3b80c7907cccbe275a345a465

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\ApowerMirror.ini

                                  Filesize

                                  27B

                                  MD5

                                  f68ed61a36e0da7f328985c3f415dfcd

                                  SHA1

                                  b0ad1b38e86a1b2f419d450e57f58888e50c4c89

                                  SHA256

                                  c5f037ca6ef13242c30ddd84f07b1b74a83c343faf5ae40a3c2427f5d4064710

                                  SHA512

                                  55a4a25d58b283dee5d66d70c730e213150617ade700d832a7d7c655f018f391a96d8590d988061587ee5eb61050c6faa42bb2384f9dfc4d0d2c3d6ab0c7ba83

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\Config.ini

                                  Filesize

                                  167B

                                  MD5

                                  7854e4b691005b1c33b73348272cae82

                                  SHA1

                                  f6838897788d80dd119c32aaa4bddc9da8ea45ef

                                  SHA256

                                  4e61b58027947d4226823288fa642b17994f531678246da092efeea0f97c84c7

                                  SHA512

                                  3b6c51d381e29acfde98fe809c289de18dc9bfad671cba034eabd28e3b24fe99b1d81525010981000e157693e1c1e10e6cc8fab6b9d4c844ebbea824b713b518

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\WXMedia.ini

                                  Filesize

                                  1KB

                                  MD5

                                  3794ed43c2874c54a47a1afbc3e30805

                                  SHA1

                                  660604538513ce3ffe23f10d5690276dc020dc65

                                  SHA256

                                  165af24282dea83650e696c8cac419228b2d965df8056145c7b3420da638722c

                                  SHA512

                                  15cf899eb6331bba7d790647f72da873551629842571f6a19d440628847c359ccc457ee89c9508347be4e11c1d59b2849c6d756dd633217d1581dd6749945635

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\WXMedia.ini

                                  Filesize

                                  1KB

                                  MD5

                                  803bd1e7cd1cdba1f7dc23dbb490246b

                                  SHA1

                                  d3d1efe8b2fdca1415df8b1b2a0e014c15950f96

                                  SHA256

                                  bf307b5e7df8f051e208e93eacf1546f2329f64710ee27d6e1a1f1d9add065ce

                                  SHA512

                                  3d651578258559c8e62fac3976d75b2e205f7814ae5dbb5a14089a8ab81b25c8009014d298da202ca30dfe29d5e58bac66b35ad94f4b2fab69d27fe15fdd1cb2

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\WXMedia.ini

                                  Filesize

                                  2KB

                                  MD5

                                  6d58e55802146d8760fe9846fa4b3c63

                                  SHA1

                                  acc1f66fb9e4d73b846412c18fe0effd021556c6

                                  SHA256

                                  d5e50153222fbbecac2efb6e08e7ec06fd9e4f2f195dcccab44b5dc54b3963e5

                                  SHA512

                                  3751cf538daf1169445b7cbe4942308d89573c801222defaf7ce0a6c2febb67df31bd5085d4298ba3cea8b7448bff779e6a4a34dfb3d11e0643be4d99eb3466e

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\config.ini

                                  Filesize

                                  123B

                                  MD5

                                  614c8b803316ab68f6626d0c4f1d029b

                                  SHA1

                                  214083b0e614bc4a1811b4397efb9f72de920cd0

                                  SHA256

                                  a7cd4e39f71a7aef7bb0a9c09642a83b16ae1e6374e1fff9f337253ef370a2ee

                                  SHA512

                                  954b21d1aa6c8ec315fd8cd0d1d21b42b4170b038b275547a66368c80ce5193ad89e0fcb6acf552857d0ac300176e715c1972f863a26623fba56e2b04b478e92

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\config.ini

                                  Filesize

                                  167B

                                  MD5

                                  542f6db5985644ec514c6a77d0554a3b

                                  SHA1

                                  b44302deb0f1f2c338360469843800bf4f078341

                                  SHA256

                                  ef96087cf44efd5a6d9d8d3d97ff4140f66fd00c083a534d8af81540d34ff435

                                  SHA512

                                  a71416bac8801c8b23f4731b3f8428c4c04dca51eea8d81d84b62e0e05d406a79c2b42ce90958ded9a4802f335938bcabacebf8980d0e79afebc6f3ee6d9dc6b

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\config.ini

                                  Filesize

                                  167B

                                  MD5

                                  7854e4b691005b1c33b73348272cae82

                                  SHA1

                                  f6838897788d80dd119c32aaa4bddc9da8ea45ef

                                  SHA256

                                  4e61b58027947d4226823288fa642b17994f531678246da092efeea0f97c84c7

                                  SHA512

                                  3b6c51d381e29acfde98fe809c289de18dc9bfad671cba034eabd28e3b24fe99b1d81525010981000e157693e1c1e10e6cc8fab6b9d4c844ebbea824b713b518

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\config.ini

                                  Filesize

                                  189B

                                  MD5

                                  62923fa810ecbcd330c8143c195ad20c

                                  SHA1

                                  9dfc840c588341fed38dd6455a1804ad3b253eaa

                                  SHA256

                                  a9f83f6eaf55a32d8b8b72af48928380542e986870ca9b08360472bbfc1be9d9

                                  SHA512

                                  663e4ea54ec48c88125287832c15b52a3f8b82ec5956f4d000e1fe648564b2e9198ebb27cfa4e6694667e608879f92ad0393633bd06885f46fa2ac12d3fb6e52

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\config.ini

                                  Filesize

                                  1KB

                                  MD5

                                  2535070882778cf21312a92219f7774e

                                  SHA1

                                  6a6ed18c1d77ad17d704d17b37c837fe73d59ab3

                                  SHA256

                                  cb7889a62128ea9cf3f5a8b97337f64560f39c712393bc498a0b892b137c0479

                                  SHA512

                                  eece9fe06df9a0cbd1af9c0db3f19c92b9bcf01386fd63702f1479087f0c49ce0b2301d72e8726718ce1b3430f25b561c574f627704224781c6a27b4a2baa101

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\event.log

                                  Filesize

                                  1KB

                                  MD5

                                  3c5a16369f93b52b293aa01d182b8be3

                                  SHA1

                                  d72e0e45f64077f47085e62e147669bf404cb1d2

                                  SHA256

                                  71b06d84f376cff412e49ab6fc66b6b23251d1edd7230dd415293d5cf0935f02

                                  SHA512

                                  ee1d1a8476abae3262f343fe1f6f257deb46bb82f01427d0c38a06710aba6085e5d9d5c104bd7c115845b4e27f4f67bb573c9261d17cf12e021bb8f83f62a40a

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\log\Apowersoft.Utils.Record.log

                                  Filesize

                                  635B

                                  MD5

                                  c24b80c762aa6f683682bf599ad70880

                                  SHA1

                                  0db6969b07a0231f56317c81a3e3acb9430a2a4c

                                  SHA256

                                  255b7f37a5160114caae56377b61d0dadba29ac09967c8efae7dd57a94d76bac

                                  SHA512

                                  9a3ee57caf79e9582fa70067ce0035fa855e789ab5d722ca01f4a15a3f93c081c9e9870b3d454f2e54a93c352e12352ea452da667711e8decff0da39fda1d5a9

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\log\CommUtilities.Native.log

                                  Filesize

                                  5KB

                                  MD5

                                  3f9cfc142682ce84516a1e7ab3e31d37

                                  SHA1

                                  dc82ed1eebd93dd87281d021206f25626c4924af

                                  SHA256

                                  c9bc514436d3b0ad007f88e81f9439d01f9f11fbda35190983be147e834b538e

                                  SHA512

                                  b12aa936517362aab38b13bad03d0a7364530283277b9c6f80c4fc49d477f1e81cd064d2597ddef3e48fe60b29d7a211f148a080ada284f5fa68398598a2a1bf

                                • C:\Users\Admin\AppData\Roaming\Apowersoft\ApowerMirror\log\CommUtilities.log

                                  Filesize

                                  5KB

                                  MD5

                                  2f1c4392be69ef13bef3984350c4aff9

                                  SHA1

                                  eeffbbdfd0361ee03c4ecbd3a7b3ac93cc709790

                                  SHA256

                                  cd44d5c4ba72ee683d64c28189d5ef076d9c4f04d955fde0ea119b7e9880cc47

                                  SHA512

                                  e0d00d2de111ce1a13ad75db89da00e40270b866c8dec52039c336f2efbe441c198378ae1cd52bd0032c9b1f724163e3f85651108399bee10107a4fffce57824

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                  Filesize

                                  3KB

                                  MD5

                                  effc41a548055becda31e5ceb254c661

                                  SHA1

                                  5826be96ea2911c3c579550872415527c6772b90

                                  SHA256

                                  98f581379e2dae49fa44cffd8b0f18d601de639c0cced4820d42ebbc9689b33b

                                  SHA512

                                  6eba51843df983059dd79a8aa4d37b84b5610233c7c5a87565fd88be460ea9d375c1894403efad477f5adf8d60a881ca497a3ccd06f926c7d365cbb538b53176

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                  Filesize

                                  3KB

                                  MD5

                                  bedc9ea6626f92cb06268f4e63c0c987

                                  SHA1

                                  5f048cc53bb6272f7ddaea38228b8fad85864e26

                                  SHA256

                                  e0146c128708c2ddcd8db9e7e9cfa184fdb71461fcbef301634c20a357c3e265

                                  SHA512

                                  d94444790abf9e34f88f13e1125efdea3685d1d57399fbc16ed45681d9d87133899cca69ccfeddae091b29050e91cccba96b2862ee8eeb444b041dfa72b31414

                                • C:\Windows\Installer\MSI73C8.tmp

                                  Filesize

                                  76KB

                                  MD5

                                  950087e828e1b7426f703678e446c799

                                  SHA1

                                  c9f28be9b9f810132ec8d78c161e5a232491e60e

                                  SHA256

                                  8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

                                  SHA512

                                  9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

                                • C:\Windows\Installer\MSI73C8.tmp

                                  Filesize

                                  76KB

                                  MD5

                                  950087e828e1b7426f703678e446c799

                                  SHA1

                                  c9f28be9b9f810132ec8d78c161e5a232491e60e

                                  SHA256

                                  8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

                                  SHA512

                                  9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

                                • C:\Windows\Installer\MSI7418.tmp

                                  Filesize

                                  76KB

                                  MD5

                                  950087e828e1b7426f703678e446c799

                                  SHA1

                                  c9f28be9b9f810132ec8d78c161e5a232491e60e

                                  SHA256

                                  8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

                                  SHA512

                                  9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

                                • C:\Windows\Installer\MSI7418.tmp

                                  Filesize

                                  76KB

                                  MD5

                                  950087e828e1b7426f703678e446c799

                                  SHA1

                                  c9f28be9b9f810132ec8d78c161e5a232491e60e

                                  SHA256

                                  8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

                                  SHA512

                                  9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

                                • C:\Windows\Installer\MSI760E.tmp

                                  Filesize

                                  76KB

                                  MD5

                                  950087e828e1b7426f703678e446c799

                                  SHA1

                                  c9f28be9b9f810132ec8d78c161e5a232491e60e

                                  SHA256

                                  8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

                                  SHA512

                                  9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

                                • C:\Windows\Installer\MSI760E.tmp

                                  Filesize

                                  76KB

                                  MD5

                                  950087e828e1b7426f703678e446c799

                                  SHA1

                                  c9f28be9b9f810132ec8d78c161e5a232491e60e

                                  SHA256

                                  8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

                                  SHA512

                                  9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

                                • C:\Windows\Installer\MSI760E.tmp

                                  Filesize

                                  76KB

                                  MD5

                                  950087e828e1b7426f703678e446c799

                                  SHA1

                                  c9f28be9b9f810132ec8d78c161e5a232491e60e

                                  SHA256

                                  8a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee

                                  SHA512

                                  9ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93

                                • C:\Windows\Installer\MSI763D.tmp

                                  Filesize

                                  75KB

                                  MD5

                                  6f8e3e4f72620bddc633f0175f47161e

                                  SHA1

                                  53ed75a208cc84f1a065e9e4ece356371cac0341

                                  SHA256

                                  2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

                                  SHA512

                                  80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

                                • C:\Windows\Installer\MSI763D.tmp

                                  Filesize

                                  75KB

                                  MD5

                                  6f8e3e4f72620bddc633f0175f47161e

                                  SHA1

                                  53ed75a208cc84f1a065e9e4ece356371cac0341

                                  SHA256

                                  2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

                                  SHA512

                                  80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

                                • C:\Windows\Installer\MSI7729.tmp

                                  Filesize

                                  75KB

                                  MD5

                                  6f8e3e4f72620bddc633f0175f47161e

                                  SHA1

                                  53ed75a208cc84f1a065e9e4ece356371cac0341

                                  SHA256

                                  2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

                                  SHA512

                                  80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

                                • C:\Windows\Installer\MSI7729.tmp

                                  Filesize

                                  75KB

                                  MD5

                                  6f8e3e4f72620bddc633f0175f47161e

                                  SHA1

                                  53ed75a208cc84f1a065e9e4ece356371cac0341

                                  SHA256

                                  2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

                                  SHA512

                                  80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

                                • C:\Windows\Installer\MSI790E.tmp

                                  Filesize

                                  75KB

                                  MD5

                                  6f8e3e4f72620bddc633f0175f47161e

                                  SHA1

                                  53ed75a208cc84f1a065e9e4ece356371cac0341

                                  SHA256

                                  2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

                                  SHA512

                                  80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

                                • C:\Windows\Installer\MSI790E.tmp

                                  Filesize

                                  75KB

                                  MD5

                                  6f8e3e4f72620bddc633f0175f47161e

                                  SHA1

                                  53ed75a208cc84f1a065e9e4ece356371cac0341

                                  SHA256

                                  2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

                                  SHA512

                                  80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

                                • C:\Windows\Installer\MSI790E.tmp

                                  Filesize

                                  75KB

                                  MD5

                                  6f8e3e4f72620bddc633f0175f47161e

                                  SHA1

                                  53ed75a208cc84f1a065e9e4ece356371cac0341

                                  SHA256

                                  2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e

                                  SHA512

                                  80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869

                                • C:\Windows\Installer\e576bba.msi

                                  Filesize

                                  2.6MB

                                  MD5

                                  86e2b390629665fbc20e06dfbf01a48f

                                  SHA1

                                  d9f4697a6f4eceea24735822cb1df501268ca0b0

                                  SHA256

                                  46e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1

                                  SHA512

                                  05ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea

                                • memory/2164-1837-0x000000000EC10000-0x000000000EC2A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/2164-1992-0x000000001A6D0000-0x000000001A6EE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/2164-2117-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1716-0x0000000000C60000-0x00000000016B6000-memory.dmp

                                  Filesize

                                  10.3MB

                                • memory/2164-2116-0x000000001CB50000-0x000000001CBFD000-memory.dmp

                                  Filesize

                                  692KB

                                • memory/2164-1717-0x00000000065C0000-0x0000000006B64000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/2164-1718-0x0000000006C10000-0x0000000006CA2000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/2164-1720-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1745-0x0000000007570000-0x000000000792A000-memory.dmp

                                  Filesize

                                  3.7MB

                                • memory/2164-1747-0x0000000007930000-0x0000000007948000-memory.dmp

                                  Filesize

                                  96KB

                                • memory/2164-1796-0x0000000007E50000-0x0000000007E62000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2164-1797-0x0000000007E40000-0x0000000007E50000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1798-0x000000006A480000-0x000000006A4AF000-memory.dmp

                                  Filesize

                                  188KB

                                • memory/2164-1800-0x0000000008620000-0x0000000008B4C000-memory.dmp

                                  Filesize

                                  5.2MB

                                • memory/2164-1799-0x000000006BF00000-0x000000006E62B000-memory.dmp

                                  Filesize

                                  39.2MB

                                • memory/2164-1801-0x0000000007570000-0x000000000792A000-memory.dmp

                                  Filesize

                                  3.7MB

                                • memory/2164-1804-0x0000000007DC0000-0x0000000007DCA000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/2164-1803-0x0000000007930000-0x0000000007948000-memory.dmp

                                  Filesize

                                  96KB

                                • memory/2164-1807-0x000000000DB80000-0x000000000DC1C000-memory.dmp

                                  Filesize

                                  624KB

                                • memory/2164-1814-0x000000000E090000-0x000000000E0F6000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/2164-1815-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1816-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1817-0x000000000E210000-0x000000000E312000-memory.dmp

                                  Filesize

                                  1.0MB

                                • memory/2164-1829-0x000000000E8C0000-0x000000000E8DA000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/2164-1721-0x0000000007540000-0x0000000007562000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/2164-1838-0x000000000EC90000-0x000000000ECE4000-memory.dmp

                                  Filesize

                                  336KB

                                • memory/2164-2115-0x0000000015B50000-0x0000000016DA4000-memory.dmp

                                  Filesize

                                  18.3MB

                                • memory/2164-2111-0x000000006BF00000-0x000000006E62B000-memory.dmp

                                  Filesize

                                  39.2MB

                                • memory/2164-2016-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1847-0x0000000010E00000-0x0000000010E22000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/2164-1848-0x00000000113A0000-0x00000000113D8000-memory.dmp

                                  Filesize

                                  224KB

                                • memory/2164-1849-0x0000000011360000-0x000000001136E000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/2164-1850-0x0000000011890000-0x00000000118D0000-memory.dmp

                                  Filesize

                                  256KB

                                • memory/2164-1851-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1853-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1861-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-2107-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-2106-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1843-0x000000000ED60000-0x000000000ED6A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/2164-2015-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1990-0x000000001A650000-0x000000001A670000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/2164-1841-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1991-0x000000001A510000-0x000000001A51E000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/2164-1993-0x000000001CB50000-0x000000001CBFD000-memory.dmp

                                  Filesize

                                  692KB

                                • memory/2164-1994-0x0000000003A60000-0x0000000003A70000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2164-1842-0x000000000ED80000-0x000000000EDA0000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/2684-157-0x0000000000400000-0x00000000004ED000-memory.dmp

                                  Filesize

                                  948KB

                                • memory/2684-165-0x0000000000400000-0x00000000004ED000-memory.dmp

                                  Filesize

                                  948KB

                                • memory/2684-1330-0x0000000000400000-0x00000000004ED000-memory.dmp

                                  Filesize

                                  948KB

                                • memory/4304-169-0x0000000000860000-0x0000000000861000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/4304-171-0x0000000000400000-0x00000000006A7000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/4304-174-0x0000000000400000-0x00000000006A7000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/4304-216-0x0000000000860000-0x0000000000861000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/4304-382-0x0000000000400000-0x00000000006A7000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/4304-1329-0x0000000000400000-0x00000000006A7000-memory.dmp

                                  Filesize

                                  2.7MB

                                • memory/4304-1246-0x0000000000400000-0x00000000006A7000-memory.dmp

                                  Filesize

                                  2.7MB