Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-es -
resource tags
arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
24/03/2023, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
apowermirror-setup-gg-b.exe
Resource
win10v2004-20230220-es
General
-
Target
apowermirror-setup-gg-b.exe
-
Size
1.9MB
-
MD5
95f99a7a6ee16bdcc0a8fe120116d7d7
-
SHA1
ccdb752544c3b1c3cb12319374a3fd0807f2585e
-
SHA256
7999a1eb0af8b4448598c1e3ace49eaa44cbe2b6266a63e19077e3fb9608c40c
-
SHA512
de20942292e8e0fcf613d1f3c0eee504fd1426e3cfe8e1a92ae0f207e3b7bc4fbd8a78ee121fec94a7e7fe534bfe4b40a93b11a59d8473222d8bc66ec90e69d8
-
SSDEEP
49152:myIO6XrnRNm5zuXp7jRG6wLvSpDiTEO3xTuDB14:XIOqrRXG6wL603d
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules mDNSResponder.exe -
Blocklisted process makes network request 3 IoCs
flow pid Process 93 3488 msiexec.exe 95 3488 msiexec.exe 98 3488 msiexec.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 3 IoCs
pid Process 3876 netsh.exe 4980 netsh.exe 4300 netsh.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation apowermirror-setup-gg-b.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation ApowerMirror.exe -
Executes dropped EXE 7 IoCs
pid Process 2684 installer.exe 4304 installer.tmp 1192 mDNSResponder.exe 2128 Process not Found 3940 Process not Found 2164 ApowerMirror.exe 1372 ApowersoftAndroidDaemon.exe -
Loads dropped DLL 64 IoCs
pid Process 4304 installer.tmp 1660 MsiExec.exe 1660 MsiExec.exe 1660 MsiExec.exe 4032 MsiExec.exe 4032 MsiExec.exe 4080 MsiExec.exe 2788 MsiExec.exe 976 MsiExec.exe 4304 installer.tmp 4256 apowermirror-setup-gg-b.exe 1900 msedge.exe 3056 msedge.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 1372 ApowersoftAndroidDaemon.exe -
Registers COM server for autorun 1 TTPs 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ThreadingModel = "Both" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\jdns_sd.dll msiexec.exe File created C:\Windows\system32\jdns_sd.dll msiexec.exe File created C:\Windows\SysWOW64\dns-sd.exe msiexec.exe File created C:\Windows\system32\dns-sd.exe msiexec.exe File created C:\Windows\SysWOW64\dnssd.dll msiexec.exe File created C:\Windows\system32\dnssd.dll msiexec.exe File created C:\Windows\SysWOW64\dnssdX.dll msiexec.exe File created C:\Windows\system32\dnssdX.dll msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\is-AD851.tmp installer.tmp File opened for modification C:\Program Files (x86)\Apowersoft\ApowerMirror\libpthread-2.dll installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\GuideHelp\img\ios-app\is-RRPDD.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\HUAWEI_files\is-K6H7N.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\is-75032.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\BleTutoralHelp\img\is-ULCUL.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Lang\is-QOQF4.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\VIVO_files\is-N3AV0.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\is-P9KLR.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\is-GHEMP.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\is-HS64A.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\OnePlus_files\is-71CUT.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\OnePlus_files-es\is-DPET6.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MI_files\is-689MI.tmp installer.tmp File opened for modification C:\Program Files (x86)\Apowersoft\ApowerMirror\av1.dll installer.tmp File opened for modification C:\Program Files (x86)\Apowersoft\ApowerMirror\DriverSetup.exe installer.tmp File opened for modification C:\Program Files (x86)\Apowersoft\ApowerMirror\libwxaus.dll installer.tmp File opened for modification C:\Program Files (x86)\Apowersoft\ApowerMirror\libpng16-16.dll installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\is-PHJAQ.tmp installer.tmp File opened for modification C:\Program Files (x86)\Apowersoft\ApowerMirror\WXDLNAReceiver.dll installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\HUAWEI-SUB_files\is-AHV1H.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MI_files\is-CEIFN.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\SamSung_files\is-F02QN.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\SamSung_files\is-FE5OV.tmp installer.tmp File created C:\Program Files (x86)\Bonjour\dns_sd.jar msiexec.exe File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\is-SR3KQ.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files-de\is-JP66U.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files-de\is-MEA4K.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MI_files\is-KCADF.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\OnePlus_files-es\is-HQTHL.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\OPPO_files\is-RQRKJ.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\is-O8NHO.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\is-FHCKL.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\is-0UQTC.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\GENERAL_files\is-N1V49.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files\is-VAKND.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\OnePlus_files-es\is-6S2C3.tmp installer.tmp File opened for modification C:\Program Files (x86)\Apowersoft\ApowerMirror\Apowersoft.Commutilities.Services.Http.dll installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\is-9Q67F.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\AssistiveTouchTutoralHelp\.history\is-E32K4.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\GuideHelp\is-AQSDK.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files-de\is-GOGV3.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\OPPO_files-de\is-ED2UJ.tmp installer.tmp File opened for modification C:\Program Files (x86)\Apowersoft\ApowerMirror\Apowersoft.CommUtilities.Base.V2.dll installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\BleTutoralHelp\img\is-SSKRC.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\is-D3EBO.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\MEIZU_files\is-LA5Q8.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\OnePlus_files-es\is-V3K09.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\is-TI3AV.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\BleTutoralHelp\img\is-GKPM5.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\img\is-AAA5D.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\is-78UMQ.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\is-ALNOO.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\SamSung_files-es\is-IRL6G.tmp installer.tmp File opened for modification C:\Program Files (x86)\Apowersoft\ApowerMirror\libphonectl.dll installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\is-8I67E.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\is-1HD56.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\GuideHelp\img\android\is-JM7EC.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\is-78E6Q.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\is-7VBK8.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\AssistiveTouchTutoralHelp\.history\is-DSK9C.tmp installer.tmp File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\SamSung_files\is-HBNOQ.tmp installer.tmp File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230324132310.pma setup.exe File created C:\Program Files (x86)\Apowersoft\ApowerMirror\Help\UsbDebug\OPPO_files\is-3L8EL.tmp installer.tmp -
Drops file in Windows directory 38 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI73C8.tmp msiexec.exe File created C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico msiexec.exe File opened for modification C:\Windows\INF\input.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\hdaudbus.PNF ApowerMirror.exe File opened for modification C:\Windows\Installer\e576bba.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7418.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI75ED.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI790E.tmp msiexec.exe File opened for modification C:\Windows\INF\compositebus.PNF ApowerMirror.exe File created C:\Windows\Installer\e576bba.msi msiexec.exe File opened for modification C:\Windows\INF\swenum.PNF ApowerMirror.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\INF\monitor.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\vdrvroot.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\msmouse.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\volume.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\hdaudio.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\mssmbios.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\rdpbus.PNF ApowerMirror.exe File opened for modification C:\Windows\Installer\MSI760E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7729.tmp msiexec.exe File opened for modification C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico msiexec.exe File opened for modification C:\Windows\INF\umbus.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\usbport.PNF ApowerMirror.exe File created C:\Windows\Installer\SourceHash{56DDDFB8-7F79-4480-89D5-25E1F52AB28F} msiexec.exe File opened for modification C:\Windows\Installer\MSI763D.tmp msiexec.exe File opened for modification C:\Windows\INF\volmgr.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\mshdc.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\acpi.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\vhdmp.PNF ApowerMirror.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\INF\keyboard.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\spaceport.PNF ApowerMirror.exe File opened for modification C:\Windows\INF\pci.PNF ApowerMirror.exe File opened for modification C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\Bonjour.ico msiexec.exe File created C:\Windows\Installer\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}\RichText.ico msiexec.exe File created C:\Windows\Installer\e576bbe.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs ApowerMirror.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID ApowerMirror.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags ApowerMirror.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName ApowerMirror.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID ApowerMirror.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 ApowerMirror.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName ApowerMirror.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs ApowerMirror.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 ApowerMirror.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags ApowerMirror.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 4748 tasklist.exe 4508 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1776 netstat.exe 2728 netstat.exe -
Kills process with taskkill 2 IoCs
pid Process 4888 taskkill.exe 1996 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION installer.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ApowerMirror.exe = "11001" installer.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION installer.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ApowerMirror.exe = "11001" installer.tmp -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDService\CLSID\ = "{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\VersionIndependentProgID\ = "Bonjour.DNSSDRecord" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ = "C:\\Windows\\system32\\dnssdX.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord\ = "DNSSDRecord Class" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\Programmable msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\TypeLib\Version = "1.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Bonjour.DNSSDService.1\CLSID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\NumMethods\ = "7" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ProxyStubClsid32\ = "{7FD72324-63E1-45AD-B337-4D525BD98DAD}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\SourceList\LastUsedSource = "n;1;C:\\Program Files (x86)\\Apowersoft\\ApowerMirror\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{56608F9C-223B-4CB6-813D-85EDCCADFB4B}\ = "Bonjour" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\ = "IDNSSDEventManager" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Bonjour.TXTRecord msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\NumMethods\ = "19" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Bonjour.DLL\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\ = "PSFactoryBuffer" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\ProgID\ = "Bonjour.DNSSDService.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDEventManager.1\CLSID\ = "{BEEB932A-8D4A-4619-AEFE-A836F988B221}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ProxyStubClsid32\ = "{7FD72324-63E1-45AD-B337-4D525BD98DAD}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5E93C5A9-7516-4259-A67B-41A656F6E01C}\VersionIndependentProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\ProxyStubClsid msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\Language = "1034" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord.1\CLSID\ = "{5E93C5A9-7516-4259-A67B-41A656F6E01C}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{24CD4DE9-FF84-4701-9DC1-9B69E0D1090A}\VersionIndependentProgID msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\SourceList\PackageName = "Bonjour64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\SourceList\Net\2 = "C:\\ProgramData\\Apple\\Installer Cache\\Bonjour 3.1.0.1\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21AE8D7F-D5FE-45CF-B632-CFA2C2C6B498}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29DE265F-8402-474F-833A-D4653B23458F}\ProxyStubClsid32\ = "{7FD72324-63E1-45AD-B337-4D525BD98DAD}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CE603A0-3365-4DA0-86D1-3F780ECBA110}\TypeLib\ = "{18FBED6D-F2B7-4EC8-A4A4-46282E635308}" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8BFDDD6597F70844985D521E5FA22BF8\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Bonjour.DNSSDRecord\CLSID\ = "{5E93C5A9-7516-4259-A67B-41A656F6E01C}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\ProgID\ = "Bonjour.TXTRecord.1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8FA0889C-5973-4FC9-970B-EC15C925D0CE}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AFEE063C-05BA-4248-A26E-168477F49734}\AppID = "{56608F9C-223B-4CB6-813D-85EDCCADFB4B}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEEB932A-8D4A-4619-AEFE-A836F988B221}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{7FD72324-63E1-45AD-B337-4D525BD98DAD}\TypeLib msiexec.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 108 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4304 installer.tmp 4304 installer.tmp 3056 msedge.exe 3056 msedge.exe 1900 msedge.exe 1900 msedge.exe 4108 identity_helper.exe 4108 identity_helper.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4748 tasklist.exe Token: SeDebugPrivilege 4888 taskkill.exe Token: SeDebugPrivilege 4508 tasklist.exe Token: SeDebugPrivilege 1996 taskkill.exe Token: SeShutdownPrivilege 2512 msiexec.exe Token: SeIncreaseQuotaPrivilege 2512 msiexec.exe Token: SeSecurityPrivilege 3488 msiexec.exe Token: SeCreateTokenPrivilege 2512 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2512 msiexec.exe Token: SeLockMemoryPrivilege 2512 msiexec.exe Token: SeIncreaseQuotaPrivilege 2512 msiexec.exe Token: SeMachineAccountPrivilege 2512 msiexec.exe Token: SeTcbPrivilege 2512 msiexec.exe Token: SeSecurityPrivilege 2512 msiexec.exe Token: SeTakeOwnershipPrivilege 2512 msiexec.exe Token: SeLoadDriverPrivilege 2512 msiexec.exe Token: SeSystemProfilePrivilege 2512 msiexec.exe Token: SeSystemtimePrivilege 2512 msiexec.exe Token: SeProfSingleProcessPrivilege 2512 msiexec.exe Token: SeIncBasePriorityPrivilege 2512 msiexec.exe Token: SeCreatePagefilePrivilege 2512 msiexec.exe Token: SeCreatePermanentPrivilege 2512 msiexec.exe Token: SeBackupPrivilege 2512 msiexec.exe Token: SeRestorePrivilege 2512 msiexec.exe Token: SeShutdownPrivilege 2512 msiexec.exe Token: SeDebugPrivilege 2512 msiexec.exe Token: SeAuditPrivilege 2512 msiexec.exe Token: SeSystemEnvironmentPrivilege 2512 msiexec.exe Token: SeChangeNotifyPrivilege 2512 msiexec.exe Token: SeRemoteShutdownPrivilege 2512 msiexec.exe Token: SeUndockPrivilege 2512 msiexec.exe Token: SeSyncAgentPrivilege 2512 msiexec.exe Token: SeEnableDelegationPrivilege 2512 msiexec.exe Token: SeManageVolumePrivilege 2512 msiexec.exe Token: SeImpersonatePrivilege 2512 msiexec.exe Token: SeCreateGlobalPrivilege 2512 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 4304 installer.tmp 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2164 ApowerMirror.exe 2164 ApowerMirror.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2164 ApowerMirror.exe 2164 ApowerMirror.exe 2164 ApowerMirror.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4256 wrote to memory of 2684 4256 apowermirror-setup-gg-b.exe 95 PID 4256 wrote to memory of 2684 4256 apowermirror-setup-gg-b.exe 95 PID 4256 wrote to memory of 2684 4256 apowermirror-setup-gg-b.exe 95 PID 2684 wrote to memory of 4304 2684 installer.exe 99 PID 2684 wrote to memory of 4304 2684 installer.exe 99 PID 2684 wrote to memory of 4304 2684 installer.exe 99 PID 4304 wrote to memory of 4152 4304 installer.tmp 102 PID 4304 wrote to memory of 4152 4304 installer.tmp 102 PID 4304 wrote to memory of 4152 4304 installer.tmp 102 PID 4152 wrote to memory of 976 4152 cmd.exe 104 PID 4152 wrote to memory of 976 4152 cmd.exe 104 PID 4152 wrote to memory of 976 4152 cmd.exe 104 PID 976 wrote to memory of 4748 976 cmd.exe 106 PID 976 wrote to memory of 4748 976 cmd.exe 106 PID 976 wrote to memory of 4748 976 cmd.exe 106 PID 976 wrote to memory of 4492 976 cmd.exe 105 PID 976 wrote to memory of 4492 976 cmd.exe 105 PID 976 wrote to memory of 4492 976 cmd.exe 105 PID 4304 wrote to memory of 4888 4304 installer.tmp 107 PID 4304 wrote to memory of 4888 4304 installer.tmp 107 PID 4304 wrote to memory of 4888 4304 installer.tmp 107 PID 4304 wrote to memory of 4164 4304 installer.tmp 110 PID 4304 wrote to memory of 4164 4304 installer.tmp 110 PID 4304 wrote to memory of 4164 4304 installer.tmp 110 PID 4164 wrote to memory of 492 4164 cmd.exe 112 PID 4164 wrote to memory of 492 4164 cmd.exe 112 PID 4164 wrote to memory of 492 4164 cmd.exe 112 PID 492 wrote to memory of 4508 492 cmd.exe 114 PID 492 wrote to memory of 4508 492 cmd.exe 114 PID 492 wrote to memory of 4508 492 cmd.exe 114 PID 492 wrote to memory of 2492 492 cmd.exe 113 PID 492 wrote to memory of 2492 492 cmd.exe 113 PID 492 wrote to memory of 2492 492 cmd.exe 113 PID 4304 wrote to memory of 1996 4304 installer.tmp 115 PID 4304 wrote to memory of 1996 4304 installer.tmp 115 PID 4304 wrote to memory of 1996 4304 installer.tmp 115 PID 4304 wrote to memory of 2512 4304 installer.tmp 123 PID 4304 wrote to memory of 2512 4304 installer.tmp 123 PID 4304 wrote to memory of 2512 4304 installer.tmp 123 PID 3488 wrote to memory of 1660 3488 msiexec.exe 125 PID 3488 wrote to memory of 1660 3488 msiexec.exe 125 PID 3488 wrote to memory of 4032 3488 msiexec.exe 126 PID 3488 wrote to memory of 4032 3488 msiexec.exe 126 PID 3488 wrote to memory of 4032 3488 msiexec.exe 126 PID 3488 wrote to memory of 4080 3488 msiexec.exe 127 PID 3488 wrote to memory of 4080 3488 msiexec.exe 127 PID 3488 wrote to memory of 4080 3488 msiexec.exe 127 PID 3488 wrote to memory of 2788 3488 msiexec.exe 128 PID 3488 wrote to memory of 2788 3488 msiexec.exe 128 PID 3488 wrote to memory of 976 3488 msiexec.exe 129 PID 3488 wrote to memory of 976 3488 msiexec.exe 129 PID 3488 wrote to memory of 976 3488 msiexec.exe 129 PID 4304 wrote to memory of 4980 4304 installer.tmp 132 PID 4304 wrote to memory of 4980 4304 installer.tmp 132 PID 4304 wrote to memory of 4980 4304 installer.tmp 132 PID 4304 wrote to memory of 4300 4304 installer.tmp 134 PID 4304 wrote to memory of 4300 4304 installer.tmp 134 PID 4304 wrote to memory of 4300 4304 installer.tmp 134 PID 4304 wrote to memory of 3876 4304 installer.tmp 136 PID 4304 wrote to memory of 3876 4304 installer.tmp 136 PID 4304 wrote to memory of 3876 4304 installer.tmp 136 PID 4256 wrote to memory of 1900 4256 apowermirror-setup-gg-b.exe 138 PID 4256 wrote to memory of 1900 4256 apowermirror-setup-gg-b.exe 138 PID 1900 wrote to memory of 4332 1900 msedge.exe 139
Processes
-
C:\Users\Admin\AppData\Local\Temp\apowermirror-setup-gg-b.exe"C:\Users\Admin\AppData\Local\Temp\apowermirror-setup-gg-b.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe" /VERYSILENT /SUPPRESSMSGBOXES /FORCECLOSEAPPLICATIONS /DIR="C:\Program Files (x86)\Apowersoft\ApowerMirror" /LANG=Spanish2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\is-C0SSK.tmp\installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-C0SSK.tmp\installer.tmp" /SL5="$80186,133368584,912896,C:\Users\Admin\AppData\Local\Temp\installer.exe" /VERYSILENT /SUPPRESSMSGBOXES /FORCECLOSEAPPLICATIONS /DIR="C:\Program Files (x86)\Apowersoft\ApowerMirror" /LANG=Spanish3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-UE7D7.tmp\KillProcessWithName.bat" "ApowerMirror.exe""4⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c tasklist | find "ApowerMirror.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\find.exefind "ApowerMirror.exe"6⤵PID:4492
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
-
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /t /im "ApowersoftAndroidDaemon.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-UE7D7.tmp\KillProcessWithName.bat" "ApowerMirror.exe""4⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c tasklist | find "ApowerMirror.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Windows\SysWOW64\find.exefind "ApowerMirror.exe"6⤵PID:2492
-
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
-
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /t /im "ApowersoftAndroidDaemon.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
C:\Windows\SysWOW64\msiexec.exe"msiexec.exe" /i "C:\Program Files (x86)\Apowersoft\ApowerMirror\Bonjour64.msi" /quiet4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="ApowerMirror" program="C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe"4⤵
- Modifies Windows Firewall
PID:4980
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="ApowerMirror" dir=in action=allow program="C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4300
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="ApowerMirror" dir=out action=allow program="C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3876
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://r.aoscdn.com/jumper?type=install&product_id=113&language=es&unique_id=17f90d5c5848880bf67f358fee7e06d3&apptype=ads-gg-b&appver=1.7.21.4&first_install_ts=1679664177&ts=1679664177&wxga=&ct=1677161727&mt=1677161727&h=95f99a7a6ee16bdcc0a8fe120116d7d7&hash=44876332da9ca9f66f456f09f8d523ca2⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8ad5546f8,0x7ff8ad554708,0x7ff8ad5547183⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:23⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:33⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:83⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:13⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:13⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:13⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:13⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:13⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:83⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:3216 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7f4f95460,0x7ff7f4f95470,0x7ff7f4f954804⤵PID:2272
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:13⤵PID:556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10845381892532028800,12436901208178057687,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:13⤵PID:4368
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding E6A8213314B4A78C7B39ACA20BE687702⤵
- Loads dropped DLL
PID:1660
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 802CB92A9A0BE89ED4163467DDD75CA42⤵
- Loads dropped DLL
PID:4032
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BA731A6441DB117A2E2A1BC96455F9D0 E Global\MSI00002⤵
- Loads dropped DLL
PID:4080
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Bonjour\mdnsNSP.dll"2⤵
- Loads dropped DLL
PID:2788
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Bonjour\mdnsNSP.dll"2⤵
- Loads dropped DLL
PID:976
-
-
C:\Program Files\Bonjour\mDNSResponder.exe"C:\Program Files\Bonjour\mDNSResponder.exe"1⤵
- Modifies firewall policy service
- Executes dropped EXE
PID:1192
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1432
-
C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe"C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowerMirror.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2164 -
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon2⤵
- Gathers network information
PID:1776
-
-
C:\Program Files (x86)\Apowersoft\ApowerMirror\ApowersoftAndroidDaemon.exeadb -L tcp:5037 fork-server server2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372
-
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon2⤵
- Gathers network information
PID:2728
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD5ed1000dd31854c65ffe80dcc0319eb84
SHA1f79ce68ebee1151280ce71e00f00af79a8e15a1c
SHA2569e4d07676afde9e7e271c646ade1457448e818930679dbceca78022927539fba
SHA512802648f4a08e403deb6b1f2000208d7fe8faab58664e5adca7aafe50d28d4b8670bc2ab46e4c9dfeb88715ff43b4c2ccf5ccb612f3870e1120a26440b7126726
-
Filesize
10.3MB
MD5480bcbfd7d00480eac1fe7cdad928c44
SHA1a56788852992ee6ab71ffe6a15c18ae967ccc203
SHA2566cb5d78ed9b22f9d3c7c2215c70f57d5024962175d84011bd9590e4318f2d80f
SHA5120a7443fe1f55ded9a23df592da5bbb541cce459aef15c830805d3f48c73dcc8412ec18ff93531173da18927134fcdd6047661a4af3d5f55e843f25d1e3f5fb90
-
Filesize
10.3MB
MD5480bcbfd7d00480eac1fe7cdad928c44
SHA1a56788852992ee6ab71ffe6a15c18ae967ccc203
SHA2566cb5d78ed9b22f9d3c7c2215c70f57d5024962175d84011bd9590e4318f2d80f
SHA5120a7443fe1f55ded9a23df592da5bbb541cce459aef15c830805d3f48c73dcc8412ec18ff93531173da18927134fcdd6047661a4af3d5f55e843f25d1e3f5fb90
-
Filesize
10.3MB
MD5480bcbfd7d00480eac1fe7cdad928c44
SHA1a56788852992ee6ab71ffe6a15c18ae967ccc203
SHA2566cb5d78ed9b22f9d3c7c2215c70f57d5024962175d84011bd9590e4318f2d80f
SHA5120a7443fe1f55ded9a23df592da5bbb541cce459aef15c830805d3f48c73dcc8412ec18ff93531173da18927134fcdd6047661a4af3d5f55e843f25d1e3f5fb90
-
Filesize
1KB
MD57aded013c74be010099ce8aa161b1e23
SHA1f5052c44c3e0d184ce9d401acdadee6e5c16803a
SHA256b4de84a6088db0f6b34b77f4819dc6c1b7f8ccceb65c33b2648706ec4f03272b
SHA5122d36182b68287f8c0778bfcb413200fc7bf90f5b3cfd1d7ade3779440c235ec19799a6a489a659c2e8b85b13401f6bd4d4a724f688bde780f8f3c86b658ec950
-
Filesize
2.6MB
MD586e2b390629665fbc20e06dfbf01a48f
SHA1d9f4697a6f4eceea24735822cb1df501268ca0b0
SHA25646e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1
SHA51205ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea
-
Filesize
1KB
MD5a9306e38bb978bdd36b26d5c0e68fa06
SHA14b80f8c1306f4d5687d51fd30e9513a73efca264
SHA256268fa650496a2d20c9a8d08719da6737a85b88b7f9549f8fa60e2aa2264c4c86
SHA51282c87405cfa58c383e7472857ba9e5eff9f90b075b2eb26cc4b99ab11cc042a06a9c385facb2918685e047215573233b30a75c6d0d93d9fb8617f23262c2f673
-
Filesize
1KB
MD53170ba902ea3b748103fd662b5742a6e
SHA1ee7761919f609a2c6ac56c42e8f02f4c819fdcf4
SHA25679df254f3f3afaf1861aefae760dd70f4fe6c507909ca3ba3724479eab861e29
SHA51259034eb406e954f72ab09a022ccd53d2c5569fc425aacb64eccfdfffb75554956654e74472824c3e1bcc96b72ff0e530611e24ba57d11bc9ecd8f05aadf2fe26
-
Filesize
1KB
MD55d3b2a67c313c3ae6ccd130e546e0959
SHA1d9188b2b6a3724edd4c5b9da0c8f22047183c913
SHA256bd122717680d42e7287aa0ed55fe37e3652fd45553232ac4c8f0c7d5ee3fa3ff
SHA51216c2339f79aeb3a64cdbb9e0d2a4eeb42b7afc70c3e4865dfcb71d0ca86c2617f63b159514bbcf414f4b982fb46800e68dd151ebfd210c390f792b90f85c2e51
-
Filesize
102KB
MD5cda0a264757834dca56a62422bbc8262
SHA1822eb6f338a080ab3d5fa6aa57ad06cf652f1edf
SHA2561499087f081f31a4910780b87f65b98fdb51eecf9bf171b4a1ad5db87adb4c5e
SHA5128e95a584ba5a1940f139cf7ee258e6a64174c70bb934988309f854d64a59289c7de2a7a56803f39036017c49330c30eee1580cad1eb069c157183a10f9dd4be5
-
Filesize
770B
MD5be27f3cf33ce1536dd46fc784df02fc4
SHA1a357666525f3ea5c84c985c116987f1f2bd4f7c7
SHA2562b9b9e61373f72d2efb6a503120a96992e74c91cf5398dfd4e534481823045e7
SHA5120faf1840dcae7dd071282b120e452a8571d81f637fa067b804c56de22d3084eb247df3f454607012eb3b5338f5e8bf5eae6ccad9ebaa9437c6a9cf28caca067a
-
Filesize
1KB
MD549d080badfcb3cb76958257c14c5bf92
SHA1c44163514205ccac0edad80bd5d7d55032f8c64b
SHA2563ad5ac1a6cc6b84f5e45068396999592031d3de3d9111f932405257a727f96ad
SHA5126b7723b8054cad74abbfc6582e131a1da9f12f85b726c13ec2cfa1cfae7d6d47d91b6436cfb40f6d6994782805de0ea770570de834ccc7dae57350df03097d3a
-
Filesize
267B
MD578f36b85d4d4a1c5b5132a79f6539dc1
SHA108787dd0252ed15e74d6474672d4fdcea3772b00
SHA256c176760f862ef58c6339ff497740d17f439cd3f1105af3de4aad60c164a72a2f
SHA512093a78c1980a108a63350b2410bf786720b07887b9cfd23d1e8e2567fdf19d48fe827f944e9a46fd9b2bb6127e85a018dcdcf656e968fb9dc9c5b8576f493b3b
-
Filesize
489B
MD5bf09951f73abf4a8eb88a9adc3f4405c
SHA1b93f8f73ef7cca09f9b63955b3b384caa3112e77
SHA2567cface45764acf3d93cac17965a001471e23944323ccf0e01a30972e7e511370
SHA51290197bf55cec02c183aa4e9f5d2af2c44e9daa672fde40fdcbdf4186386ece85ffc4e8f3ad0c60c07acb582e6c35195f93f44fd174476e752e495e7c6c9517c5
-
Filesize
823B
MD52b3bb5f256bfa0ddd73c349e8ae20310
SHA13d356b0ce64198ca8419cdbcb25fc93fe5adb136
SHA256e115de560e98872f17e271d713a4daf1a18a745071c960e1139e136ba184862f
SHA512ad64614fd47d99219f7631734c1482a899a2f3c648073312e3320b15f35faf57c40267f29c123c59c7d9021ca098b9fd8463201d6706faf7cf9a16989df7ca4e
-
Filesize
245B
MD53cd8b19ba2796cf3310d8b592cb76e5d
SHA10e26f535cfecf6ccceb919df514ccd3e80e21325
SHA256339f6d2288fa6822c28b412f067ad8ce81c076a8d55af8c1390e0ed9b4f465d5
SHA512ee7af0ca8673a0d3c6690c94755fd35f6b59c6d9544881f1b4c946a5ca921bd6f1b4f387ed4134c39b00dba0dd950c1f13bb71a6c9d829a8d858688b66158268
-
Filesize
1KB
MD5bd4d726d4da8ce648fe5a3e99b1d94d6
SHA16336759301cd5642fa1c703cd86c5c65db1fdfba
SHA2569705566585f3a57968483fa6e2455ca5c144d360ca6069305d1bb086cc4c6d9d
SHA512497a12f53adfdbf46b02178e0d5a03782a6cf3051d32b8f24e21d8fdfb364214d62129a2fb7efb36dafe32458d0e3324ec38f6fa10c9c79ec9503a1b69ce6022
-
Filesize
615B
MD5df069a5a885a1bbea3339d9efa9f91c7
SHA1c5ade3a1af4d2e2cd57ff2a33928a6c75ca59437
SHA256235d7b4ab38274e7ead460ece92cfd9ea1c2502a2abfd2d9b8ca544b4c9f7797
SHA512ac47adccb1d3fdcb6a71e4739a8c438de8e2855d67e03a4b0a8ffc63f2ebfa02b4ab011fe683de9dee3675ca30f04258c9905f116a5d9c87b106a4975241e63a
-
Filesize
281B
MD54d392a0946827656c57745fb43432df3
SHA1eb9d0aec190d4018cb117a89826d706a5b9c47f1
SHA256d815dc663d3004ea75ca6d19be08b792658ff055a8fb580380c249ed996b9957
SHA5124a007ab0f2e33bd41bb0ed4d57fc5a2c8216bc9eba3495c88c38a97d0fd2f8fb8afc230b366df33b14aece1b15325416e26c9cf966b3032da350f74fd4ea8d9f
-
Filesize
267B
MD591c10ed1537ae6251380c0f8aa59ddff
SHA10438fffbbc81e6cd9660ffd80af2b772e3cce081
SHA2560763f6aa9c7f4b2d3bcd86242f44068c9adc63c95d4754597aac797f1d1e1324
SHA512adc7d2d1c3a748ff533e55d9378cc43578791a2807b1ee25411f465b11938725bca7287f2622abccb70fc4a065a31c387bc7dae78004b6620ef1e0b92199bc01
-
Filesize
1.3MB
MD522277c5bcba6da2a6e4092cbc517ce59
SHA110d2e327123973b00f80258458c453eaaccb68e3
SHA256e24cc86d09c27e2b365913a662181636292381eb74daebe8400da4079eb0bc94
SHA5128fb887b1f6d24348c281590aaef489a772a253589f275d894b59250eed408ee6453118d454817d02ac1f7023d11904724e1872018a3a1ad9a0a5b542aaa42007
-
Filesize
2.6MB
MD58e4a6e33762f41cfb4033e7bf9005cb6
SHA13f209562ed82a5a57abbcf0b2e10aa46a9200448
SHA25628200a3561d896b8a32887bd081a040ec3f74e534f4e79bffd2094e3f9069f65
SHA512823f5a04f22c8889564fffa3865fb84a3cb49585c3a79cdea7487ad34ade5d6616a4819b6e3d8591f808a6fec6b4e2e986dfd77e222bd86faaef678277c443a2
-
Filesize
2.6MB
MD58e4a6e33762f41cfb4033e7bf9005cb6
SHA13f209562ed82a5a57abbcf0b2e10aa46a9200448
SHA25628200a3561d896b8a32887bd081a040ec3f74e534f4e79bffd2094e3f9069f65
SHA512823f5a04f22c8889564fffa3865fb84a3cb49585c3a79cdea7487ad34ade5d6616a4819b6e3d8591f808a6fec6b4e2e986dfd77e222bd86faaef678277c443a2
-
Filesize
1.9MB
MD586e39e9161c3d930d93822f1563c280d
SHA1f5944df4142983714a6d9955e6e393d9876c1e11
SHA2560b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
SHA5120a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
-
Filesize
936KB
MD5d1bb2c4947c150a5922f8d2530a978a0
SHA1ed34ac4453795e583c3c210853fa20a229280fdc
SHA2567c5456772c1feb74850ef6ce914d98713fa9cc0be8552423f23b4a3ad9f9956b
SHA512aa0cec8804d9e5505b6ddad65b0f022a6b8e123d3483ef918e5e40f21b081f849452dde39ede836ec282efc6b2d671269aae9764c19a446f445469057b72a9ce
-
Filesize
936KB
MD5d1bb2c4947c150a5922f8d2530a978a0
SHA1ed34ac4453795e583c3c210853fa20a229280fdc
SHA2567c5456772c1feb74850ef6ce914d98713fa9cc0be8552423f23b4a3ad9f9956b
SHA512aa0cec8804d9e5505b6ddad65b0f022a6b8e123d3483ef918e5e40f21b081f849452dde39ede836ec282efc6b2d671269aae9764c19a446f445469057b72a9ce
-
Filesize
1.3MB
MD522277c5bcba6da2a6e4092cbc517ce59
SHA110d2e327123973b00f80258458c453eaaccb68e3
SHA256e24cc86d09c27e2b365913a662181636292381eb74daebe8400da4079eb0bc94
SHA5128fb887b1f6d24348c281590aaef489a772a253589f275d894b59250eed408ee6453118d454817d02ac1f7023d11904724e1872018a3a1ad9a0a5b542aaa42007
-
Filesize
28.6MB
MD50e4557ff6284c74f2096cf8c70210935
SHA1b4caba3b509707767a8b5ff5901c4827c5f698c3
SHA256423b897bd250df587d75a411c867d313529f16307120b2c0b0d90663066d0c7f
SHA512ac3d32246bfbe7c33bfde9d1b7dffc5ccc755d4866c1939f03f34511c1acdc2621c9bd361c24db0275e68a6add69a1c72af2ea7eb12ab45906b662c9eb19b8c5
-
Filesize
28.6MB
MD50e4557ff6284c74f2096cf8c70210935
SHA1b4caba3b509707767a8b5ff5901c4827c5f698c3
SHA256423b897bd250df587d75a411c867d313529f16307120b2c0b0d90663066d0c7f
SHA512ac3d32246bfbe7c33bfde9d1b7dffc5ccc755d4866c1939f03f34511c1acdc2621c9bd361c24db0275e68a6add69a1c72af2ea7eb12ab45906b662c9eb19b8c5
-
Filesize
175KB
MD5681c4f68020521ae38ce6998fdfbf09a
SHA136253533c1fdab1bece8bf8cdae5da28d585538e
SHA256d25a1aa4a8bbab4fb7e6216b648b073d18b8e668f7f10e2390dd6204d504a2f4
SHA512fd16b07c160ca484a1d3ab13185bfe9fcd124e219d4a6d314e5882c070c7575ece0c31e3049c84432e49641b52ef199872668c526e2fdc4c0641e8e5b4ae04c2
-
Filesize
175KB
MD5681c4f68020521ae38ce6998fdfbf09a
SHA136253533c1fdab1bece8bf8cdae5da28d585538e
SHA256d25a1aa4a8bbab4fb7e6216b648b073d18b8e668f7f10e2390dd6204d504a2f4
SHA512fd16b07c160ca484a1d3ab13185bfe9fcd124e219d4a6d314e5882c070c7575ece0c31e3049c84432e49641b52ef199872668c526e2fdc4c0641e8e5b4ae04c2
-
Filesize
3.9MB
MD5b699e92259e963082f2d8b527a9d49a7
SHA1d0f6c40e367b3940957fa9c523e94485079218fe
SHA25632783c830a311429f6e6469c5fab9456d2ad65b13cadfc6578dba858becf2e1f
SHA512fed1e538eac049e60a6614bac107db3c65a9145d4d2138aad3da026a574f6035e8926c88e619790b29fcae0f6510aa6a044de2af291ea822f11b5d90a1b6fa81
-
Filesize
3.9MB
MD5b699e92259e963082f2d8b527a9d49a7
SHA1d0f6c40e367b3940957fa9c523e94485079218fe
SHA25632783c830a311429f6e6469c5fab9456d2ad65b13cadfc6578dba858becf2e1f
SHA512fed1e538eac049e60a6614bac107db3c65a9145d4d2138aad3da026a574f6035e8926c88e619790b29fcae0f6510aa6a044de2af291ea822f11b5d90a1b6fa81
-
Filesize
657B
MD5cacd85a493cb94b685b1ae9ed9057bff
SHA1d2ba370521cfb5305d563197ee8052590fbe601d
SHA256e432cb999303253092c4eb66ed4aec503e9eea02c371e11a9b9f7425f8b80719
SHA512a327ffc4694632a0db83848e661a41960fa7f074247c477cf08e80564adc7b6d238d71c9770cc04dd18ec9293c259f701d029df73c6e8a64f8fd60165d157a39
-
Filesize
2.6MB
MD5da481f3e7a22e87b4b2df68e286482f2
SHA15bb7d4b848f7c7d22c78587242c54d70ea678c23
SHA256f33068093c66976ebcdf3babef6397c15c5ed58c39c19b74a971178d341cc03e
SHA51264564ef5a5f8a676677a0c908f50187dfa29b0497eab2d0d95520ee3e8ad8188441234f1418ceb8a015534a0550b381813cc90e8509d59d4a7268702afc2d1cd
-
Filesize
381KB
MD55ea9c80f18cbc393ea7d9a2991ded4b5
SHA1b8917c5ae45d1ba5ca534058f1386fac92f5da63
SHA2567e5eb1ce44febe93686174058d51581fa00bdff0ebb84bd74bc08f6386019253
SHA5127fd949b792a40630ca385dd2bc88db9673f9106975b9f55481e2382f67986dd75b03cdf0fbf59846b513a8def0c506ac6561f6ba658775286f11d761b575513a
-
Filesize
119KB
MD5f6d02735de16705c1ebe6429592cd355
SHA1c6ee693de2c01cad34012471b70d87869969a0cb
SHA256356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4
SHA5121e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13
-
Filesize
119KB
MD5f6d02735de16705c1ebe6429592cd355
SHA1c6ee693de2c01cad34012471b70d87869969a0cb
SHA256356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4
SHA5121e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13
-
Filesize
119KB
MD5f6d02735de16705c1ebe6429592cd355
SHA1c6ee693de2c01cad34012471b70d87869969a0cb
SHA256356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4
SHA5121e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13
-
Filesize
119KB
MD5f6d02735de16705c1ebe6429592cd355
SHA1c6ee693de2c01cad34012471b70d87869969a0cb
SHA256356c49c5e1328fb181c295a84292471c566e11099e46d7a34c017931863d86a4
SHA5121e37adcdcb399f1d9f84599dcd4254b7da342f6d52f6af7faf51fe618c96fbb3754813e97cf7c5ec224dac58d341658d8422dcd8bb26549bbf4952251353cd13
-
Filesize
451KB
MD5b5c2f92ee1106dfe7bb1cce4d35b6037
SHA131070ef84c5355b082873ffc19ff60659637995f
SHA256e399c390687589194d8aad385055f0cfa7d52ad9e837d8ff95008b8eb2b34e50
SHA5127f82752b271ee35bad31a8571ae33b8cc83ef48f41937297dfc446f6f9b12da3d8b8336a527f6bbc5bc3c6627deadbd38a5f109b16c7d1386a3db36742c5a9c7
-
Filesize
451KB
MD5b5c2f92ee1106dfe7bb1cce4d35b6037
SHA131070ef84c5355b082873ffc19ff60659637995f
SHA256e399c390687589194d8aad385055f0cfa7d52ad9e837d8ff95008b8eb2b34e50
SHA5127f82752b271ee35bad31a8571ae33b8cc83ef48f41937297dfc446f6f9b12da3d8b8336a527f6bbc5bc3c6627deadbd38a5f109b16c7d1386a3db36742c5a9c7
-
Filesize
130KB
MD5eaaa2b83c4764fdcfbee4a4d6546de92
SHA1961a7e7735ee8f07ca54fa7cbfb23399748f8174
SHA256043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b
SHA512bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3
-
Filesize
130KB
MD5eaaa2b83c4764fdcfbee4a4d6546de92
SHA1961a7e7735ee8f07ca54fa7cbfb23399748f8174
SHA256043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b
SHA512bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3
-
Filesize
130KB
MD5eaaa2b83c4764fdcfbee4a4d6546de92
SHA1961a7e7735ee8f07ca54fa7cbfb23399748f8174
SHA256043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b
SHA512bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3
-
Filesize
130KB
MD5eaaa2b83c4764fdcfbee4a4d6546de92
SHA1961a7e7735ee8f07ca54fa7cbfb23399748f8174
SHA256043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b
SHA512bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3
-
Filesize
130KB
MD5eaaa2b83c4764fdcfbee4a4d6546de92
SHA1961a7e7735ee8f07ca54fa7cbfb23399748f8174
SHA256043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b
SHA512bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3
-
Filesize
130KB
MD5eaaa2b83c4764fdcfbee4a4d6546de92
SHA1961a7e7735ee8f07ca54fa7cbfb23399748f8174
SHA256043779b2c684699c89d6e8363d65baa9f31dff17d250059b56a8e3ae48c89b5b
SHA512bc569de847db42bc2b1bc0a6ee0a792269b1d7dccffc8a5f0f6130495cabb8accb5ee312a0c749ccc13c395e4969a1a5738132ebb41cfebfaaf41126ac9737d3
-
Filesize
17KB
MD5ce9a2f5a7fcfff341d6d901ad919a2ab
SHA1341f9d9a0b3fd8cfbefe0169b148dcc55688ee93
SHA256cc36a44467f41cf2dc91c126e368e357b28a0d57101472d2dfd1c06a4091cdf7
SHA5121f53e652b042ee27fe05b11ccda2ed9ae9a8f44b948b8658aa7a2d7ad2f5bd94ea16f3d9a92e65a8c65b7480517f1d05a066a4fb8d961b927d0d305399ca4e8f
-
Filesize
152B
MD5aaeb1f5e097ab38083674077b84b8ed6
SHA17d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2
SHA2561654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef
SHA512130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD573066d04878e7d00c33033df2f44c788
SHA17495c647547675bc446c72a8015f8cc9a040e363
SHA25692d9c7f664bfb85097ad178c95af0cc7944c16e228ab4355ef73c9a2ba2ea89b
SHA51228662e9990c0e4f2dfbae6b2df25f5e0e14cd2640fe693d19cb6c9b785909dfbd819513c88d0aaab5067e5a11314548755dbb8d4cbf1d214ea056ca188d35560
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize552B
MD59d76508a62976cecbd2459b156de3e70
SHA1c66bbe3a8a519ffcacfceb2f156b34e323d1ca06
SHA256698ec22848afc90742b3b9298f12dce252cc1f31e08b4449723217f35db12174
SHA512ed6c6fd558c344c88d03ff4e76be31c3859459e29b01083fa16b1fd16fe38f690e4143b4b706e9d6fc230afc8bd163327b97ce932e89a3d4b8410833ec2458d0
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
2KB
MD57689914e443e34e7cc93306a9d88fc8f
SHA17e6337515a6b77486bf6a8b9d4f73128ca0d212b
SHA2569b503d9a096a00bb4cc9ad25d40dc292b204c8030581a91e77a28137c1a92e15
SHA512e6d6dfdc90507f8d61a44a1c5640a35e698f2dc8217847627768a5a2030f82be2e93913c078986a621c6c5154bd2817e32741b31da224007cf88d869fc4be373
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1KB
MD55c7ced387733e1ce60694d794f24cf08
SHA1d5bb8f98709bcfcf176ff2b6f7e9cdab42164acf
SHA2562feea9e884f81c15b4cad8b9a4270c94d79b81ad9215613112c72812f8b877aa
SHA512e95c2a52d045640c83b44febe2e0c5abfeab5e562a15cb57af101ab1765565262553733eb2199e32a8f3c08f9032dd31f215f91e0686c5f36fcde39b41c41362
-
Filesize
4KB
MD54e5decbb1629f34bce96f58d2aaf5c18
SHA1635483b85b047ad340e21aa6d595df1e60200723
SHA25682250ca5443cbf239f935a63c184ada7d8e0df70a2d82015e8efa1842decce39
SHA5121a3fedc658adef7a28be9cecc42e0203c6b380180a1ab823bb2149e53a9e20f443d3d473cbd98be425008fa3fc32a884712fa20c7a62c9e157e39f53529b477e
-
Filesize
7KB
MD5c89ff81b4b5fa5b7d974e6b9c4165e09
SHA158679769885e77cc131d7b867ee49728260d0934
SHA25698ec9e95f502aea5c9e4b033128c33c6791af895ded77f3c0e08845c6e72bcfc
SHA512552bcafc2db69277793e8fecc41aefe338554c38fcc9a8b7638d0cf2f8d0409bae9c8de9c2e82c963a187364fdb7d3868f3d4ffaef9f42ed55284d35ff4a72f6
-
Filesize
24KB
MD547e94a96372e6f095b8a3fd7edc48ec0
SHA1377b68f34e5964ca8be1b1b0c1507dd7f0e5f005
SHA25615c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e
SHA5125bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
9KB
MD5efa046efb084cc2a0092c933c8ecdcd6
SHA1004171becd48860a27bb06ad21d80546370fc1db
SHA2562f7a739f85b10277dcd7be6aaf942b1155335e8992c685df3920274556b964b7
SHA5122b93995327e585ba742ba95f424ffdd347e07802d783389c5dbbbb47c18fc4bb7e1efc1fce468d5fae4e347b44a00c96fd416fd2d7432b2e50044ef92b5bcd12
-
Filesize
10KB
MD5f4003ab5f541d80bb0a588619e7eec0c
SHA16979c5f8dcdf18c5104ae1c9b7c85ff12897d5ea
SHA256f5e45723d7490d03754500de484a148dbc8b7dfbc8469429a619833759bd623b
SHA512e2cf3907973ae52e722a41386d77c3b3330959364b0568aacb50b46a732621e9123717e0148639eefd07e2951ef68e5b2b0f8dcef1d09f58dae37fa9d993c2c0
-
Filesize
183KB
MD50bfc8be49343b69a309aad64d55d03c2
SHA1a4c61c2a7a7c15a98e96cf366776a7bc04886fc1
SHA25614a36dcf7714cc85c45dd2261d52220daf0d5993cc4f64ebcddcd8a6691294e0
SHA512fa1c8432e1710b1a05f2dddbc63337489d6935aab0e10a39b380d507eca3a28b2417617bbae70b5d7296017e2e6173fb0c0acb6c99772c4bb2dcef9cc93db5dd
-
Filesize
128.1MB
MD501ce68ba37f5e3be70262a6e1fc35d60
SHA1348763682ede4910815eafdbeadaf208dca94771
SHA256a98225ed39d88b6a39144749a807c3df720eaea87fd289c33a1ad8d9e338dc24
SHA512c9ae5dfd9de63b652364e71ba4632b225063267a03590880de790fa9a95c46abbc9540e1d383bb51da5e6c9deb8eaf2e31f94760507223f87bd8ee442348b109
-
Filesize
128.1MB
MD501ce68ba37f5e3be70262a6e1fc35d60
SHA1348763682ede4910815eafdbeadaf208dca94771
SHA256a98225ed39d88b6a39144749a807c3df720eaea87fd289c33a1ad8d9e338dc24
SHA512c9ae5dfd9de63b652364e71ba4632b225063267a03590880de790fa9a95c46abbc9540e1d383bb51da5e6c9deb8eaf2e31f94760507223f87bd8ee442348b109
-
Filesize
128.1MB
MD501ce68ba37f5e3be70262a6e1fc35d60
SHA1348763682ede4910815eafdbeadaf208dca94771
SHA256a98225ed39d88b6a39144749a807c3df720eaea87fd289c33a1ad8d9e338dc24
SHA512c9ae5dfd9de63b652364e71ba4632b225063267a03590880de790fa9a95c46abbc9540e1d383bb51da5e6c9deb8eaf2e31f94760507223f87bd8ee442348b109
-
Filesize
2.6MB
MD5da481f3e7a22e87b4b2df68e286482f2
SHA15bb7d4b848f7c7d22c78587242c54d70ea678c23
SHA256f33068093c66976ebcdf3babef6397c15c5ed58c39c19b74a971178d341cc03e
SHA51264564ef5a5f8a676677a0c908f50187dfa29b0497eab2d0d95520ee3e8ad8188441234f1418ceb8a015534a0550b381813cc90e8509d59d4a7268702afc2d1cd
-
Filesize
2.6MB
MD5da481f3e7a22e87b4b2df68e286482f2
SHA15bb7d4b848f7c7d22c78587242c54d70ea678c23
SHA256f33068093c66976ebcdf3babef6397c15c5ed58c39c19b74a971178d341cc03e
SHA51264564ef5a5f8a676677a0c908f50187dfa29b0497eab2d0d95520ee3e8ad8188441234f1418ceb8a015534a0550b381813cc90e8509d59d4a7268702afc2d1cd
-
Filesize
155B
MD512320b56fad8a52d1fc409d7977637db
SHA1dee01db8bac192d111d16d3d4505e2464bc6746c
SHA256daa5b50a7973dd0c49f0cd5f90c2351617146cdc0408e99cf7fcb219d0703299
SHA5126760d9257eefd8568fbd640a99ed24f4e91b91f6f323ffc7103008084ffeb33e869daf265d74670d62723de771410f5e68d3b9accdef35829068ee0a0fe8e48b
-
Filesize
130KB
MD5f7b445a6cb2064d7b459451e86ca6b0e
SHA1b05b74a1988c10df8c73eb9ca1a41af2a49647b7
SHA256bd03543c37feb48432e166fe3898abc2a7fe854b1113ee4d5d284633b4605377
SHA5129cf6d791132660d5246f55d25018ad0cf2791de9f6032531b9aca9a6c84396b8aeca7a9c0410f835637659f396817d8ba40f45d3b80c7907cccbe275a345a465
-
Filesize
27B
MD5f68ed61a36e0da7f328985c3f415dfcd
SHA1b0ad1b38e86a1b2f419d450e57f58888e50c4c89
SHA256c5f037ca6ef13242c30ddd84f07b1b74a83c343faf5ae40a3c2427f5d4064710
SHA51255a4a25d58b283dee5d66d70c730e213150617ade700d832a7d7c655f018f391a96d8590d988061587ee5eb61050c6faa42bb2384f9dfc4d0d2c3d6ab0c7ba83
-
Filesize
167B
MD57854e4b691005b1c33b73348272cae82
SHA1f6838897788d80dd119c32aaa4bddc9da8ea45ef
SHA2564e61b58027947d4226823288fa642b17994f531678246da092efeea0f97c84c7
SHA5123b6c51d381e29acfde98fe809c289de18dc9bfad671cba034eabd28e3b24fe99b1d81525010981000e157693e1c1e10e6cc8fab6b9d4c844ebbea824b713b518
-
Filesize
1KB
MD53794ed43c2874c54a47a1afbc3e30805
SHA1660604538513ce3ffe23f10d5690276dc020dc65
SHA256165af24282dea83650e696c8cac419228b2d965df8056145c7b3420da638722c
SHA51215cf899eb6331bba7d790647f72da873551629842571f6a19d440628847c359ccc457ee89c9508347be4e11c1d59b2849c6d756dd633217d1581dd6749945635
-
Filesize
1KB
MD5803bd1e7cd1cdba1f7dc23dbb490246b
SHA1d3d1efe8b2fdca1415df8b1b2a0e014c15950f96
SHA256bf307b5e7df8f051e208e93eacf1546f2329f64710ee27d6e1a1f1d9add065ce
SHA5123d651578258559c8e62fac3976d75b2e205f7814ae5dbb5a14089a8ab81b25c8009014d298da202ca30dfe29d5e58bac66b35ad94f4b2fab69d27fe15fdd1cb2
-
Filesize
2KB
MD56d58e55802146d8760fe9846fa4b3c63
SHA1acc1f66fb9e4d73b846412c18fe0effd021556c6
SHA256d5e50153222fbbecac2efb6e08e7ec06fd9e4f2f195dcccab44b5dc54b3963e5
SHA5123751cf538daf1169445b7cbe4942308d89573c801222defaf7ce0a6c2febb67df31bd5085d4298ba3cea8b7448bff779e6a4a34dfb3d11e0643be4d99eb3466e
-
Filesize
123B
MD5614c8b803316ab68f6626d0c4f1d029b
SHA1214083b0e614bc4a1811b4397efb9f72de920cd0
SHA256a7cd4e39f71a7aef7bb0a9c09642a83b16ae1e6374e1fff9f337253ef370a2ee
SHA512954b21d1aa6c8ec315fd8cd0d1d21b42b4170b038b275547a66368c80ce5193ad89e0fcb6acf552857d0ac300176e715c1972f863a26623fba56e2b04b478e92
-
Filesize
167B
MD5542f6db5985644ec514c6a77d0554a3b
SHA1b44302deb0f1f2c338360469843800bf4f078341
SHA256ef96087cf44efd5a6d9d8d3d97ff4140f66fd00c083a534d8af81540d34ff435
SHA512a71416bac8801c8b23f4731b3f8428c4c04dca51eea8d81d84b62e0e05d406a79c2b42ce90958ded9a4802f335938bcabacebf8980d0e79afebc6f3ee6d9dc6b
-
Filesize
167B
MD57854e4b691005b1c33b73348272cae82
SHA1f6838897788d80dd119c32aaa4bddc9da8ea45ef
SHA2564e61b58027947d4226823288fa642b17994f531678246da092efeea0f97c84c7
SHA5123b6c51d381e29acfde98fe809c289de18dc9bfad671cba034eabd28e3b24fe99b1d81525010981000e157693e1c1e10e6cc8fab6b9d4c844ebbea824b713b518
-
Filesize
189B
MD562923fa810ecbcd330c8143c195ad20c
SHA19dfc840c588341fed38dd6455a1804ad3b253eaa
SHA256a9f83f6eaf55a32d8b8b72af48928380542e986870ca9b08360472bbfc1be9d9
SHA512663e4ea54ec48c88125287832c15b52a3f8b82ec5956f4d000e1fe648564b2e9198ebb27cfa4e6694667e608879f92ad0393633bd06885f46fa2ac12d3fb6e52
-
Filesize
1KB
MD52535070882778cf21312a92219f7774e
SHA16a6ed18c1d77ad17d704d17b37c837fe73d59ab3
SHA256cb7889a62128ea9cf3f5a8b97337f64560f39c712393bc498a0b892b137c0479
SHA512eece9fe06df9a0cbd1af9c0db3f19c92b9bcf01386fd63702f1479087f0c49ce0b2301d72e8726718ce1b3430f25b561c574f627704224781c6a27b4a2baa101
-
Filesize
1KB
MD53c5a16369f93b52b293aa01d182b8be3
SHA1d72e0e45f64077f47085e62e147669bf404cb1d2
SHA25671b06d84f376cff412e49ab6fc66b6b23251d1edd7230dd415293d5cf0935f02
SHA512ee1d1a8476abae3262f343fe1f6f257deb46bb82f01427d0c38a06710aba6085e5d9d5c104bd7c115845b4e27f4f67bb573c9261d17cf12e021bb8f83f62a40a
-
Filesize
635B
MD5c24b80c762aa6f683682bf599ad70880
SHA10db6969b07a0231f56317c81a3e3acb9430a2a4c
SHA256255b7f37a5160114caae56377b61d0dadba29ac09967c8efae7dd57a94d76bac
SHA5129a3ee57caf79e9582fa70067ce0035fa855e789ab5d722ca01f4a15a3f93c081c9e9870b3d454f2e54a93c352e12352ea452da667711e8decff0da39fda1d5a9
-
Filesize
5KB
MD53f9cfc142682ce84516a1e7ab3e31d37
SHA1dc82ed1eebd93dd87281d021206f25626c4924af
SHA256c9bc514436d3b0ad007f88e81f9439d01f9f11fbda35190983be147e834b538e
SHA512b12aa936517362aab38b13bad03d0a7364530283277b9c6f80c4fc49d477f1e81cd064d2597ddef3e48fe60b29d7a211f148a080ada284f5fa68398598a2a1bf
-
Filesize
5KB
MD52f1c4392be69ef13bef3984350c4aff9
SHA1eeffbbdfd0361ee03c4ecbd3a7b3ac93cc709790
SHA256cd44d5c4ba72ee683d64c28189d5ef076d9c4f04d955fde0ea119b7e9880cc47
SHA512e0d00d2de111ce1a13ad75db89da00e40270b866c8dec52039c336f2efbe441c198378ae1cd52bd0032c9b1f724163e3f85651108399bee10107a4fffce57824
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD5effc41a548055becda31e5ceb254c661
SHA15826be96ea2911c3c579550872415527c6772b90
SHA25698f581379e2dae49fa44cffd8b0f18d601de639c0cced4820d42ebbc9689b33b
SHA5126eba51843df983059dd79a8aa4d37b84b5610233c7c5a87565fd88be460ea9d375c1894403efad477f5adf8d60a881ca497a3ccd06f926c7d365cbb538b53176
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD5bedc9ea6626f92cb06268f4e63c0c987
SHA15f048cc53bb6272f7ddaea38228b8fad85864e26
SHA256e0146c128708c2ddcd8db9e7e9cfa184fdb71461fcbef301634c20a357c3e265
SHA512d94444790abf9e34f88f13e1125efdea3685d1d57399fbc16ed45681d9d87133899cca69ccfeddae091b29050e91cccba96b2862ee8eeb444b041dfa72b31414
-
Filesize
76KB
MD5950087e828e1b7426f703678e446c799
SHA1c9f28be9b9f810132ec8d78c161e5a232491e60e
SHA2568a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee
SHA5129ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93
-
Filesize
76KB
MD5950087e828e1b7426f703678e446c799
SHA1c9f28be9b9f810132ec8d78c161e5a232491e60e
SHA2568a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee
SHA5129ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93
-
Filesize
76KB
MD5950087e828e1b7426f703678e446c799
SHA1c9f28be9b9f810132ec8d78c161e5a232491e60e
SHA2568a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee
SHA5129ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93
-
Filesize
76KB
MD5950087e828e1b7426f703678e446c799
SHA1c9f28be9b9f810132ec8d78c161e5a232491e60e
SHA2568a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee
SHA5129ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93
-
Filesize
76KB
MD5950087e828e1b7426f703678e446c799
SHA1c9f28be9b9f810132ec8d78c161e5a232491e60e
SHA2568a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee
SHA5129ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93
-
Filesize
76KB
MD5950087e828e1b7426f703678e446c799
SHA1c9f28be9b9f810132ec8d78c161e5a232491e60e
SHA2568a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee
SHA5129ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93
-
Filesize
76KB
MD5950087e828e1b7426f703678e446c799
SHA1c9f28be9b9f810132ec8d78c161e5a232491e60e
SHA2568a41eaa0d699f48661c2560aeffe4b0432cf755f1b15e31ac9aff667d498b3ee
SHA5129ab24bf84a4534e219df132a0b43874c1d6410ef802c69e65c5aaf3d0c46085470690851ef23303f9a48076e8ae552d816903e02c43c1af83e6fc3457d2acb93
-
Filesize
75KB
MD56f8e3e4f72620bddc633f0175f47161e
SHA153ed75a208cc84f1a065e9e4ece356371cac0341
SHA2562adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
SHA51280187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869
-
Filesize
75KB
MD56f8e3e4f72620bddc633f0175f47161e
SHA153ed75a208cc84f1a065e9e4ece356371cac0341
SHA2562adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
SHA51280187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869
-
Filesize
75KB
MD56f8e3e4f72620bddc633f0175f47161e
SHA153ed75a208cc84f1a065e9e4ece356371cac0341
SHA2562adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
SHA51280187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869
-
Filesize
75KB
MD56f8e3e4f72620bddc633f0175f47161e
SHA153ed75a208cc84f1a065e9e4ece356371cac0341
SHA2562adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
SHA51280187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869
-
Filesize
75KB
MD56f8e3e4f72620bddc633f0175f47161e
SHA153ed75a208cc84f1a065e9e4ece356371cac0341
SHA2562adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
SHA51280187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869
-
Filesize
75KB
MD56f8e3e4f72620bddc633f0175f47161e
SHA153ed75a208cc84f1a065e9e4ece356371cac0341
SHA2562adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
SHA51280187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869
-
Filesize
75KB
MD56f8e3e4f72620bddc633f0175f47161e
SHA153ed75a208cc84f1a065e9e4ece356371cac0341
SHA2562adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
SHA51280187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869
-
Filesize
2.6MB
MD586e2b390629665fbc20e06dfbf01a48f
SHA1d9f4697a6f4eceea24735822cb1df501268ca0b0
SHA25646e31e284da64d6c2d366352b8a8abcf7db28d3e2a870d8fcf15c4a6fe0a6dd1
SHA51205ecd3be5779f39db09329dda4dce0e3c49ac5d3950e92833031622b53542dadbe9e2948df35faeb4c41dbc8e01992935087c4a2975c797bd008ae177f7c3fea