Malware Analysis Report

2024-11-15 06:02

Sample ID 240930-wzlv9sshnd
Target 020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e
SHA256 020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e
Tags
rhadamanthys discovery spyware stealer persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e

Threat Level: Known bad

The file 020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e was found to be: Known bad.

Malicious Activity Summary

rhadamanthys discovery spyware stealer persistence

Suspicious use of NtCreateUserProcessOtherParentProcess

Rhadamanthys

Sets service image path in registry

Event Triggered Execution: Image File Execution Options Injection

Uses Session Manager for persistence

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Checks installed software on the system

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-30 18:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-30 18:21

Reported

2024-09-30 18:24

Platform

win7-20240729-en

Max time kernel

150s

Max time network

124s

Command Line

C:\Windows\Explorer.EXE

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2284 created 1212 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\Explorer.EXE

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7z.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\dialer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7z.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1488 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\7z.exe
PID 1488 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\7z.exe
PID 1488 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\7z.exe
PID 1488 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\7z.exe
PID 1488 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 1488 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 1488 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 1488 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 1488 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe
PID 1488 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe
PID 1488 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe
PID 1488 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe
PID 1488 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe
PID 1488 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe
PID 1488 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe
PID 3028 wrote to memory of 2012 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp
PID 3028 wrote to memory of 2012 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp
PID 3028 wrote to memory of 2012 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp
PID 3028 wrote to memory of 2012 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp
PID 3028 wrote to memory of 2012 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp
PID 3028 wrote to memory of 2012 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp
PID 3028 wrote to memory of 2012 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp
PID 2012 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe
PID 2012 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe
PID 2012 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe
PID 2012 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe
PID 2636 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 2636 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 2636 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 2636 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 2636 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 2636 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 2284 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\SysWOW64\dialer.exe
PID 2284 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\SysWOW64\dialer.exe
PID 2284 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\SysWOW64\dialer.exe
PID 2284 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\SysWOW64\dialer.exe
PID 2284 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\SysWOW64\dialer.exe
PID 2284 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\SysWOW64\dialer.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe

"C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe"

C:\Users\Admin\AppData\Local\Temp\7z.exe

"C:\Users\Admin\AppData\Local\Temp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\files925.zip" -o"C:\Users\Admin\AppData\Local\Temp\extracted" -y

C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe

C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe

C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp" /SL5="$70192,81128209,619008,C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe

"C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe" -Cookies

C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe

"C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe"

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 filecloudvv235.life udp
US 104.21.54.168:443 filecloudvv235.life tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 2.23.205.233:80 www.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\nszED1E.tmp\INetC.dll

MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

\Users\Admin\AppData\Local\Temp\nszED1E.tmp\nsExec.dll

MD5 2746f5b49ef1a2d17a1d4a290dc45615
SHA1 26e98eea903b5f34812885ec289e82bcdaeaac07
SHA256 24f6dec8eb5097fef8e6e2acdbf85fcb510f64daee5818572223b3a6a8849ebd
SHA512 2befe9ad0400c160c14ccae66932473930108624e167e53662d55f0c85a44c4e43a8213c2d9554375afc0e0d6a1c47590b8eacb944ca401c217d07bf304c44c3

\Users\Admin\AppData\Local\Temp\7z.exe

MD5 0b24892597dcb0257cdb78b5ed165218
SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f

C:\Users\Admin\AppData\Local\Temp\7z.dll

MD5 1143c4905bba16d8cc02c6ba8f37f365
SHA1 db38ac221275acd087cf87ebad393ef7f6e04656
SHA256 e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812
SHA512 b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

C:\Users\Admin\AppData\Local\Temp\files925.zip

MD5 df260f1223832132ba7703c4d83fb5a7
SHA1 76589851f57e29c645669b7db1de810ff3b1cab3
SHA256 1390254e815bcf8b165746e61b75c33a67be98a927def1c0dcd9af10da66d9fc
SHA512 1c56fd67a71f61d41a56cabaa337e91e7ac52d9ef64acddfaed86a674897731460e9e4ae42807bec82051a53d18f776b2d63f8b911cb98b6a13854acd95ac7c1

\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe

MD5 fd57b4457b9c453bf563559c53b9071b
SHA1 08eb3a76af5c337b73f50efe5a27c43b68edce88
SHA256 995bf2a06730050f99f6e5ff53d641e1e98f022e7d7c376d91d65959aa79a70e
SHA512 ba9518440625fef53101440c976951b5c8e2b07f946a975da77b8a7ab2cbfc795cd20a264f61ff1fc4a7c0b77ea9b75ed8a9c9e69b9d22ae65d10163a510c5a7

memory/3028-50-0x0000000000400000-0x00000000004A1000-memory.dmp

memory/3028-53-0x0000000000401000-0x0000000000417000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-VP1VH.tmp\PAssist_Setup.tmp

MD5 5365d92452967516bbfea696fb767c6a
SHA1 4be412e572ee9f01f60fe63ca6cf40bea393daea
SHA256 9c916bb9f92446d3c91dae7a8a58b75d3e29e372dfd9347ffae15b6d6def0d4e
SHA512 d2b8dd5f8698af3643227680a0c79a5351033f425a00dc1f6fdf234e6988fac26649a75e9ba417b8ceaf3cba9c718902ba67d8df4bbbcaa98d5714c77ffb0722

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\MFCButton.dll

MD5 89f2f18309679dfaa520218676816719
SHA1 bbc1a5cbeb27cc80b3f2b53a742a00132bb2cb6c
SHA256 c3e299b95595941981fd3e3bc0194c20e62e1282ec2e52c67a5cac89a31fcefc
SHA512 2917ed234c018fce30607890f937b3338a7229a50f7d18b35d02a0cedc07ff2d81c69a47f8801e9dbd6a04bfc6a1a5636f6098b49e0d3650d1a8d531b79f690e

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\aman.exe

MD5 e53271e7cd54cedd7057cea764b88419
SHA1 fd9526d5e13302e96909055e882b799d4b69214c
SHA256 46f1e3143008be9bbdf05540b4ab7a7a07228f55b24e18a8b8943aa92b943074
SHA512 895593689c7348aea1702155abff18d9541d2cacf080011bdd5478390eb8da446e49db21bc9b4f7a14a08376f72d2585eaa57d92fb5deec86ca7457aaecce3b5

memory/2012-172-0x0000000004310000-0x000000000431E000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\CheckRunning.dll

MD5 5f7de6775125b31caaa0edec7b8f2ad3
SHA1 a8f7a8ee6ce4eb8c7faa97b222b404e25604be5b
SHA256 bd83b596384b414ae4f2f9adfb0b80b2231572df12ee32a80647aaf92abe575c
SHA512 ed6c959ddd936962ddb34a13f129d0f2a0943ba12797944b6f57febeb0cf60e1c081028af1438d439fceafcb0ee1b0462fa12ab78b41a833aff8ac9fd3f1f8dd

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\btopen.png

MD5 90eb121bf0ae802f3ad12bc6582ca691
SHA1 8647260945740e2cd97a97b7cee6e5016688166f
SHA256 85a908620121820c1c40303d6e268bac586c469cbfbfe864143a2c96d171f56c
SHA512 881bdec3c122b7baaf81c01f91b24409377602c0d9398b09aa3ad7cb965d347bcee5e631ca87636edfad693d5666b8339ee45e8877500f78f823817d449ec8e1

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\Checkblue.png

MD5 a8b6c2a1eb48b2be0f941f3ab8f7e238
SHA1 b78df675d44df51d64b55c8f2c511cd180d5cf73
SHA256 4ef202de5bf06745f20ef82ab0680cb4b1d882025a4503639ccdb6435e029dd0
SHA512 b181985244dbd6dc0bc456f822cc8011cb76ce334a680928a8c2aa12a9f0c4a066c3e6745f738ffc480e39b907a0499e59b3865fed040a5a43310803de61c0c2

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\iconclose.png

MD5 3a58934b887aab94f6b08f937379cd27
SHA1 1b56a9405cc8b818c4c2584372d30ff2e3f07173
SHA256 2412f5c1a826c923b6afbf41aa700066f8845227bc6c0732f1917f4671e16015
SHA512 f5232174b1c4c3871fbc0fbcab403d2281f8d2c207127466d215de44b23d4472e5dee32210e3adf2294a9be31b334e0dae14f0421ee05318ed419239bcb983d4

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\CallbackCtrl.dll

MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\iconminimize.png

MD5 5577c4f4a5b74020337c273b94744d25
SHA1 46c46b1d15a07319d7396e9ab1bd686764abf785
SHA256 8e9e7818db8b22e2d7e836ae72712eb402b4e94fc43aa1b2a6b1217dfb90e9ac
SHA512 3cd31fc686103a83ce8779fc94771b51afbf1343f5ab4e36f3f2d1ede013feb6eb4b0d66c48c5f00217eefb9c407071fd30188dc0a16244d86899116c6fc4f45

memory/2012-176-0x00000000047C0000-0x00000000047CE000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\botva2.dll

MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\ucrtbase.DLL

MD5 126fb99e7037b6a56a14d701fd27178b
SHA1 0969f27c4a0d8270c34edb342510de4f388752cd
SHA256 10f8f24aa678db8e38e6917748c52bbcd219161b9a07286d6f8093ab1d0318fa
SHA512 d787a9530bce036d405988770621b6f15162347a892506ce637839ac83ac6c23001dc5b2292afd652e0804bd327a7536d5f1b92412697c3be335a03133d5fe17

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-crt-runtime-l1-1-0.dll

MD5 047c779f39ebb4f57020cd5b6fb2d083
SHA1 440077fc83d1c756fe24f9fb5eae67c5e4abd709
SHA256 078d2551f53ca55715f5c6a045de1260ce331b97fd6d047f8455e06d97ef88dc
SHA512 95a57d79c47d11f43796aea8fd1183d3db9448dee60530144b64a2dd3cd863f5b413356076c26101d96dd007ebf8aff9e23cf721ba4e03d932c333b8e5536b73

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\vcruntime140.dll

MD5 1a84957b6e681fca057160cd04e26b27
SHA1 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA256 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA512 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\msvcp140.dll

MD5 8ff1898897f3f4391803c7253366a87b
SHA1 9bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA256 51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512 cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-core-localization-l1-2-0.dll

MD5 3979437d6817cdf82da474c8a1eefb0d
SHA1 5e96fe40993acbc7c2e9a104d51a728950ad872e
SHA256 3dd2e16b6f135cdd45bce4065f6493540ebbaf2f7f1553085a2442ea2cf80a10
SHA512 4f64c6d232fdae3e7e583cb1aa39878abbfbbc9466108b97a5dce089c35eb30af502b5b212b043c27c1b12b23c165bd2b559060c43d9e2efcdda777b34f0066b

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-core-processthreads-l1-1-1.dll

MD5 4da67feefeb86b58a20b3482b93285b3
SHA1 6cd7f344d7ca70cf983caddb88ff6baa40385ef1
SHA256 3a5d176b1f2c97bca7d4e7a52590b84b726796191ae892d38ad757fd595f414d
SHA512 b9f420d30143cf3f5c919fa454616765602f27c678787d34f502943567e3e5dfb068fec8190fea6fa8db70153ed620eb4fe5dc3092f9b35b7d46b00cc238e3ba

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-core-file-l2-1-0.dll

MD5 dcd09014f2b8041e89270fecd2c078b2
SHA1 b9f08affdd9ff5622c16561e6a6e6120a786e315
SHA256 6572965fd3909af60310db1e00c8820b2deef4864612e757d3babab896f59ed7
SHA512 ef2ac73100184e6d80e03ce5aa089dbddb9e2a52adf878c34b7683274f879dcf2b066491cfc666f26453acbd44543d9741f36369015bd5d07e36b49d435751f6

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-crt-string-l1-1-0.dll

MD5 1f1d50aa4553e77f6b90ae13bd56a95c
SHA1 cf421a298f485c2a000791e1840ededeea19bad0
SHA256 d343529d2a49cbb89d644deafce573b873ab45e0bf57e2d906b2f2a964d7bd9a
SHA512 a08bdcc2883066a8bdb9336eec5c7f8593202c367ce75a7d7390ed4c6e0e1dbe80b7afadeee78f12ac0386d70ac360af12bf0ff3285acda0425789038951f180

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-crt-locale-l1-1-0.dll

MD5 7481e20041cf8e366d737962d23ec9de
SHA1 a13c9a2d6cf6c92050eaae5ecb090a401359d992
SHA256 4615ec9effc0c27fc0cfd23ad9d87534cbe745998b7d318ae84ece5ea1338551
SHA512 f7a8e381d1ac2704d61258728a9175834cf414f7f2ff79bd8853e8359d6468839585cb643f0871334b943b0f7b0d868e077f6bd3f61668e54785ee8b94bf7903

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-crt-time-l1-1-0.dll

MD5 fa5327c2a3d284385d8dc3d65935604b
SHA1 a878b7cdf4ad027422e0e2182dad694ed436e949
SHA256 704ad27cab084be488b5757395ad5129e28f57a7c6680976af0f096b3d536e66
SHA512 473ff715f73839b766b5f28555a861d03b009c6b26c225bc104f4aab4e4ea766803f38000b444d4d433ff9ea68a3f940e66792bae1826781342f475860973816

C:\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-crt-environment-l1-1-0.dll

MD5 9806f2f88ba292b8542a964c0b102876
SHA1 c02e1541a264a04963add31d2043fa954b069b6b
SHA256 cf601a7b883bb4fb87c28b4a1d9f823d2454b298cdbcb4da4f508db8bd1278ba
SHA512 d68cb926de3caa498ad2aea60e2c5dbb72f30836a6ad9bb11a48f2ca706656981d9332dae44769ccf6f8de3b2ea1507983440afbe1322520f2fd1674cd8de823

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 1747189e90f6d3677c27dc77382699d8
SHA1 17e07200fc40914e9aa5cbfc9987117b4dc8db02
SHA256 6cc23b34f63ba8861742c207f0020f7b89530d6cdd8469c567246a5879d62b82
SHA512 d2cc7223819b9109b7ce2475dfb2a58da78d0d3d606b05b6f24895d2f05fb1b83ee4c1d7a863f3c3488f5d1b014cd5b429070577bd53d00bb1e0a0a9b958f0b1

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-crt-convert-l1-1-0.dll

MD5 392b572dc6275d079270ad8e751a2433
SHA1 8347bba17ed3e7d5c2491f2177af3f35881e4420
SHA256 347ceeb26c97124fb49add1e773e24883e84bf9e23204291066855cd0baea173
SHA512 dbdbd159b428d177c5f5b57620da18a509350707881fb5040ac10faf2228c2ccfd6126ea062c5dd4d13998624a4f5745ed947118e8a1220190fdb93b6a3c20b7

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-crt-stdio-l1-1-0.dll

MD5 10e9dfc88bf784847e7b9aab82e28d0c
SHA1 cb750cf87d561ca32f5860854da374dae6c9f2ad
SHA256 e6bab87156c9e7ae14ce36a754eb6891891a22ddfff584b706538152017fbb0f
SHA512 29c2edb44cada75ee8ccae1b55a405c8282c937450913196d54b6da1a1e121451c6e14a92a200574984961fa8c649d8a40caf58ea50a33d42a7dfae4439091c2

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-crt-heap-l1-1-0.dll

MD5 1bcb55590ab80c2c78f8ce71eadeb3dc
SHA1 8625e6ed37c1a5678c3b4713801599f792dc1367
SHA256 a3f13fa93131a17e05ad0c4253c34b4db30d15eae2b43c9d7ec56fdc6709d371
SHA512 d80374ec9b17692b157031f771c6c86dc52247c3298594a936067473528bbb511be4e033203144bbf2ec2acfd7e3e935f898c945eb864dcf8b43ae48e3754439

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-core-synch-l1-2-0.dll

MD5 c250b2e4ff04d22306bf8ce286afd158
SHA1 e5c60b7892ff64cbff02d551f9dbf25218c8195b
SHA256 42367b6b7285bddc185c0badefe49e883646f574b1d7d832c226f2d1ce489c5b
SHA512 a78c4ddf98330698c9da8d1d2c7c3176f22dfabf0900008cff1f294f56a2a14b52becd09ba37a065d544f58617911b3f5850614b5aabd0ec7daf236f29c9b10b

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-core-timezone-l1-1-0.dll

MD5 3339350008a663975ba4953018c38673
SHA1 78614a1aad7fc83d6999dcc0f467b43693be3d47
SHA256 4f77abb5c5014769f907a194fd2e43b3c977df1fb87f8c98dd15a7b950d1e092
SHA512 a303fd57dd59f478a8d6c66785768886509625a2baf8bf2b357bb249fc93f193ac8c5c2c9193e53738805700e49b941bf741d6c4850a43f29a82424ccdda191b

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\api-ms-win-core-file-l1-2-0.dll

MD5 7d64aefb7e8b31292da55c6e12808cdb
SHA1 568c2a19a33bb18a3c6e19c670945630b9687d50
SHA256 62a4810420d997c7fdd9e86a42917a44b78fb367a9d3c0a204e44b3ff05de6d4
SHA512 68479da21f3a2246d60db8afd2ae3383a430c61458089179c35df3e25ca1a15eba86a2a473e661c1364613baa93dcb38652443eb5c5d484b571ab30728598f9b

\Users\Admin\AppData\Local\Temp\is-3G4HE.tmp\up.dll

MD5 66f3817952b5107d5bdaffef5e7959b4
SHA1 2533fbf0f3cbad38c61d53ab76498563b7fb3843
SHA256 f47b797c6abcefc050ebcae395912a63354d0a185aee63d516cb2cf28969604e
SHA512 88ac0e097fe1562dc226efb766e3d6c8a7d578f617aa294c7f5339ec00ff78defe3df047f60984a3105cc6778885346b501e6545f7d47281005a7710b236bb67

memory/2636-248-0x000000001F870000-0x000000001FA4E000-memory.dmp

memory/2636-251-0x000000001F870000-0x000000001FA4E000-memory.dmp

memory/2636-250-0x000000001F870000-0x000000001FA4E000-memory.dmp

memory/2636-249-0x000000001F870000-0x000000001FA4E000-memory.dmp

memory/2636-257-0x000000001F870000-0x000000001FA4E000-memory.dmp

memory/2284-258-0x0000000000080000-0x00000000000FE000-memory.dmp

memory/2636-256-0x000000001F870000-0x000000001FA4E000-memory.dmp

memory/2284-255-0x0000000000080000-0x00000000000FE000-memory.dmp

memory/2284-254-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2284-252-0x0000000000080000-0x00000000000FE000-memory.dmp

memory/2284-259-0x00000000009E0000-0x0000000000DE0000-memory.dmp

memory/2284-260-0x00000000009E0000-0x0000000000DE0000-memory.dmp

memory/2284-262-0x0000000075000000-0x0000000075047000-memory.dmp

memory/1736-263-0x0000000000080000-0x0000000000089000-memory.dmp

memory/1736-265-0x0000000001E30000-0x0000000002230000-memory.dmp

memory/1736-268-0x0000000075000000-0x0000000075047000-memory.dmp

memory/1736-266-0x0000000076D90000-0x0000000076F39000-memory.dmp

memory/3028-269-0x0000000000400000-0x00000000004A1000-memory.dmp

memory/2012-270-0x0000000000400000-0x00000000005ED000-memory.dmp

memory/2012-271-0x00000000047C0000-0x00000000047CE000-memory.dmp

memory/2012-289-0x00000000047C0000-0x00000000047CE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-30 18:21

Reported

2024-09-30 18:24

Platform

win10v2004-20240802-en

Max time kernel

92s

Max time network

125s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2008 created 2616 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\system32\sihost.exe

Event Triggered Execution: Image File Execution Options Injection

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PartAssist.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DupFiles.exe\dpiAwareness = "2" C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Defrager.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADR.exe\dpiAwareness = "1" C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PartAssist.exe\dpiAwareness = "2" C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DupFiles.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wintogo.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wintogo.exe\dpiAwareness = "0" C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Defrager.exe\dpiAwareness = "0" C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADR.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BitlockerTool.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BitlockerTool.exe\dpiAwareness = "0" C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ampa\ImagePath = "\\??\\C:\\Windows\\system32\\ampa.sys" C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A

Uses Session Manager for persistence

persistence
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a000000 C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7z.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\amanhlp.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\amanhlp.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\amanhlp.exe N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ampa.sys C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
File created C:\Windows\system32\ampa.sys C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe N/A
File created C:\Windows\SysWOW64\ampa.sys C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe N/A
File created C:\Windows\system32\is-PQQQV.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Windows\system32\is-TT4CJ.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\ddm\Fat.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\doc\is-J3LD8.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\doc\is-53HEG.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\is-R9NFE.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\curver\is-V6GOP.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\ddm\doc\images\is-Q9BVB.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\msvcp120.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\x64\api-ms-win-core-string-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\html\img\is-GGCAJ.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\html\Win11\is-AHMLT.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\is-QITB2.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\upgrade\html_99CEAF66\upgrade-now\scripts\jquery-2.1.4.min.js C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\api-ms-win-core-processthreads-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\x64\7z.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\api-ms-win-core-rtlsupport-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\is-IPL9D.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\ddm\Vds.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\html\img\is-H6TH8.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\html\.idea\is-VIE4O.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\mfc140.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\avutil-58.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\ddm\is-K85Q9.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\is-8OD9L.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\is-D03HQ.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\is-5OIMR.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\upgrade\html_99CEAF66\upgrade-now\scripts\demo\tw.js C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\ddm\Logic.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\is-RRMO2.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\doc\is-S6SQR.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\doc\is-IVUUD.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\lang\is-LQECF.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\native\Arm\amd64\fre\is-E4EGO.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\upgrade\html_99CEAF66\upgrade-now\scripts\std\es.js C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\api-ms-win-core-handle-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\is-OCMIG.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\is-HKQ8R.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\html\img\is-JM4V4.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\html\img\is-HBRUR.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\is-RPRO3.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\is-B7A4T.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\plugins\imageformats\is-AIAV9.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\upgrade\html_99CEAF66\upgrade-now\images\icon_completely.png C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\upgrade\html_99CEAF66\upgrade-now\images\icon_list_arrow_white_down.png C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\Winchk.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\native\w2k\x86\fre\is-QNMDU.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\ddm\msvcr80.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\Image\is-E9FGO.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\html\new\images\is-LVTFC.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\is-90GFP.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\upgrade\html_99CEAF66\upgrade-now\images\icon_nav_close_hover.png C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\API-MS-Win-core-xstate-l2-1-0.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\x64\mfc80.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\api-ms-win-core-errorhandling-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\x64\concrt140.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\is-EGCEA.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\is-M3P03.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\native\w2k\x86\fre\is-HCRVO.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\html\new\scripts\demo\is-T903P.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\bcdboot.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\Qt5Svg.dll C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\ddm\doc\images\is-CDNRK.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\ddm\is-C52NU.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Program Files (x86)\AOMEI Partition Assistant\cfg.ini C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
File created C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\is-EVSAS.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\is-NTFUM.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\windows\PAGa4.dat C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\ga4.exe N/A
File opened for modification C:\Windows\ampa.exe C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
File created C:\Windows\ampa.exe C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe N/A
File opened for modification C:\Windows\ampa.exe C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe N/A
File opened for modification C:\Windows\ampa.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\Windows\ddmmain.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File created C:\Windows\is-RPRTL.tmp C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
File opened for modification C:\windows\.2bcb023e-23f9-42f4-87f7-90d94005accb C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\ga4.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\ga4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\AOMEI Partition Assistant\amanhlp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\openwith.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7z.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeAuditPrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\ga4.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\ga4.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: 35 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4060 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\7z.exe
PID 4060 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\7z.exe
PID 4060 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 4060 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 4060 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 4060 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe
PID 4060 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe
PID 4060 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe
PID 1864 wrote to memory of 4432 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp
PID 1864 wrote to memory of 4432 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp
PID 1864 wrote to memory of 4432 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp
PID 4432 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe
PID 4432 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe
PID 4432 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe
PID 3872 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 3872 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 3872 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 3872 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 3872 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe
PID 2008 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\SysWOW64\openwith.exe
PID 2008 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\SysWOW64\openwith.exe
PID 2008 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\SysWOW64\openwith.exe
PID 2008 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\SysWOW64\openwith.exe
PID 2008 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe C:\Windows\SysWOW64\openwith.exe
PID 4432 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe
PID 4432 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe
PID 4432 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe
PID 4432 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe
PID 4432 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe
PID 4432 wrote to memory of 2132 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe
PID 4432 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe
PID 4432 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe
PID 4432 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Windows\SysWOW64\cmd.exe
PID 4432 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Windows\SysWOW64\cmd.exe
PID 4432 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Windows\SysWOW64\cmd.exe
PID 4432 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe
PID 4432 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe
PID 4432 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe
PID 4432 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\ga4.exe
PID 4432 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\ga4.exe
PID 4432 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\ga4.exe
PID 4432 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe
PID 4432 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe
PID 4432 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe
PID 4408 wrote to memory of 1756 N/A C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe C:\Program Files (x86)\AOMEI Partition Assistant\amanhlp.exe
PID 4408 wrote to memory of 1756 N/A C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe C:\Program Files (x86)\AOMEI Partition Assistant\amanhlp.exe
PID 4408 wrote to memory of 1756 N/A C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe C:\Program Files (x86)\AOMEI Partition Assistant\amanhlp.exe
PID 3988 wrote to memory of 3672 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe
PID 3988 wrote to memory of 3672 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe
PID 3988 wrote to memory of 2204 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe C:\Program Files (x86)\AOMEI Partition Assistant\LoadDrv_x64.exe
PID 3988 wrote to memory of 2204 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe C:\Program Files (x86)\AOMEI Partition Assistant\LoadDrv_x64.exe
PID 3988 wrote to memory of 2992 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe
PID 3988 wrote to memory of 2992 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe
PID 3988 wrote to memory of 624 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe C:\Program Files (x86)\AOMEI Partition Assistant\LoadDrv_x64.exe
PID 3988 wrote to memory of 624 N/A C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe C:\Program Files (x86)\AOMEI Partition Assistant\LoadDrv_x64.exe

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe

"C:\Users\Admin\AppData\Local\Temp\020425c9fc833c6851f81b9db71b47eda800d4ecacc91eb8f3d6ee27b3beff6e.exe"

C:\Users\Admin\AppData\Local\Temp\7z.exe

"C:\Users\Admin\AppData\Local\Temp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\files925.zip" -o"C:\Users\Admin\AppData\Local\Temp\extracted" -y

C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe

C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe

C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp" /SL5="$190224,81128209,619008,C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe

"C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe" -Cookies

C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe

"C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe"

C:\Windows\SysWOW64\openwith.exe

"C:\Windows\system32\openwith.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2008 -ip 2008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2008 -ip 2008

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 436

C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe" -u

C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe"

C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe" -u

C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c echo [UserExperience] >"C:\Program Files (x86)\AOMEI Partition Assistant\Other.ini"&&echo ExperienceValue=1 >>"C:\Program Files (x86)\AOMEI Partition Assistant\Other.ini

C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe"

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\ga4.exe

"C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\ga4.exe" --api_secret="dEWDrGUTR1uXAjz-D7o6cQ" --measurement_id="G-WN5XWG0D3E" --event_name=install --store --cache="C:\windows\PAGa4.dat" --event_params="event:success,edition:setup,language:en,version:10.5.0,OS_windows:Windows 10 Enterprise,UXP:check"

C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\aman.exe" -Commit_install "en" "0" "3" "" "C:\Program Files (x86)\AOMEI Partition Assistant\PAssist_Setup.exe"

C:\Program Files (x86)\AOMEI Partition Assistant\amanhlp.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\amanhlp.exe" -submit_cache

C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe" -u

C:\Program Files (x86)\AOMEI Partition Assistant\LoadDrv_x64.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\LoadDrv_x64.exe" -u

C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\SetupGreen64.exe"

C:\Program Files (x86)\AOMEI Partition Assistant\LoadDrv_x64.exe

"C:\Program Files (x86)\AOMEI Partition Assistant\LoadDrv_x64.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 filecloudvv235.life udp
US 172.67.140.173:443 filecloudvv235.life tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 173.140.67.172.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 a.aomeisoftware.com udp
US 172.66.40.247:443 a.aomeisoftware.com tcp
US 8.8.8.8:53 247.40.66.172.in-addr.arpa udp
US 8.8.8.8:53 sn.aomeisoftware.com udp
US 172.66.40.247:443 a.aomeisoftware.com tcp
US 172.66.40.247:443 a.aomeisoftware.com tcp
US 172.66.40.247:443 a.aomeisoftware.com tcp
US 172.66.40.247:443 a.aomeisoftware.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nshA401.tmp\INetC.dll

MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

C:\Users\Admin\AppData\Local\Temp\nshA401.tmp\nsExec.dll

MD5 2746f5b49ef1a2d17a1d4a290dc45615
SHA1 26e98eea903b5f34812885ec289e82bcdaeaac07
SHA256 24f6dec8eb5097fef8e6e2acdbf85fcb510f64daee5818572223b3a6a8849ebd
SHA512 2befe9ad0400c160c14ccae66932473930108624e167e53662d55f0c85a44c4e43a8213c2d9554375afc0e0d6a1c47590b8eacb944ca401c217d07bf304c44c3

C:\Users\Admin\AppData\Local\Temp\7z.exe

MD5 0b24892597dcb0257cdb78b5ed165218
SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f

C:\Users\Admin\AppData\Local\Temp\7z.dll

MD5 1143c4905bba16d8cc02c6ba8f37f365
SHA1 db38ac221275acd087cf87ebad393ef7f6e04656
SHA256 e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812
SHA512 b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

C:\Users\Admin\AppData\Local\Temp\files925.zip

MD5 df260f1223832132ba7703c4d83fb5a7
SHA1 76589851f57e29c645669b7db1de810ff3b1cab3
SHA256 1390254e815bcf8b165746e61b75c33a67be98a927def1c0dcd9af10da66d9fc
SHA512 1c56fd67a71f61d41a56cabaa337e91e7ac52d9ef64acddfaed86a674897731460e9e4ae42807bec82051a53d18f776b2d63f8b911cb98b6a13854acd95ac7c1

C:\Users\Admin\AppData\Local\Temp\extracted\s-etup.exe

MD5 fd57b4457b9c453bf563559c53b9071b
SHA1 08eb3a76af5c337b73f50efe5a27c43b68edce88
SHA256 995bf2a06730050f99f6e5ff53d641e1e98f022e7d7c376d91d65959aa79a70e
SHA512 ba9518440625fef53101440c976951b5c8e2b07f946a975da77b8a7ab2cbfc795cd20a264f61ff1fc4a7c0b77ea9b75ed8a9c9e69b9d22ae65d10163a510c5a7

memory/1864-35-0x0000000000400000-0x00000000004A1000-memory.dmp

memory/1864-37-0x0000000000401000-0x0000000000417000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-UFCK6.tmp\PAssist_Setup.tmp

MD5 5365d92452967516bbfea696fb767c6a
SHA1 4be412e572ee9f01f60fe63ca6cf40bea393daea
SHA256 9c916bb9f92446d3c91dae7a8a58b75d3e29e372dfd9347ffae15b6d6def0d4e
SHA512 d2b8dd5f8698af3643227680a0c79a5351033f425a00dc1f6fdf234e6988fac26649a75e9ba417b8ceaf3cba9c718902ba67d8df4bbbcaa98d5714c77ffb0722

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\MFCButton.dll

MD5 89f2f18309679dfaa520218676816719
SHA1 bbc1a5cbeb27cc80b3f2b53a742a00132bb2cb6c
SHA256 c3e299b95595941981fd3e3bc0194c20e62e1282ec2e52c67a5cac89a31fcefc
SHA512 2917ed234c018fce30607890f937b3338a7229a50f7d18b35d02a0cedc07ff2d81c69a47f8801e9dbd6a04bfc6a1a5636f6098b49e0d3650d1a8d531b79f690e

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\aman.exe

MD5 e53271e7cd54cedd7057cea764b88419
SHA1 fd9526d5e13302e96909055e882b799d4b69214c
SHA256 46f1e3143008be9bbdf05540b4ab7a7a07228f55b24e18a8b8943aa92b943074
SHA512 895593689c7348aea1702155abff18d9541d2cacf080011bdd5478390eb8da446e49db21bc9b4f7a14a08376f72d2585eaa57d92fb5deec86ca7457aaecce3b5

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\CheckRunning.dll

MD5 5f7de6775125b31caaa0edec7b8f2ad3
SHA1 a8f7a8ee6ce4eb8c7faa97b222b404e25604be5b
SHA256 bd83b596384b414ae4f2f9adfb0b80b2231572df12ee32a80647aaf92abe575c
SHA512 ed6c959ddd936962ddb34a13f129d0f2a0943ba12797944b6f57febeb0cf60e1c081028af1438d439fceafcb0ee1b0462fa12ab78b41a833aff8ac9fd3f1f8dd

memory/4432-157-0x0000000003580000-0x000000000358E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\Up.dll

MD5 66f3817952b5107d5bdaffef5e7959b4
SHA1 2533fbf0f3cbad38c61d53ab76498563b7fb3843
SHA256 f47b797c6abcefc050ebcae395912a63354d0a185aee63d516cb2cf28969604e
SHA512 88ac0e097fe1562dc226efb766e3d6c8a7d578f617aa294c7f5339ec00ff78defe3df047f60984a3105cc6778885346b501e6545f7d47281005a7710b236bb67

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\msvcp140.dll

MD5 8ff1898897f3f4391803c7253366a87b
SHA1 9bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA256 51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
SHA512 cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\vcruntime140.dll

MD5 1a84957b6e681fca057160cd04e26b27
SHA1 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA256 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA512 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\Encrypt.dll

MD5 72d01e07655ef01c7cf94dd01e627323
SHA1 956b802ac2aa02cdc49f4308168f1521e9d321f4
SHA256 42518c27b53e430c15efdacfb06672cccd68b675be21835b06b076689a6a45d5
SHA512 b2541d6c5edd4cde9fbb4ff38ae24956857c168d34b9be09d7e3227f23bcfaf8c269e29944724d00edc5f9c164fe410a8c43af47c254b68052692552bc8ada2d

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\libcrypto-1_1.dll

MD5 8d38b77ed67be9c731c0d4c425bf30e4
SHA1 23d3e64a0b30bbfd9fc568114a7997e4d2717139
SHA256 167a3cae494c55997a5cbffdbaa21c8f4b3293c02e0f4f0a0eadd9c5e5dd7216
SHA512 8fa0375e11cdf492021e50fb352433de5435527f7fec4a42377a5ac683b40da05e4f8964c6c5a62c30120d866a4197bc2a1e19762931d62f2f2bb2ca0c60c0fe

memory/4432-177-0x0000000005D50000-0x0000000005D5E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\CallbackCtrl.dll

MD5 f07e819ba2e46a897cfabf816d7557b2
SHA1 8d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA256 68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA512 7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\iconminimize.png

MD5 5577c4f4a5b74020337c273b94744d25
SHA1 46c46b1d15a07319d7396e9ab1bd686764abf785
SHA256 8e9e7818db8b22e2d7e836ae72712eb402b4e94fc43aa1b2a6b1217dfb90e9ac
SHA512 3cd31fc686103a83ce8779fc94771b51afbf1343f5ab4e36f3f2d1ede013feb6eb4b0d66c48c5f00217eefb9c407071fd30188dc0a16244d86899116c6fc4f45

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\botva2.dll

MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\Checkblue.png

MD5 a8b6c2a1eb48b2be0f941f3ab8f7e238
SHA1 b78df675d44df51d64b55c8f2c511cd180d5cf73
SHA256 4ef202de5bf06745f20ef82ab0680cb4b1d882025a4503639ccdb6435e029dd0
SHA512 b181985244dbd6dc0bc456f822cc8011cb76ce334a680928a8c2aa12a9f0c4a066c3e6745f738ffc480e39b907a0499e59b3865fed040a5a43310803de61c0c2

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\iconclose.png

MD5 3a58934b887aab94f6b08f937379cd27
SHA1 1b56a9405cc8b818c4c2584372d30ff2e3f07173
SHA256 2412f5c1a826c923b6afbf41aa700066f8845227bc6c0732f1917f4671e16015
SHA512 f5232174b1c4c3871fbc0fbcab403d2281f8d2c207127466d215de44b23d4472e5dee32210e3adf2294a9be31b334e0dae14f0421ee05318ed419239bcb983d4

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\btopen.png

MD5 90eb121bf0ae802f3ad12bc6582ca691
SHA1 8647260945740e2cd97a97b7cee6e5016688166f
SHA256 85a908620121820c1c40303d6e268bac586c469cbfbfe864143a2c96d171f56c
SHA512 881bdec3c122b7baaf81c01f91b24409377602c0d9398b09aa3ad7cb965d347bcee5e631ca87636edfad693d5666b8339ee45e8877500f78f823817d449ec8e1

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\PathFormat.dll

MD5 fa8184d714ef320ff0602fccbce5cf7b
SHA1 c4e783cd1decf6bd6f248fcff1ec8749d865d510
SHA256 8255753f83d5d9705bc0ac52b981796f7619f45deb79e968d115ab442d6625a2
SHA512 72f6622300d4fe45b5f9cac522209329cf4bd344256196e6e8bcab78a251b94b2e0ddde2ba584ef6af92aa2a30d2e39de71a3f469b874cf7a06175bbb2208e3c

memory/4432-217-0x00000000074A0000-0x00000000074D2000-memory.dmp

C:\Program Files (x86)\AOMEI Partition Assistant\Image\is-OKESH.tmp

MD5 151db542e18783801896517e5c11148e
SHA1 1631105625b1a39dca0ce71304a5abb3bd1aa2e5
SHA256 8aa479a05c5254d5b747a90f1019bccbfc0c843256e614fd6965ac3bbd4ec4ed
SHA512 4170b6c23cd976a0b6716cafd61cda2043f8873abb4da1d1a94b1bab9419d6c9bc70e9ef147dd127153c67150397ba1e7d0cb8d58a830d1004eb9bb7f188a2ce

C:\Program Files (x86)\AOMEI Partition Assistant\Image\is-CR8QA.tmp

MD5 de0cf41ade8c4a8dcdd64096913ffcfd
SHA1 8886d9104d846e3e7b4975c21af358a275dbba56
SHA256 e67eacbc98ff6cd7735a1ae493031611bb9f9d7c14434cf4032b1b4242b03329
SHA512 3691f2fd54025618d12e056757fa2f9a45124b22e5797f1b9bb85abc2b16219e775bd2d6ca73dc526af23f23e8f6ea2573a23b1aaa84f3fe08d1c6ce7d36be2e

C:\Program Files (x86)\AOMEI Partition Assistant\Image\is-DFHGE.tmp

MD5 23d09962070f873e33464283ed89a56f
SHA1 cd8997c14fd2ffc4b8e78e6e7fb1e3d9b80f2993
SHA256 2542d5680f4ba3ee60b62d15c61ea44013633daf11ad66e439fdf8002dbb6518
SHA512 cde3d41371c01f7ce26580c8a6c7feb2b7a65ed6be1e61c81102596b43ec15d2e9cd30d43297409ea20480a845ac4619a5c436a92514d919befbfebceb43bdcb

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang.lang

MD5 d60f93795d00b0942ca4481039c68a68
SHA1 e9fb8fcba84b5f1df303440eec1a65e723a1d8b7
SHA256 56a4010223d1b7b22349a56e7d449d4214187376c113a8a74df767cd15df4ab5
SHA512 836cc01dbdb58434204af99cfe1ebc2e16124e40aac23643c541c45f2b80631fed9ae0bd7af25797032734e8291fc836e33a62d3cc5d666e3328c04c950fb1a6

memory/3872-488-0x000000001F870000-0x000000001FA4E000-memory.dmp

memory/3872-510-0x000000001F870000-0x000000001FA4E000-memory.dmp

memory/2008-512-0x0000000001140000-0x00000000011BE000-memory.dmp

memory/3872-509-0x000000001F870000-0x000000001FA4E000-memory.dmp

memory/2008-508-0x0000000001140000-0x00000000011BE000-memory.dmp

memory/3872-492-0x000000001F870000-0x000000001FA4E000-memory.dmp

memory/3872-493-0x000000001F870000-0x000000001FA4E000-memory.dmp

memory/3872-494-0x000000001F870000-0x000000001FA4E000-memory.dmp

C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe

MD5 4aa1e8ff12e2452b9a9b436693914e51
SHA1 c5c3f2a370393b19d758ea9cb06b1c8be005717a
SHA256 3211e024bb986c8e8b207324311c1df41bd6cdd2f57596af65c0629bb3d9623d
SHA512 b08750c80289256194789a0c6d2ff0fedd70b40590bc3450b0516ad520165c4723f1755a5f598969e7a40f4db9bf7996f71a8eb1b604441e6ea031b57e05b99a

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\giveaway.html

MD5 ab23b61ba08bf64b4d8ca3d388d5c47f
SHA1 850431e5e3275f6ddb5b3b7a8c5e1d4e60e2bead
SHA256 ecd8d17176ed57a0096b98c18ced47f6daf78aa948888cfcc9b81403fdb97947
SHA512 888e8616b8f05ec4313c3f594738fd7f5d1220f96ee36d348227e8cc4c1f7926f288879e6396e0fb6ed5aeb79f324bc89f38a209cefd6e92f9426b6edcb4d54d

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Demo.html

MD5 d3c589c98e1fee2569a116f218597c2d
SHA1 beeefc8e19bb3f8ca3a5cb83e30ab869bdd42c17
SHA256 d07ac96dce47527c9656cda954f4abfdbb80267b04c35a38581dcf1a8cd30a09
SHA512 db13e2ddf88378a9e560b9bd5303988abd4a0266c4188740d4e5e0e516ada0ec708b4b326c82d0762c7ed903f4df6d6b8d6254d0dad8303b789af5d355a6c215

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\home.html

MD5 acd204f8702f6a9a6c5c45489e8def28
SHA1 2481753acc18239f9cef00ee9bd082bddfff68f5
SHA256 3175fb7063458272062259e664d52751e39634d2b44488d785823ba45a778308
SHA512 0df2b652b5cecc544071e41954c937c5d01b49a52317c70cbfd8e32dcf054412fc7192203be68a1e2128cb4da67229bb849d681633e694e9a9d95a4c8ec3ac54

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\reg.html

MD5 df5ad6da9871a5c60d2a11434a0fb388
SHA1 76aa98d0097d5aa696d6c1c7ab5089a093392513
SHA256 e9decb5a0faab15c80fdbc714235ef607854e416dfd73c2bbc761c15563368d4
SHA512 fef43cd409da68ab6a3a888a64d2f1f3c211ae0fa87232aa363bd74561796b996f3b0a31bf2f6d70d9077b5ddbb438d70a59df7b66bf7fdb4c2cbad06f46d9bf

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\lite.html

MD5 cef7538b3f14012b1e38d3e1670a53e8
SHA1 d533e45508281c64a7ffe86b8dca15fba763ae72
SHA256 09168117d416df4bd1c478b44832751308526383bcf05116ed7dc8690e28b510
SHA512 b7e74ded2595accb4e852a1a0899ed6511392b03606dff2dfb8bacbf8cb142116e018810b9192922b5c243aa98925bca5d11a1ab1ab481ce39558b039915f2c6

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\index2.html

MD5 6215634f1f8c0b2bec5a48c9a8bc67bd
SHA1 e98c9a973dd5789dbc3e257a9881051085af5bf4
SHA256 dcaab38c111a8c46ea4066e51007600fbebcb503141e1d5c905f6e4c9e49dc0a
SHA512 0c9ffe326962712bf6a8d6c2e4c8c5a39c63e98673908bcbd06b18423fc5b5ca319bf300c351bb3c9f9d3a8ab678774433f6d8fa0a0d8909fa3b6d78150eab07

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\index2-jp.html

MD5 e40bd6808409f9e8cec4a0dcb600a57d
SHA1 9bfda344a712842ec95d27a6284e099d54914afc
SHA256 f42e88cf5641df0245400f77376b04e809a287d68fd1e60064c57bf265776981
SHA512 e5ebd449e7170306442e30c715cdb56e2f695cf423c6d1d25a650c0ff9780616bd0c6e6b83a59d54374afcfa16e267378ab57bff7f642eb4ed00acd5526b426d

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\index2-fr.html

MD5 18638c339f9df0975369e5c694ec5dbe
SHA1 601e5349ad7022e3e70252ab1bdf3d7fc1f769a8
SHA256 7f91c881f02b0ff8916ab2a6472e2e9921537bf802e624014ed77c1ad2e18085
SHA512 a878362a3802d492f3c302b4afdf156eb8782d4f45e8f8ae843216fa1f39c0000c82e3ec9f28cc77d66e4ed8f52f81915be0c8c6d3b693e04570e8714b79a7cc

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\index2-de.html

MD5 256c2248d9860b0248fba2cccbee285a
SHA1 605693e67ae0db2167305cbaea10abf16e4506e7
SHA256 c7adec65ae0cfd8940b883b1b34e838de180433c04c34d34c4a0ee3668495f46
SHA512 2e973e60348b63402f4c3cc83c7ade65bfdba9fdd7149ab26493b9ba7184690f687f1936251a9d329f7e17e8e10c4abedefed7bc01d84f9fe8bbb542b7b75c72

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\index.html

MD5 67e9c09176b3bf17b757ac31f25d8d59
SHA1 5367ce5db79ee3f483d1d557f0854fd977dcca30
SHA256 36a77373ec7bb7f6057fb9b7b4de16be5d5c2dfd3fec0c81436c40f2191c3739
SHA512 b63af02f96e2fddff546f2c3700e9e60f1528310cf3b4649450ebb26492890750a4d260d8b8e070770400cf2d34458659b9c38550532d8462f11069ea25d06d4

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\index-jp.html

MD5 4ad1da546a1935ab5edc90f6af52352c
SHA1 d7f2859ecedde34d93620802019e171ce69580fd
SHA256 2e67d87a940fa63f5a6f549513373eadbcdc9bdf059d2a449310b234b472b66b
SHA512 4045df8d7b3a69ef18a198da2c9759e532d4a39077ba6e0bf5d679064ad13c2b63f9e0f01f97c362515217b4b02d02cedb3fef382e27a400d2a0e99edc56ba9a

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\index-fr.html

MD5 b6dc33fee7a3d2e63dc90cbad4f603d8
SHA1 262503e5820ed3084cbdbc1f8e2032548adf8a91
SHA256 f547e0fd4a20cd295b2f2fdd0870d2360268c745679e756d7c8ab0e76b50f96d
SHA512 25f91219e6afd3c416f24e49c67381090d75cda2df50817d820f0a4989b393872f911f068d315d11131e29894b37f425daf599eb6deb0f155e52e6d07c0b6655

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\index-de.html

MD5 8664a182239901e53b394592b2169d53
SHA1 1d084ea8b46928cc2c39d4be9e8be41cd21505c7
SHA256 bbb7948baa5eee5c2d9f3daa95797501bb930009de2c273bb7cb54b99345cf0f
SHA512 426711f9608f10cf0da3727e8ebd589a54e09aaa5b17549b18325d066b0fa934103ada70733c0eaae99815b67373f89f9a84548307bace12e4ab4a08058e1db4

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\setup.html

MD5 df4d37b1134fd16cd4ce4928f6dab6b8
SHA1 6924e69f5e5e903b1fe836540736cf83c52072dd
SHA256 85f08db4dd34ee8e1bf73c4c7bfca935101ed7c0af9ed6ddf98ef4e60130eda9
SHA512 7f2812ed903cb42a8cd74413f078c4358ad82e340bac198b2b5ff633b2c067ee90935e64126e8386aaf1e59615d0c3a0254a8e15bf92e11c6fcb849eceafada5

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bg.png

MD5 7218a179d579f205f93b42681b6571cf
SHA1 6a5a37f83f00108d29e8cf6d1c8f5330685a8a97
SHA256 89864d201b389d0ff33ab5a644721304ffc291f54f8b0767268f6f5901b01c83
SHA512 7b784049f4122e7d552ba674bc84e2c81ffa31c3532d555118e0845a5957fc8140dac6e66b53e0a7a978d95083496baab7275d994a06a8fe0bf3d6fa2c70bdfa

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bt_hover.BMP

MD5 1dd6220e5f0669531fdd2dfa13e9872e
SHA1 f9e555eae6a765a0f8bc0a739b29c6144e694172
SHA256 885845d187c238f73be4360a2401cf16c4b74c85c1b6615f705f892acb39f7e6
SHA512 9553af185fadf46915a2b9fd55db2bba2d9ddae68b9116012b3cbb53094c9eb55027ab979e055fc90d21f9e588f2b94dffafe6850f5ce53d11f7201f1606010d

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bt_hover.png

MD5 6283c515b1c5ff2b5ee27ae35668cf19
SHA1 6412b18090131d5414c7462e7a4134f467d056cb
SHA256 c4d86fb1fda481995d89089583cd6828cac8e5bd38fadc3ee51c9345e8f0a0cf
SHA512 ac76d2b439b16966bf909dff4923aa498fab918a8463fde23b7e4f0fa7b3ae882df5c9f1d6dc157ee248b2ca2dae8fdc0bce06074a3c250954f56ff426ad184a

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\ic-3.jpg

MD5 12654ed9603ebe816e31d79cf1c3a416
SHA1 eb645b611d2e231817028f563b0813f3b7355e09
SHA256 7253f9bcf5346a6d9baf259b21b5998526daedba85954ef76cc21ec6191662dc
SHA512 d9b63d88004a332e8ab140b8739a5e528521dda3a80bd77e30ef121af4fdacbcb97362f0c1df8b358b21fe5eea8c277087469e180c1b3cdd02437329a4445a4e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon-location.png

MD5 46d33fb4ade6910f93bc13d4303819b3
SHA1 fe1511c79dc750e34e13036b2b3010b398b30cba
SHA256 9185bd63b66b4fd731b4cd36f218874935ad7ce710b9e470ff6df20b897ae40e
SHA512 1934d30916e289488f85947e3be45e3bc32b5559b19af27512bdf084f034225a9037eb5014a138fdf44decae7131cdb22ac73f72c47063c84f4f9a9c09236fa4

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_11.png

MD5 295d98569f7460ec2262648184135dfd
SHA1 aed5cacb744aa560d0682b67959aaf18f6220478
SHA256 9a7e7991fd63076a328f46bde7ef63e66766d5bd3e0644d9525bc263bc158143
SHA512 564046acaa024b1b3d8a7b20f199b038cedc4e213b21e846f17b33771faebdd412a990b26234791a2f14a9edf824a6c5adecc806b5519e2b0c1b61aada5e600b

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_10.png

MD5 2349fc94e568e0e25fffbe7620b124d5
SHA1 a5ee1ca4e6d7875dbdb11c617d57b751bfce3cb8
SHA256 8e3992bb2337b8a784540c1848c7c9c9b1f3b3f9dfe04c4c35743fcdb4ea690c
SHA512 5b075e5c054f474983d5c38e11733335a3c4562d79067f3326e8085e20d43f3cea756e3ba2ae4d4a8c9be7ecf58003232969577f3989c7cd64f5a8d4089ca311

C:\Program Files (x86)\AOMEI Partition Assistant\html\img\icon_1.png

MD5 7fca3cfeb1b75e33e5c1a1c4bec5c4c0
SHA1 4a5c8b015ecde49df4701477a66822334f138f7a
SHA256 d6031c7d1cbfc0b663a90af9ae4b73cc48237791570736a31cebe2b8e58ae4e8
SHA512 040b43ef2438427d0cf86839dd6ca2ff0be9f91e91bcc97f4825a00754c6705971317b6fa59a8fefcc42a8e93d88ad430450e4e303611edfc03c949056c39dc7

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon-user.png

MD5 a7bfa91a2dbbc601559b4d8fb4d4b6b1
SHA1 9319bb549f0dbd4beeaba9e0db9a1931d793c49c
SHA256 3acd715b3e7a1c12b1f4c2e2d06a0c541804a6f957462270408ee60113036355
SHA512 94e2fb59f80d3d2d6b11371d7860dc257f76f3f6b3d96872691c627e0eea63e044a4b429104f4f1a3ecb7e624df76c4604f9764831d8bf28215b1141822ce253

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon-tech.png

MD5 b8520f42e7f68e487add547bee37ef18
SHA1 3299dd84bf22c434ceba9a548d45057b8e6ed2a3
SHA256 2a411b47f960bdea4f45c4b09a156bc617e01cec5c04b2fc704105fd7b058fd8
SHA512 987523aaefdd652af148e95e44fb131c22c6bdd782af6b7acbaaa90ec36ee668dd21a2d955341938611aa974888be7e6722a8bb0e656d35f6bd0548b73918dbd

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon-small.png

MD5 a22e1007d8b71a3f488b1d1df8bb326b
SHA1 9380161c3f4dd0cf1247c62e41024b7f84a9c8d5
SHA256 05fa1f3e59ebfa90990fe79514e4b2cc106c8871be2e21fb805d722da6087ea5
SHA512 8d125e8fefcdf0af42aac69ef7f6b16d4d45d0e5e83267ec9d717126c9230df2fd3ed3d1e0782daa264469ddaa383f2f82efc5bdf9f90302ec0c54f794c75836

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon-small.jpg

MD5 8642f4321132886f21f6715ad3b83d50
SHA1 23734670e7ba5fb1f8578207996b8bbe3b896ac5
SHA256 8b4c2a9aa9d36411638032252498cded22d4d5474739a450d8125fad7f9e3408
SHA512 c94c17e380ba6560d30984f99f6ff0c13a18f3c32d09217b0236eaac882a7b3c7cff3b2f32aa9fd6dec89fe091d3023d4c78113085f24edd97ba283d967f765b

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon-security.png

MD5 2549cb806af2942a775652898a0ae328
SHA1 5905cb07e55bcd5496e8d81b39a1d99a3afae171
SHA256 d03267e8abeb92492a7a80b5c6ed57268887e618668a5611993a24c212072973
SHA512 89fcceed302f0e263cc87f7bab739f7e60aeb04a46c8b9c40a31193138cf91fd5071dbeaecb181a96726e0539bb1226dbd4f99d1a8987a9a72d3643eb3ed2525

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon-hook-orange.png

MD5 75ad4b2ce499134d95a7a8d3920141aa
SHA1 c635151c36e0a1b23bdf264e66f2057860ac2869
SHA256 82ef9ec99d0a9cf4ce8b3049e24b7e54c1bb4d5af658ed59f49d10d9a7cd8827
SHA512 8c0b15f6acd905e9676ff73e335fcc748d899fd3c78806350537408fe763a28751ba2b8d3afebf4508e2fbe9b4f3db67ae47592f3ff11a2d175d11d2dae91f2c

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon-gift.png

MD5 52e6b8b11e8223409d669441ba511cef
SHA1 bd8958a6c0e9e8cbbb7ef7816dacfef2a896b88a
SHA256 2528032f1ab8af5f58d51e1909b948a9424c8bcfa6c74a657defde94f2175e8d
SHA512 63fe2a871519698ed506b4eb47fc1f563995673930950f905bcfa901195211c4465f57c996cb19320ce1fbe1689ab5ceb65ceb50ee10dec7e9ba7493a5190c93

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon-dot.png

MD5 1380a90f45c0ff8bbda563f0ff903429
SHA1 0f6b9b9df408d4953fa0ceb54e3a536e52fe3e49
SHA256 6390c9d3c61ed100226d74121ca9bd2dfb6faf4e28863e3b7c7513abc4e8099c
SHA512 f4996889e9d73a9367ec3c9593d5592f3b7f67bf8250ff5d5787f42664927bdd6bbf77a4360ea63368e8a7194a6ed085bd999872e9bb09e8ce0de6a3bb9bc1de

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon-block.jpg

MD5 28a7fd48b0b5101aad80e10a850f0ac0
SHA1 136e6e496cbe165e3f4b2cb0544ad6d31cd87f9d
SHA256 973fed9a0dece658cd46ff4b6e6327e5bb0a688914c3c4afbd84cf1f7fb961c1
SHA512 804e24f03e74ba4ce0f7f9772854117f1c768e831bfcc50dae1f548ed66cfce9314abf2f9b7f60d45962f0c0e1d0c584a43bacfe7ecacb8de99498d0f586d4cb

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\ic-lean.jpg

MD5 af9473282fe49fe3bdd0d324188868c0
SHA1 95ca8a16a68c90f8cb42d04b495d8ca9e2a5c57d
SHA256 be193f7c9fc993a0479ebc37632ae9f8b3b95798d37c660b7051cd44f5992361
SHA512 9983c8534b8eb8ec761338943b5ee2aa18c948af91f7244ee67a503e506902becea7b1f9a897c8d5f28a0768f3a48b572fcf8f755c6aab0ecb68c677c71e0208

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\ic-9.jpg

MD5 b554d2035924de2f2d354f5a34172b6a
SHA1 d8d7f1364d4cb2dfbed8772e6d422808c8c3f688
SHA256 622f7e0e9b249bf33cd8293ce7f7c20e30b7d86c914a476e654224b3b2036346
SHA512 e0a60d9495a23c48a439fc4c7240a5a89bbf206a5a852152a993b12def5d0898b74d483afc93a714d5886637724de95a8fb53dc3b4f926fdef91612e4596607a

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\ic-8.jpg

MD5 b7a75e00f51dc505cc41d5c25500215d
SHA1 5921faf9a80aa9b70e6d4786926822645c0dcfcc
SHA256 5de44909fc6daa1c6c326a735ae7abc53e2e8e7f5a4c07e71aeb35ea6fdf99fe
SHA512 da3fc9e4903122852bec0cc26cbb5660e2bfd4e3676180cdacf449ed70337604729c2e09449b2d4fed44fb8046953393a98a8f1494c863cdb4cd4bb7884b9db7

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\ic-6.jpg

MD5 f69d7e37fff36e6d47ac4cac63969f96
SHA1 a5deb3aae657b5e6fe653c7545294a669d22d1d1
SHA256 26647894b9d968709fbeefb4ed588cbda9cde5f314a622dba1f75735b5a7aab0
SHA512 de03bddf12c0dab1916d4887ccccfa42dc75dcf44c18a39c0f480c9d50da960f5212414fb90e561c8b1688563005b37abbc65296944cee36d7087981212ff0ed

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\ic-5.jpg

MD5 c90b69ccbec35ce5142b445a99eca2f9
SHA1 cddbbf412c4d6bab2b5a1e6249cc99a8fa5eca7c
SHA256 14ae20dabc64ecb4023345ea6e6ceed388ae40c684d1627c463f8b8b12c531b7
SHA512 5ed6296ad688c97637baa35b8b5caa5ef32dda423148b100e1a3b8a018b38d94cfb1a668ee3f55bb6773bd6236a3d642c291b0ee43cae91d676d209fd91de675

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\ic-4.jpg

MD5 6615fd0b6c897a7679aeeb5890e91bd7
SHA1 49438183a940841bbfbf1211d796d07998fbe496
SHA256 59c65ceb33a9e3cc20df1e62c5efc7821d13efa354eeded551749ecda6b6ae0b
SHA512 c53d02024b6762dc65eb4d4617ab33c7877e545504c69edacb23fed6de190febc2cbfefde3917a64b7a1d42b4f037537292bc936317baf7da9cfffd6c9366050

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\ic-2.jpg

MD5 55cf81f0c0bdd535fd5464db3c12764c
SHA1 fe6dcb9f76b73ab46850ab23cf28c7975cb122a0
SHA256 957e06bfed2df4de72f868bdff8914ec3af22345ad8bc5cfa0123242ec16d837
SHA512 950d38e946d54f1ebf2972252e189a24c42d6d29cbfab0bd0e33cd6d801ee711d08b7581b17e9afb652af25acf85ad1dee1a816c59554708d46eb699da89b885

C:\Program Files (x86)\AOMEI Partition Assistant\html\img\ic-1.jpg

MD5 85e63149ab0df61ace0298aaa43d3f1f
SHA1 3a5d285322c6d647bf8c75ce95bba480c9001b3c
SHA256 bd849bdefe2c428b488db3ea4319508b736d7b5f64e7d3d0b55aa8b54b279398
SHA512 4dad1b68503c0a13033bcd47b919a8e789fb5d5ae34451bc237a275784dbfcc40757aaaab2af283ec3be4f6ee1fc5889a7ef4a3715cefedf70e996572bb89ee9

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\gou2.png

MD5 b3ba447a9faf7f1bd97768d66383d7c4
SHA1 027c89717101d9911824b954f3d7297e72a4cfb0
SHA256 68b85b17853633beb0c7c309faec5db36852f5b329256d72c2aa91e56c6a3539
SHA512 68f70a9ebf7c608c9e62f4b77ed28f4b7b4fa44482273a205e4834c774be672ec6eb3c5e603e4ff918cac6a74f38f0229571d20133cd1f0e37fad39231ed4e19

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\gou.png

MD5 a42b39ae94896f5c45c4153381254d45
SHA1 b5f37171ba2b0aff22702ba449f51413c48f80b2
SHA256 b692d896010b619503500e131404ac6a5494990b7607d4bae274f10b3646812d
SHA512 c94d16e5553e8126476b132d4c2b3a4e3a17a6f6e54f6001eef9596fc35251c1bf87cc7c65ac68efb224a9918f0318545ae9d2e36d7b1cca4444b7cf78c0bf78

C:\Program Files (x86)\AOMEI Partition Assistant\html\img\EPW_small_normal.png

MD5 3b0a83438908a769b8e36deeefcd4222
SHA1 be84b9de160661b3c0a75ca82c5644c9d2d680a2
SHA256 2ef421ea7b6d1dbb525aa6694e7d8b7f6b1601a05a1c5ec3248673bf8e4e28f7
SHA512 8ecee876e5ee36af70679d1204998ecf1d464fce1c9fb0e434988f4fbd257dbe60f72d70ca0db21da74df0edec56ae2260661823bda4cd5dad84eafb8c6e6b7e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\down.jpg

MD5 5a049daae8e63ae531996e14552e0b07
SHA1 e6a8ccfc852415e82ac6a57ed25910b28b51fcd5
SHA256 68628f5b2b4b1354349026304f935db2d2033bbfd05cd9d632c15990ca7e3e9c
SHA512 1a57191f8b7b97c2bfbe4f800d3b2015009aa770d21e4b4fb633d24c993e1ea84b0969f11f8f01dd7183b6872ef6d220ad846e06739b49ed48796ca8639c29ae

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\disk-copy.png

MD5 19818a95c0bf7d7be9a1125995780a75
SHA1 c50396c2bf7278b5da31d16dfbb4fcc63d301f75
SHA256 c30e2537db92e4b7477a8828ccbb5a485774bb2f867872f2d4956ddbc0cc4fb5
SHA512 7663698fb8d0f06b83f25e9a52c241f3d41e18fce5b68e1e0ed3cd47e467069e1c353de34b143fab1a78c0ed1bd3443469baaf286da22cd7e6a07479d89be132

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\default.png

MD5 b65da396af5da75dbf4c4d2116800543
SHA1 c7e60e0b9b5d02137ab11407b9b63c0e3ade7e3f
SHA256 6b9f66622ea6315cd0c9cccb330caf1a228b086dcc37a5c8cff7aa879c82169e
SHA512 8ce5c8757d48ad76015016797401ea5310a98693f1cb999b527d925d8d0c5bc917322848cc858695db1d1b6e04d8e59889bde1cf588f236672176c2dc90dbd43

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\copy-partition.png

MD5 5398cdd918d1b4fbbdfdab0ab68a62e7
SHA1 be4b8418d7c21c45c57c02aab911b709ee13d4d1
SHA256 29f3c54613053620e844f1fcbfd6959f74e6bed2eea3ecedf82b89328113acf6
SHA512 0494cd70a2aeb61e5f933c50228959f5c807e217dd91336b9fd559663ec49c59f88fab45d88516903f6c09c753ea27b3b041765ab8b993ba7dca9b181764cfa7

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\convert-mbr-gpt.png

MD5 970e29bb04a1b1037a1ff55fef317aa5
SHA1 4d23af6d50444f73a549258f2f2c94cb6a93b099
SHA256 d99a1100315753c320a2c3199fbfde5edcac53ddeaa5ce8df000a4d5ee738b17
SHA512 29b55a273b2c4c2a1c155d3157febe564aa329083a61f7702fd3d0bd791abb46cea2e98b52d0b6e599655d26b3ad90a7c0ecadc07140b150cb6ac2ef12bcbe48

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\CD16.png

MD5 bdb419f87a14aad927785137477c24cd
SHA1 f3ccbda70047ec96a65e2e92e0b3cbaffba51f1a
SHA256 a7af368f5ca4e7950e84b929451a4588741d58d3443f342e4b9fa189b001c961
SHA512 0bd4b3f2b9e83eefd6424b26065b156a363a0b62bb59cf2898f0485c84f103ae61233297ef39b55c86c4881bd10340287b76b104d6bd2ef200b9bf39bd8a3e9c

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bt_normal.png

MD5 70d98076354ae325affb5fdfc222d5cf
SHA1 f2d5ddd5a267d6bf82c85a9b1153d75d5906b751
SHA256 cbd5e42a11b8d4c44320808381bcf2d3369c2ea9967bdb5583fa10a219fb184c
SHA512 947d65ac7b844e1fdbb7573bddd9af1efe0baef0de4bc61a91a8a5f7949a0217a743fe3527c45868797d65bb64ca028944b312b7b58e32efefb00e354ca59e00

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bt_normal.BMP

MD5 c5dbdb76e2ccc7b5188be0e03e106277
SHA1 e5dc70248fef83fa22e3272444d6d1da4fe90744
SHA256 d7ce53c5119f4477d0d7c51bde137320f26d7e29852cd6d6283a1b21661679b2
SHA512 42ba52fa622bac8ba6d57c4b98b1f36db3e0bc38eb91f0e05bdf9f81ca215c74eb4416c7f266e48e7f635b006a8f3754f92601a36a7d1c8f99b00560d6ed9f4a

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bt_click.png

MD5 7e2025f2e87bef31bc0c2aea91d3eb0b
SHA1 08904ca3c505716fa97c58214fe2ce4c8cf896fc
SHA256 bc732828fbd038bebccc50c090fc3df10ea9d89a1f960692c692fa814f8fb766
SHA512 71c97fa42f097010a5e7c3b44fb4bc3f2752ec310c0a93634e1b1bc00504cb3604254d53eac0f94323941c0964cef04fa98a9dad1f29b7cb13bfb52376e02afa

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bt_click.BMP

MD5 88275fb721382ff12e9d9cd3f278094a
SHA1 810ad03e9ab4e31a8197e3c82bb48670cc77a386
SHA256 a99afcc2c6f54fae403f3d3225a45b98843744182f12f06f40a87d258a814cce
SHA512 f44e633f6b0ea299bd226be99355f9a7dcd6f3cae36d43765e3307091143d0e0b569abca10bece9f2ab8921a1c9e07bfa7547c3b420aeb025095e16a2c56bf64

C:\Program Files (x86)\AOMEI Partition Assistant\html\img\bg_top_lan.png

MD5 fc3463b9bddaed795d5b826b785a70bc
SHA1 f05c0c45adc653fff77264e8908a67e6b8f32c0a
SHA256 38e4db832f8290f80f15a65104f083c5c4d4ab3fec65be98439832f9c7b3ce29
SHA512 806c669ea9f09c1d193d2575b8aff579a6a7facc78407f09b39442112b1e586fc0a89275d9cf598319f1e9e0b7b5baf3c4ad59be515ba057afddfe1021a523cc

C:\Program Files (x86)\AOMEI Partition Assistant\html\img\bg_top_h150.png

MD5 3d2b4e7c9a47113ee95d81d007c8beb7
SHA1 6c72f93f84d3536d29465bfac401a7b80db8cb99
SHA256 4d90569f4b4306f2a600c9a2cd3658f3345b13166239f848ebae6758975d90ce
SHA512 c474d2cdf1c8400799bb5bb233ca9b845f8aedb496f067fb28aafdca41614557aa8fbee764c3b38b18a17b8f4c71014e003b52f16b3aefb112a3e929b9aef320

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bg_top.png

MD5 9fa7d9b54a974bc0d395b4294281695a
SHA1 b6e31166d5162541447e0351213ff28e65445f05
SHA256 d398bd0dc9acb3afe15014e06c7e2eda16ee92255c479d4246e30d3273c5d55b
SHA512 43e52e1b2d9d2e8c37803f58db39251f0260637c04ca1683554e3d33a146bb8b8907f31092bfbe0313ab1abc8232ba97d7c4dd40f4f073cbc9793ba86a20b9c1

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bg_top.jpg

MD5 02dd958c3704bf9eec6fc3dc1b15e6b4
SHA1 06baa0e377c19daca2ba5991634c99e7ad36f55f
SHA256 ce45fa75b7ef1bdfab93f98985b4982a8a119cd382eeea7a6f7a585ee13a1f92
SHA512 22262a13181a38aa76f831bd02f800940e982de67345cac5af7ab51ae9358f64f8b2eebc9415079135073fb8e82015be5cfd1442949fc8159a7d709327423a0e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bg_green.png

MD5 a8580df461b441d16fcf1e627fd38b5b
SHA1 d2d5e97ad29e01ac4714014b29153f304f859aab
SHA256 b172a8d9c131bb13f39a2235f7ccd25a285dc74866776cd57cc3f3e5dc6b01a3
SHA512 15b4ba39b0df7cf1ad65dd68bc6b38f3af874d8f328879e4b945b48c2dca77232112139749dbd82fd4ecaf3b966786384fc5a9c59e72c2652c9c1f01ee8d8821

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bg_green.jpg

MD5 0d867f5d95f28a60913607f70fe32efa
SHA1 3fdbb7807c433575e392e1e1486eb85bc8937143
SHA256 fb824d5af0c8385f6fd638fb6ba897647c5387cbde0956ae37d2d401281f2699
SHA512 7e8f2717183a7175f3492f4c104864a068836ade7999c9ea7b1f81d26c73767efd042d7ed90635e5e70b4d926ad26d8e2fd15bcec94e9de2a9fba6339669aa77

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bg_blue.png

MD5 db32577fbacf4fe383d9aee0c084e7a8
SHA1 c5e4c352d57ca5435b5a873f5f004e863dce68ed
SHA256 a0e5e7449d5053310fcf61c0c16294be782a0cd72041f1d9cf15f8cb0075555c
SHA512 20f7f1be524c0aea732381396bf7dc88a90563a6597f346f35edce039c10d73f9ced017c3191996fd5026be70aff27c0cce3fd61a7db662353b7ab7f1028be8e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bg_blue.jpg

MD5 b63db4a24187f993cf9821ec4d365d65
SHA1 5969332fbdbb8ebf7b8e5dd69b8d04e7b07081ea
SHA256 6fcaea29e577e38c7880f9df94658902421b2aa9258228b2ca5832a2d7c5b547
SHA512 576f096732fb2c50dd5ce44cbc50e3ffa39e0370ff41be15e5ed82dbf4692b3abee0b9afb73c6de162cfc6a4cfd57827df4042a0a8ee27af4e694d9527396b4b

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bg_1.png

MD5 455576b15a66cb05f35e2e5827124085
SHA1 9d47a98ce47129f8719cd1858775e9103939c572
SHA256 ef1a8bea1f8d0b22c4f10326291b53cb33b6408659d6e2e80f4cfead2d453f72
SHA512 9b2a8a5aa99fa95bff6b47b40016893bf8b41c378243f8faed9eaad3c0fafe9ce320464ba77d29f04ab2d6491c4143e13f05a3be2c5262949d845afb88d38daf

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\bg.jpg

MD5 6ea308424c696b89391fe8b3b88b7eb9
SHA1 9ebb1dbb97d6a37631029b02daa813a598dbd2e9
SHA256 c12074afd4137b32d46eb5aaef8613f3fc94907ac2f6b1185c7c3fdbd151d9f5
SHA512 fb419da6b24f1240bd7b40b63d7562c60790d6f637d96e0d1621b20de8b6b9e88fd54accd590c650435e986d055a49cf43bcc11464f26f7dfb68ef076028ae56

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\allocate-space.png

MD5 32ed86ca4a7b78100c179491e168dacf
SHA1 9a8a099e5391a709ec6978588dcfe899f98c550e
SHA256 728876f294ab0f17ed1837288c5ac6d553b3d541c4f4e48142fd3dd8d26e5185
SHA512 09df02a7201c5a8a59f979b838790afa6811c7ac1cb3a165e0db444824dcc27ff9203f1206b32f9c226c6438000f800f289a26120bc2d926a404328e37581867

C:\Program Files (x86)\AOMEI Partition Assistant\html\img\icon_13.png

MD5 34c5b5b7d7ca6648df297442ef1f75fd
SHA1 b73e2dfa8a6b023ae3a1caaffb62bc795d169ea9
SHA256 86d6befc925b20c732208a03fec49d4145767deb34e81da7097e32b4f2d3e8d7
SHA512 d80d35125229ac0a9f79b78f4324f3057781ab27e3c9b53bcef48f70f590dc752775d93f6163f6de75c93f10e898d0a3401fa7530e2104ce115dd23017fde94a

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_12.png

MD5 b7794b979a49656ceefb5b1369e6313d
SHA1 e760f94ca2f55ce3ecfe049388c1f7efabd250da
SHA256 e35914e5f8a1675f42f089c091ac90e6b0deca7a0526ff8440ee003d58511133
SHA512 53856cbc830d6256cb424fb5fe5a99694499d0100dca57a92b68bd94518421b2b93608957cdcc9a08fad666ad9633893a69206ec151fee7f9315cc6d32a394d1

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_11_x.png

MD5 7c35f5563cc3943245c2c8ed89bf0a17
SHA1 b528fbd70eaa12a8e88e43792236668fd5a7ff37
SHA256 cd5041815501ceababae4d0bc5fd2f01a2b9e25a3329756d8ab03c2139b4acda
SHA512 2e43d7185d312d019aa07f02daedc8466f531eeda59105f27aaaea4d5f25f5b18d89acd0186029754ba67fe9df14a7fb074a11df41475cef4e2a27d0514c7d04

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_9.png

MD5 cce3cfebf7dc0bd9686e68b315e82858
SHA1 9e672f45da39e5b4682f6168d068fe04fd2be875
SHA256 604c31ba06068a75c15bc92730719d0eb2537226fcfe12ad58fcac4457269ffb
SHA512 6497ee5c9f2c44dbe3d44c19e938d54fb6549485ab1d937a0f32bfaa3ffa714b228a70ff9c98a578840edc12b05696f219aa3d3ee42403c7b95fe7d7168a4577

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_8.png

MD5 5ad9569d4eff8340798109dadb092da1
SHA1 cd052573654bfc4d82153a32267ec354ff0286bc
SHA256 d418e89f6686981eec3b9e51ac32ead6ea8bfa17f488bcb60d42dadefc372c01
SHA512 373942a34d1843ba654bbcc111f1909e15ce6300b27fafe16e575925620528cb50b76a770dfe4aca80dde198167806d2e9b5955e3f5007e96cd11c1172a7b901

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_7.png

MD5 11e36c8e12f7006a5b6d316d5963e952
SHA1 770516ea4cc53dab8ec2f8f757cbc3939497ba31
SHA256 1a1073efc72004a421029105c52753179750e8b18a42657294124ce506c2e87a
SHA512 7e65f4fbb43ce1e2a682f6e33a0a08a7d573547fbe5073d822fcff646a194cd214d789aafd9a394c4548149b54d363bbb0d5681dc1da4de956453b9c18e2852f

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_6.png

MD5 bc265e54ad941f378dfd8ba274ea2bce
SHA1 9c017ce78083ec4af5a9da041ade276ff127ab04
SHA256 32e259cb82c3e9f7b4cceaf7adc1025190488dd8bd39c1bf7e1913ad2d6dc8a3
SHA512 acdd8f955149ffe07ab011cb24f6d25b2090c8df486477bb94a6ae4959294958097f653dbf8054d45b4971755913cdaac55c006dac0395abf9f398dc3bce786b

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_4.png

MD5 0548adfa0ba2b051bd78c5cda5aa2460
SHA1 361a21dc67b6c32427e5156290e7acdd056fafad
SHA256 50ea5a353ded957d7717ba611e9e845a3e1244683b58619d3cf17e48b720d133
SHA512 16a75a69c294428b1a24f3123f13c1d45557e5a6cc81754313b507c768fe3032573ddba450ef4b12f1aaad768ee62ea592bbc82da3f1f2f7c3cc07402bc05781

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_2.png

MD5 77f97b5163ee15f08d05f171927c98e4
SHA1 fe751cfcc4c20dbecf4ee4146ed8964580d61708
SHA256 a0438f9ed88981beea0ec8cb69b092c1595d318c282bcd9bc17737cbf1bd6211
SHA512 849c8d7a1268ffcea40ffb37c502eedae216b2ab29c993fdfb8d03782a504e7119a5ceff469b278089b2af0a0eb285ddfd8c92bc8c11f3585ba4621f093ea914

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_down.png

MD5 0f89a7b58be8f675f234e560a035ce27
SHA1 b49289207624d7c19fbe56f71acc05debe82affd
SHA256 6ecc890f7f2d64268dc5702624302e5dde1be2bb171a3827851be705ee63ac31
SHA512 f8a0565be135a4ca906888de9d4a2c11e36655a55a0ab210c1fc46a00349624e9348e4220480c2d1dea73971417c6a70878e537b873a9582475086b1c9300865

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_90day.png

MD5 d5ff23e89c1fe5d05ffc92fab8587702
SHA1 67e757505806cdd0e3052ce7cf726a8c2fe94669
SHA256 ccdca90d4a0e14f01eab0e6d191e1bd16437f1a66ce44da10dc1c40c025d4822
SHA512 7b7116e375834ce8ac2dbb478f9ee546d4d2fc0c79b72122cd2ee77772e75dbf686c1934c3485c05daf8a5363b7a651f61f65467b2da0e23fe359f8ee95fda04

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_down.jpg

MD5 e0e759f5fee99e3bb79b03c03e81636c
SHA1 dac66de26d171a0b7d17733956b017c7e8096987
SHA256 425fada43f31c0d831b3f1766682899c6a2975da420f59b4320da88075802e46
SHA512 9210340438b56b021fa83f8a8d4019012f10088ac77268546b23a4f3db9047f4e5ad45a3073796e1c34dfea2e8cf2c48072ab821ad150e9359bc7818f14c41f4

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_email.png

MD5 e591f50f03a8c3a7b107b32609d9a307
SHA1 6f4ea808892f4ddeb6002fb545a99445e37ce816
SHA256 e9017c7ddf1f596c54c8d27f9a36d78ced0561c8a45e33c7db94bbbf5ada6ccb
SHA512 3ce22ce482cccc5ec47908c70fcdda22474f19c230ec3c36bfb605962bf6b959c7ad761ff90c6836b41611540f0e482cae2f94142b1053d3d1e2095ab391e02c

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_ltop.gif

MD5 dd682944fe6b00f1b5a2120bd7bc4452
SHA1 9379886c4c9a2fc9da41c40b132c1493bc1e132b
SHA256 ce8bec64cad96f107c830ea61359655763d4a6413adbb03c7acc788f5871a878
SHA512 2a1853ec7a26674756adebddf7cef741e8b0a34a709b684010e002eedceb436d7ef8a9bba674e87a3a62ade9562367ac49c72bcac78f4f9bba4d52e591c926b1

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_up.jpg

MD5 620108fed0e76e3959e47567728192ab
SHA1 c025fe471877282ce71b35b1385edb874ed437c8
SHA256 ec6c857f676a90736153adcf637b0a72884e66d49ab307be0a9688a2faeff7b6
SHA512 04b70acf6f54c986749c399fca72dc59decf9362cff2495688ebb71b822d6d6a5b313fe83ba6350570d00bb895f3cd7e4229f3d66ce330c222ac063a7b1617c2

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_unfold.png

MD5 4f1035c164c37abea734e26027adecad
SHA1 1d2465031fe2adfe42893115c714f9ef94de5a7b
SHA256 4cf836b6fa3c2b024b26014622005bb38ea9ced8f725ba830365d300505bde5a
SHA512 3bd38d0778c14f1263a7e36cfe64a3fe232f7ca4de5a648ac110636f6fa8c96416bbb7d299a0a13e68054abfae16cd4cd1c2ce1d14280264db893a0cd3723b9f

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_trust.png

MD5 e6803f829a68dd16debd3ecb9cc979eb
SHA1 51fcffc64d1b346a0c72211118ae0d2245904482
SHA256 eaeb6b025286067549991ddd66ad2023738f7492f1b342521a5c8c43762c54b8
SHA512 4f761ed689e78fe12afde4c473c7ad65758e2cf44e1701fb15070133e9e4d8127788cfa45d279554b9694511632872d4e1f647d73307bcd45070bc619bccbf69

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_technical_support.png

MD5 2cd700459aa0465463f1a58d1893276e
SHA1 4e1a7bef7a07160e86e79096dde01e0827b36248
SHA256 6972353b2cd898eb2e0c84b1fcae56813fd8ab668eb492377ee3b96080335a1b
SHA512 e28c3e4aa809e2bb6c1b6805388b4104e62b22346b6a5e4f2ff9178abf1df9c66628432e2956953a1969599c955b3a13d81ffe25b9244f1f2c039b9b7affad05

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_support.png

MD5 3085b6e3ca4d701f13f1506bef637cdf
SHA1 a102e0c660554689013178db398d95c3250386a7
SHA256 bd1b7b66daefb3ef495918b79b790aa7f6a083c3fd52531cdfefc74ac27c5b74
SHA512 d01992add50d5f1abeb6799605e7dff079c03015e089ef669f8dc41842a52bd28136626f2b49935bcdde6229637de20ba5ab6cf21d12874efa1d48f7ee3a14a1

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_star.png

MD5 fa668b4b5f1d094ecb56cda62ded62c4
SHA1 aec11631bb26a0db5b0dff32ec9a64b9057fe3e5
SHA256 b88a9ac169df77a40dcab92727ba007fe128332de9ab5aab890beab9120b3894
SHA512 c49453c81fb93162537bdf841826f26f08e05e10e0f47cd89d59589e27220c03be9614c0dfcc7212d597c3c81dc5e40d420e5013b00d561404c2bf53baceb690

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_receive.png

MD5 93fc29a667ddd9c7a155581cced8e323
SHA1 15f5953c4c649da14d44bd76528eba4bf1e3e00e
SHA256 a3508382af68689ba2050cf54423ab89597164bbb5f145165d83cb79f828b897
SHA512 d506cd8a8ad65a90de423b73c20b803140362d3f164b51d3d880e4f0ccd19eac5554f2ea786064d7b6ad65c1562a89ce68e300256e0bc89fc4fc37ef11fb0a6d

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_note.png

MD5 ae6c6394e709b633af5247833896139f
SHA1 6814a26d9eab0e2ebb7166853f78c76b405109d7
SHA256 e5a15421a2d2261d039f0199c2347239099a5fc33b4265e92842d9b5216992e8
SHA512 969a287b1963216ea8bc200d253deddca41538c58274740d8d90ab34268ccc816aaadf7219964c33c4b08d838e4e4d73d84c502b720a330be355069e1637ecda

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_no.png

MD5 e6a7994fb8641e5a31d03514559784b9
SHA1 4325d8fb8e2d178db04ac87461f8099292589334
SHA256 435bb310276e03d87d29ed093c77e12d21f58223ebf7a8ca10344a4040e57a4f
SHA512 495626627ceee2c157e7f75dee0bee556fac7dfe18dd7ad430e57024756faa0f04177436179b762fba819228e2f82732f8c3d177ff00e49b17e56759e69fdea5

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_ltop1.png

MD5 7f138f74e70e5805cc9b70ad3506111b
SHA1 a2f6c5c18e1cf55b4cec601738321a7318f4de7d
SHA256 61598dff39af734ecca94557c0634d1050d81b64c3d6cadd9f7d86b2f02ec116
SHA512 dfbbfb249a0d9953a8c1146c929fa35bdd8c8148085623685f6d8cfe290382410ccf7e4ada6bb3fbc5758c21161df216a8a18eccabe4a52b3dc98d8d92e31b1d

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_ltop.png

MD5 03239891e447a50ef7a65ba7426aa8c2
SHA1 19d42ac80b0fb73a18a0f56fba61801cec21af37
SHA256 b090a4a2a9086a863eb1acc944a9ecf9fd1b7ba4cbc4f3cd550ea5bba2005adc
SHA512 4b14b6d7c65fe416e7b798401bc81d89053bbf6e21119120ab3691b25eb6f1de109f9843909ae67650a8898b4310dc497e646041dcf67e0ccf8319fbd6d6bd57

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_label_top.png

MD5 ed836f9a537a3f521f2a8b996e9da6d7
SHA1 66e738c6ab044cb11b9e4968778fd7da57c2c476
SHA256 ff544d412b25939102489f8b12eccb6edb88a81788ecbf866d89883ee71a0ddb
SHA512 fbf6b0853535dbe095db81a11b6293f5b1581212bf874c5a79dd78479099956963edeac8e273f5beadb982173fa6c46d379ecdf99c46b08663f1e68abca06707

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_label_10+.png

MD5 bada0b42a1c4cb6027b5bd70620f2617
SHA1 939c063cd74d2bb0f11150ff294d628b50ff1815
SHA256 cfedbdaadefd868021264e71ba6be793c41ebcfd98956be34437253c3854788d
SHA512 86068e54a2c39cea164c9942b695da93d5cf3ced25c89465c1b1a5129ca3b15dc9a47d6d40a345f6e3f6eb48b3e840a8dc8223ab395043994e055c2eaa77eff9

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_immediate.png

MD5 73cd1e6ff4b2795e125a78e88a5cdad4
SHA1 ff576a28491dca7121f0c1ec1c4c1e2461248051
SHA256 a72c4620cc26b03e6392d5d8a9cbea9abb2ed6fc72b9ecd0253c9a99b299c62a
SHA512 86291613d5ab7a38acf2a96edb917729078c71789506bfee146c4b65fba78464d8148832f644432379944fba74a46e22313147201b9142d1440bd086c412f66c

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_hook_green.png

MD5 c0c69866aa2a5a2a14dc6bc84eb410ac
SHA1 6418d3df1816875ff244a98a3721b93531a96613
SHA256 55b5814e16b2f78ee5f90596c718a05773f058cd85785c0f368f67d9b4799ae7
SHA512 82df3da8c26e604c35f4b92eee5d6bfac2090bbb40d1c8544b2f249c9bbc9889be88e2c2baade3c1dc765b1352fdb6ad66b9ace10613ca22132e334a8b123584

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_hook_bule1.png

MD5 cdbd4d98409cdc1ec743b98c7c65a659
SHA1 242004ce2a3c61bd3c8c5b4c28b28c531faedc55
SHA256 234e480fb38a9b26ece9cd110128bf0a3cfcb0c3dd89688277d0fed775b0a59c
SHA512 a325494e5b80d8b4d6d131059442bc20d95a4ac203f75bd92f1b7999a216528d698d3e905de2ee914e8f2a31b09a5880c07be080e9f639b27d3ee324153ef6f7

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_hook_blue.png

MD5 3520a4fb02f2adb0a23b73602058906b
SHA1 81e10e32bd01edd2e18f6eeb8ac55fd415a9bf8c
SHA256 f97be99306f57175ca6ab75c22a19ac5f0f24f7b611c7f1c587e73fe0a066b01
SHA512 558e5c02e8bae280431b6536720de259b986010a86df455273ad9b5cb7d7187de197942d0c804ea429ff971c4b909f589fd1508786c146a7c534bebb10b76f6a

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_dash_grey.png

MD5 39e1f2ed1f13b9e78ec02fa962547ce3
SHA1 67a6b2b28badc2c990b3d6798754ea53ad5bbc19
SHA256 c1409ad7c68d18fabe174e3576d25712c9e4de3ca4b41aafc72a90133d029c64
SHA512 e7d2b6c1d8105ca6b73f3957b98f336268d759d2d81f5a35b1ccf0ac761055931653f17751d3a2bbcaef3191a29ddb7286e5924b87c59dfe9f1b6b36c6881933

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_d.png

MD5 dfcb4eafe0ecb0f375fc8adac5d0eae5
SHA1 f676374a783bf804d63c644bac0d1b8dc4de345b
SHA256 ddfbdce8cdb5b7d0a77356d4ab39a7cbe515b811ff00a89ca0bcd9d3e6dcd77b
SHA512 7966c5ca1238b419e9d13f1d182a8ccd576070fd2551aa0df54a24bf39c7c1257b852a0443ab7a04f3d252afd3e4a7a04d819eeb7e87884229c494949a14b585

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_car.png

MD5 9dffcf51d426bec1fa45897bed3b266b
SHA1 0c1c980fab9d9cb63b86f62a18ef47c79d722153
SHA256 59955a40fc7088a2a3da08e2b34d850b5eca842276f82e48f127d9fa01e059c7
SHA512 84dea5aa3b5b290c7ba23f7df075ac0efb39cc687ea82de39d4dd9d0c7fc23a797b608e5a8c138f42cacbb42bdffd9533e5098728329f687af24308198df60ca

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_car.gif

MD5 f25fc3d41cc23aaeb563719ff4fa3f3f
SHA1 e6ddddc62502e4418b017f8054945c57f7cb9584
SHA256 04e3b4deb4c76ec97438a1c99a5b6a2a9d1c09b365f065b37c5cde77d82c3404
SHA512 ada4fe118ee758eb31b53f974e63e83207449b54f291830f16b91033958d35204bdea9120cec67e93ac7028c0f6770518d3150e01f5c305aa647a2591827c944

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_9_x.png

MD5 52900474d84e9dbe895b4722e3097821
SHA1 d1ca67550508c31a21d7d627ac74cfcb52363eb7
SHA256 ed33d33da063ab7d86270d483176540c10b8bae02861bc5053da052066284e93
SHA512 537d136d5910dbc73bd1a91dd813b9fa3277ccbfccc7e8dd8241a6c1d168812a06e28d1982c8da928bbab004caebf35af80b32f18dcc8ef5a459625e147340da

C:\Program Files (x86)\AOMEI Partition Assistant\html\Win11\icon_list_good.jpg

MD5 63b33c6f9ecb9f45e9cf50bfb6798b21
SHA1 b2c1f1f60e37a1f3820d45216d8c69d14030ad65
SHA256 3229d519413a73c433c440f5e7617d65dd28abf029e2fd0582d93577be49ff9b
SHA512 9f284130ecac3dbde22c2f7bf8b4bface66f65eefd67e48ca86468861908b3536d39898586991e98eae4079366425fea5ee578c32e34992c20d3e33ac35605bf

C:\Program Files (x86)\AOMEI Partition Assistant\html\Win11\icon_list_error.jpg

MD5 13e6654301aeb15d420d3df6958764a1
SHA1 c7f6813e96ffbc5cbd6db62dae43dc65480c2104
SHA256 9d08f08708703f485108a41ba46318e64d2686074e49a2333f16be437eb10782
SHA512 68425abcce1f94fd97d07d00f901e57a656f83863759e2482f8bffc87957d91f8a3e53f78986e43b91def6e29f48502b3c9734dc67c682b5a547c678f9db1ae9

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\icon_Disk_conversion.png

MD5 622fdb3dd37bd889986416f5d67b2782
SHA1 f2ed75803e562a621f3ac8bd33cfcb0c294444ff
SHA256 a197217105397e7b333202d46d4b6262818bcaa92a156da11fedd6a8b54e4ae5
SHA512 52f37fc8015c9248f507d8641243f8c5c1f09b138d55990449a2b3a7811bd1a4180546cc77d884b6efe6c947778b9016ffe6cd7d7bd6e79bdf4d51179b028610

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\icon_Detect_support.png

MD5 42d4aca3d52b74e54f43d0637333f1cb
SHA1 55eb9664bdb7a352c42eddfff2d27847e818d9f4
SHA256 85583106fbbc62d1cd12561b748b232ca78295ae801335bca8f1a257143a42e8
SHA512 aff8e02e52421087e1fa298a561eccf98e45d3a2e2d32d998aa76fcc2f4ceb3d853c0559863e48182368429fa292bbc8cfed4e0dc2de7502518a3d71f9c8e339

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\icon_Detect_notsupport.png

MD5 eaedc9c8b97ff9fbee0726329a3665ae
SHA1 b2794ea12dec521782ffdd60da483164461d2739
SHA256 7399777973381a32e574996f0735b1d5f4db6f4a6fb6cc459569571471c30489
SHA512 48a393d379250ebf64214743e7a06de222435be2645c3b6ab042380d33f6dccc0749df3f594af874e74f6e151ff9695e034dbdfe18f1bff8e98ef4cd3fc25aab

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\icon_Computer_backup.png

MD5 215952739cff8757aadb2515c7494754
SHA1 e3f961059558ae33b9ad2a69e2873d58ebe6b27c
SHA256 365e8a8826d98ecbab3f33f478429286bc0a44f9065db39da89511f7eb17f63b
SHA512 1f7f0e2fbcf864725c6bda97925a7d220240c1e294563f32ea1a4a4a1389af4239793662e0757389d61ad74e06a80e05ccdf9757fc132210011e845bd97685fa

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\icon_close_normal.png

MD5 414e3db06586c56350e8544b70050d3c
SHA1 ab034fb7e73e723cc6ee47c0d242a33cce9771a1
SHA256 281491e9eb3381e957314313d6ef6af2c8413b8f154fcd2f914997e1b1b748dc
SHA512 78914c8d846601edd867f87dcf09c610dc0b7ac9dd01a0a9434a50ee3cad97d2e4491c9cd5a3a6f83754f5d64ae08850492397b0dd9179b5bade79d4b7c65c6b

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\icon_close_hover.png

MD5 26b207cf683a904fd42e36fa4c79b35d
SHA1 07af0851133c2b24e7a14b941ed027a00c9424c2
SHA256 c287a9692b81e04855cb8ff28ab799e4bf9b4dc4c8e61ccc9c1eb42d15f843f0
SHA512 48c8c0bbafe166c4ac3210e9114864c943413e8dc09b95e7e37b227a8f6d75728307f77522dbe56a584d8226b4c5fd0852ada9d3eb4676a7974f2d7640106347

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\icon_close_click.png

MD5 4c163e68889559b54a7bc948d0672e14
SHA1 ece24b47de13582cc08baab0bccd9d8970dd6d77
SHA256 4fde5441836efdf8009bcd16983fb486754dd26074bf3e8d5c70b692fbaad796
SHA512 dfda4d5c68d41d90f513eefe93c1e325a003d441aa0465e6d17cfbbfcad8090fc92cc753f2b0600b4e614133c6108ffbee04dc77161dc69a857e58c78463a482

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\icon_Checking.gif

MD5 211cfc9eb6fed40210b41886fe9e764d
SHA1 c4fa96d05f539b29e1f99cb38a40d0e6a91bcc48
SHA256 6ca427876a83b90d3df79cf59d496151b4b12f3ae3a4c5b72acd00de326e7522
SHA512 067fa58c453131e2b045e6c2f30259c4e7145edd612fefb426cf536ddf5a6d52129e1ca66578111e0a9d08900eb033052025e76b2507334b3e688fed36abfd0e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\.idea\workspace.xml

MD5 6b8f3d678c80c5e25bcb83c5e70b8be4
SHA1 54376c91cb780ddeddb580f354fd9755e1b6d03e
SHA256 2577feed73fbe0de605bc0bcc45753215406b9fc80727f99ed730f789bd585ac
SHA512 4bffd216ca939938885c7d3a01c9abcacea29f6664dd932a5ad1458d81e2eb9c6146e337efe25844461bf67fa871ccb2e768b71e6e0aaf1319f8a806bb3559ca

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\.idea\pa-demo.iml

MD5 ad10251dc3a89eaf063bff89dafaa0fd
SHA1 32fca3a41af0e658297ab10969630d1f8f1548b4
SHA256 c175f68ed3b5420621f4e81c25a5d205c21978b65b6c4f351a4000a43e6242ad
SHA512 64bdeae2e31e05da57d595658f71ad6e3451204902bc75bd5828f02f402b19df95349f852b87b5ab40c153eef6258cbf93451b01762720c2c6c38da0a1bff788

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\.idea\modules.xml

MD5 d4ac1de15c6c8fd40974e74eb405c247
SHA1 a7123860f9bd515754bdd0b3aef04517bed8e4ab
SHA256 f9ee0710ae25f8e04e9d8e4ba3d7516734fd7435b561a3073a740dae5a8a87a6
SHA512 8e8b55386b699e8e9771b39f6ac7f55eb2877a4d0804685eaffed5af952fdcaff3f05192e80ea85afedc7e644cbdf6cda7c0760acfbf5e8c381acf19f30ca95c

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\.idea\misc.xml

MD5 fe04a1fa1b2574a989fe20786811310f
SHA1 0d81a7654b3ab7b1fa88a882ac9120820be781d1
SHA256 ac5797fccf540eafb6bde16920c5497f81615b6adfa4a1af3f1d4ca8c7b72069
SHA512 7d4decaee4e007840fb386776897f966134952aca19ead56d41b9e42eaa9c8e91a968aa11b8ec29c68b5b368b49f141b84b70415a566a84b77d9a43e605859c4

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\.idea\deployment.xml

MD5 304406b5e5e3521985b541325d42a421
SHA1 c321a84d427c79c7c55395c00ab97452095878e9
SHA256 be83b6388d435ed72cfdbbfde6f47a7c919d471254a82c4f0df093b8d3cb42cb
SHA512 fdc1bd42ea722f09d762b43ff40b6aaa436b6ec5335ae5293e7a7b827d8794a1737a316fa6079ff2bc7fb589dea01fb22a79b56178d9a7cfc7061b2a2b61a6e6

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\xing.png

MD5 f762a604c7a9fd94429df0b4f9b81918
SHA1 264bd1d42e9b8feb62e61ab193e2fb6e09d4b5da
SHA256 e123164760425cba506343cf4e8d9a6b58b55fbafe5e647a0f5f9c760565a3c4
SHA512 d2f4979039a97883b4eafc9315f1640790606086990a7cb47231c108f7ed66f7e271466541b124c829dae4b6b9e5390d9494d51b65b4ffbe4cd3f462dce73c98

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\Wipe_Hard_small_normal.png

MD5 f1115561da8676b961aa329f77553694
SHA1 87a0b7b52c93fcaf04b1f814bdd079c4e466da0e
SHA256 14cb9af071f13e8bb033b5bdaaece694f262137c6330a5dcdca2b22ccf45bfcd
SHA512 5998958943be4b32e1cdde50be3c82560347ca5be2b8999d23bf888dbb7b34de9c4e003edee56f391c26499d74ab9549717368031e63bfaa3aa4ddc749b43665

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\wipe-disk.png

MD5 4bb4617666416e0d5067fad9445fdf13
SHA1 eca82c0200b6aa48f5f3ae2c8976b2bf241fcabd
SHA256 979cd79687b96c3dca25f98abaa8d137496a3f03dc950f010f2ca0ed34396a34
SHA512 7530ab788885e4c55b58428ed2bf86b70eb755f42df64c3b816d8a1582204dc6da539a63d697616cc22cb9f70a44b091338ed5b8bd8e961db2dd36ed8865e9ff

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\wintogo-s.png

MD5 29e375805202aa86495cbdb41f74a76a
SHA1 39a20c4fc851b1fa62f3aff101b9a229447cc0df
SHA256 a693bcd124640c509cf6618d71314cc396866a862105b2119d83c3733edba9a5
SHA512 5b5f7df7f5fc34bc007033879a293682900ec23648d01a668d2c7cec2c3b511a9395e793aaed108a10e8361e62653721c127de00c77a7899bc74a0f73cd94aee

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\up.jpg

MD5 d4425a2fb2ac97a8b9ef91ce9c0d8c6e
SHA1 1714ebca142ea2433599e67102c6af347a247a5c
SHA256 b2d2045a5677cebb4d950d6b7b6eb501fc88a28319f3e8e80175a0dd3cd24e5e
SHA512 e233743f371ab39e2d8322d6b9d7b56e4331b4c4817c492ddb02fe3514d68340606f99de4825b612650aefa9c120f4252e125c193f0cf67e7f536321d929ac31

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\tb-bg.png

MD5 0b316eccbc57a402e0fe6df6572d6c5e
SHA1 1a8d8aa56a2a6f29aa1eb8c1508554ac362f4c80
SHA256 2ff7c00da6bfa99e6faa1cc7cc443dfcb4d2595db5cd2fb24915e3ab7ad02a26
SHA512 f019af25b309681bc3fb06223e3d93e65a0ddea7205c96eb281d265a3ba6f36caa1c0722ad7dde62f6facbb2497070977c2804a13eee790f9bb80676b3ace55c

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\split_small.png

MD5 73c2ed664c07c9d6418846d02476b996
SHA1 646ada34e3aa6449b7af21cb6f930cb8e88d1193
SHA256 854ce4ae326af574174fda796cab9b5868d339ab02fe641a460cb312d717d1a1
SHA512 20dc1329b2de18a1ca89a0f603c6124f521aaff3b63a6a35271597878f0114b89f60550fc430b32bea3d080d1f400da813a8c28999d0a31c92dcae19eefae748

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\split-partition.png

MD5 befd24df6053233493e994c3a5fb1e5d
SHA1 8d92b3f00875d72d2df61348efa52da7aa86c08d
SHA256 38228620d12fee28ee587d374c156930a74a8ce5c65126298a8b6d09c592a2eb
SHA512 06f225fdb9de1e33db3c7175d6a551e469673cae128adc27987cc0c40eff686236a6326e0262a8b99fca227f4a37e625b7e3d7ac31ce12706c1c48370989fa82

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\resize-move.png

MD5 7001d6655b39ce0f452fd919de1c2496
SHA1 30c87ff60191a5c9452a5c1a178dfdacefbbd33b
SHA256 11e8f943c76f790a8e6e59670370ba6e71d5d48467a188c5b4d6c894c0d16739
SHA512 8ab9c05d1158a76143af62f7e40727ef32c5b1e253ffdf160471b215dc15e7f17d395eadb1ea348e6ca32318f72dedd50f92fb7e6c4b3e650a62f690c44d0793

C:\Program Files (x86)\AOMEI Partition Assistant\html\img\rebuild(1).png

MD5 32b0c72bb98bcb8d7b5137e7020e25c4
SHA1 211bbacac3f0a6dc8bde4907171a982baea9878a
SHA256 5a5d95c0cb7f1ba2438c8134a6c9cfd9557181d1b011992e2882fdb6e80d4d63
SHA512 6a237aafda310534cea971af83927dfbd53744427c32cfd3ff88182e397332408bee0913efb4ce5378ecf6dd2f19fbf232bf1da9a85b75d96e2b8188a7a3d9bf

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\quick-partition.png

MD5 ebd281a1d4ed038935df60b0f78066c7
SHA1 dfbbc46718873b0b8002468a5f4d235ef9c6d17f
SHA256 2568bb4d041a5b09eec971611a20ec304f703e5b438f1a72ae03b47b168e2e96
SHA512 dc1894df5c45e793dcb98158d6f6950b3fdb842986dc18f96c9f18f1ee4232dbdc0ee1d46cc094b8a59e0e709d1a8621f5097c0194fa59d593c8466935ac6277

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\pic.png

MD5 45023a3960e4247bab44867a8961eb79
SHA1 e5e00f15263fbe5ba5025cedd45d36dcb2ea57bf
SHA256 119222cc530346e1764c84d8c4f7f80fbd6db869c1368cecfe61219d63c3b802
SHA512 b5d25d7e83bfa74d9ed8b1568e5dd88623dfc77ef8a74039d54bb3c519c17e99662e7d0cc3fe5572a79b2c75543cd0e4c3b85bd50d3d02d45acf89834db25c07

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\partition-alignment.png

MD5 a0c9ac3ad002b874f977840fd833fc86
SHA1 18e6de2f74fae9db4787e90b1969c68b8e49229b
SHA256 10c01408a2a5ee01f56b55874c2569e22af0e846442faaf5255569031f43143d
SHA512 e85b1214abaa45714a26aa804087560d665eee95820d6051befc673da3f812d1cbc6798547d8fec92d028ed2995a221099c1f57c9bcd0132b5850bf2181d741e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\migrate-os.png

MD5 8d8c78865015a6ac05c0d6fa1d248594
SHA1 bdc184b500b1a701b129d3ae2a12fc26cb526c15
SHA256 cd4330c130b0e66bc0d5f765c56b991dee5e4f5a6dbd3770e35ab69e4f4495ab
SHA512 55138aa813b43f7eef336ca07e508945516ef8dad86764438951e573a691abb9bbdb8857d571f785c7b98f4c80857ef1b9fc913bda43d2ce8eee065b7b2a566b

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\merge-partitions.png

MD5 7074a04c295ad36fdf76d22d3914a717
SHA1 88605d21cd671dd362f3bec10577c2795d0ddf69
SHA256 afc91ef05c6a2f8cedb62ad0faa6903bede3fc9866772571ce5b939411b852c6
SHA512 39030bdbceb9b6ee30e9df28072ca978642cb9d0f0b24a71b82790b3f4aca34631040e547c5f4fd41532b5b7a7eab9b8f71e0f6b592aa95bcc4420dc5d928e61

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\logo_pa.png

MD5 dbdbb08f8dc6f62c2471a6482a8b4918
SHA1 493a25e03956272f3838cb1ffad245f3c92a9afd
SHA256 e3805c25271f9da8bdd101d7058f4178b0f7f7812b025a562b7abe0fdaf5ae3e
SHA512 9b84e56ed3c7ac873ae3f4fa144c59f3e900e82cc2f8b69a47f4c5e1becb587a5574945116a303c82899aa917119ff7233ec61f779b77de3de50d95913507f04

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\licon.png

MD5 121965de2ebb54818913bde47b207f5e
SHA1 e38da7f89839c70cf53214dacdfff289b9240d05
SHA256 05ac12bf828e887ffb25583cde0aee5bc1073becf67821ec8e0c2c805c26357d
SHA512 b8a08b55a460fac566012b1d0e35ff007c358ecc369e046638f30cced615eff7288426670f92e2b890f67c5c16356cec953705e2a6ecaa72613ce484daeca9e5

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\img_upgrades.png

MD5 3a5576f6a2e13f6aa3bf67f3ae7613a1
SHA1 f4edf66515ed27bdf2e7005649b6f56d49fc7912
SHA256 1885061756779c338b6dd8b6f80e3a49c8045a0d412ddd1e465dbcf03cf1e05d
SHA512 a4118f066f9f9b6a2f000b2b0401762bcd1a2277358ac7b125e3828ff75072d90aee02dd341ef2e73479f39e3b6e10e4b027faa3f6bad6db58f03503c33c9ebd

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_x.png

MD5 0b09837e70ab6ec9f11a44dfd0560e75
SHA1 ac84a7fbc702c99f215570e7ba27b66eb0adb0fd
SHA256 38a749900cbb3d878baa0117b8034bb617e0cecb1023aa3aa7cf597ce71de75c
SHA512 e4c1bd14f15f16c78e902589c479d951543c918aabb7a02791035f882c39161d10a0a5012de2c008ef318d00cdfe4f7f372c54631ddd3225e2cddb16157a389c

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_upgrade.png

MD5 52cf2b5a7b035cce0ca28b8f3a39a1b6
SHA1 5ca0c806d5dcc00e7d7fe17c9ab5551c94d4d6b1
SHA256 498d71dae836fb2d90b5476dc24226920b356ea5e379ef703abb45f800f08bfe
SHA512 4ef751824ebe816d482877ca1e2269609b16c069607817b1fbf60eeca138cc78f907b4399fc33d06c4ba49975930c61057e32a3f97fe3f94c19ed7e7c53fddbb

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\img\icon_up.png

MD5 b399dc8b8158d03322631f36bd43a5bb
SHA1 85a933da413fb3935254fe362847bef07ae7093a
SHA256 bf8822d3651856f4e23b64f516c500c017d9757453f7b992670d97fcb665d166
SHA512 bd777e554a8da130b299d035e0a651f540fbc45dd8c86982a0905d3bcd4b31e402aa8f012d385e9ca82ac41b27f039103dca2b278028d9044364a57a0548d52a

memory/2008-1509-0x0000000003F10000-0x0000000004310000-memory.dmp

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\curver\sanjiao.png

MD5 7bc3978fc95307ec1a6a56fcddb7a5a4
SHA1 6118ef57d068267afa86fdd52052c47680eb1dd0
SHA256 cea33f478cb8594ebd4f69fc04d5a01c75c58e82bb18647d3d05923a590bda6f
SHA512 ab192f8ca99c393e12d1781d655cef4bec0fa60c1504d3dc8b9e0a66bdf5621abd2b18014e2b46716ecfa7eda3effce678ed5747555fdab81759002507e7a0ff

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\curver\upgrade-current-pa.html

MD5 bea19c04a5d5e6afb8fe01e23752ad27
SHA1 9c42a0614ff0e0db7846a77eee6267c520cac772
SHA256 2291336d16f2c92d854e3a5ad1606164fd108c77f0f0d8cd5d1994390af83ae0
SHA512 8ccfd792b4a070dc565771a212814e1ef7a3869337470b43fa9b37be660474c57011da15ae39b87b13437c2e8d10f501ace89db90e2348cb571a0b8ddc7efe2e

memory/920-1602-0x0000000000B40000-0x0000000000B49000-memory.dmp

memory/2008-1510-0x00007FFD946F0000-0x00007FFD948E5000-memory.dmp

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_list_function_white.png

MD5 cdf117b46f55d2a996c2bb88c0905a92
SHA1 6fb6c6a691d8dcdd50cea79b0ebbd4dc69988c68
SHA256 cea9ced0fd083f6060e1032c8b93bca2095f7c078348dbd50cfba4c7aada9b26
SHA512 9e6f58ba4d0fd8a764040a3f7c7d3fdd1444138038aacc7b7c9ed5305a7aaa62a60451ef9ab28e8362ffda6a15dc7f40cf6823259c7c1770ae872d9ee1f98025

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\jquery-1.11.3.js

MD5 7f38dcbfb11aff050652ff3b754adb63
SHA1 96c73f3774471cc8378c77a64ecf09b7f625d8b7
SHA256 2065aecca0fb9b0567358d352ed5f1ab72fce139bf449b4d09805f5d9c3725ed
SHA512 1e4008489e79bbfda3186e3605eb79e1998f33eefe5ca098f3826c0e828660af7c11e54683929afcd72f9c4e25602cdb5f7f9a18de3aae94a106d0cb835c28f7

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\std\tw.js

MD5 a79ce487f95004d0c63d5a8fbb43c4c3
SHA1 cd2141ffea5c76ce103b5e9bc1dd667443e3a882
SHA256 ef84b89bc99d58d571d84de3412401fdef78350ddd3dab9cddb4489355b58f55
SHA512 586bf8c33b33b791caaf2e798012e1ffeeb23624ff24ca84884da2d3e6d12f7ed0d988b5a52c6741377cbaabc754a7ac647079a939e22f6168278b2c6433b555

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\std\jp.js

MD5 c567a933a12a140448ecc533c2d8f1d6
SHA1 8e1041cf1f17b568857e1a1c0db31fe9059f76e7
SHA256 6c0844c963861bbcb06720897a1bd612993c781055d38e1212fbe005191608d3
SHA512 71a28ad277e206a15238ab561860831977210f02b929b285459def4d4e32a34bff85582744156e2d65bcfdc4c86fe609f32c38341cca4ad205cb20421d9b12f3

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\std\it.js

MD5 ea42e3746326db8f92f1cd237a4b501d
SHA1 a2533f4b04b00199faf2965760bd79ac100e744b
SHA256 fea4ab8f488c6a42720b6964c17000e1aa12343467e5884da26e8870029263af
SHA512 b28499e76e51c64dc390d566fd77e60de7030f27bb8bd25651a714975a78fc3bbefc7e55ad82bb91912fed73d3090d4455cab80b89ddd6968106c732cf40861d

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\std\fr.js

MD5 8c15fb1578ccbd4637aa5e2ea7fa1686
SHA1 fc88b96e2bff5d0dc76a2ce9f491c5cfe036591c
SHA256 32284a135a11b7c4a860661b9e1301558b270ee9c2a7c954dc05e691b351a1ae
SHA512 3e62f51a5cbe830bdf67f4c735b6d323dac7c61ccb7e105dd0c16e79e4dc738fa2dab98b8ef8d376e3dea11b52813d279402d12ee188455210109a0b66fbd8dd

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\std\es.js

MD5 2f790b052d81ce8ae03ad40a0417d3c0
SHA1 d5c767a75bdca6624d78e73cee957424092e38d4
SHA256 3d27cb6a8e8f91152b546419a71e94e0154530bc4a0d591cd75f766debb89290
SHA512 e1c12a271b32f835a59132e58a53437130f1ff7dda7d8dc3aca95919a7dc757317ce7e0e6cb9bde5850edb51cc50a9baf746078d09aea19c72b8c7f0fbb71e0f

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\std\en.js

MD5 409f6d18b8c6cb1d7e5f1f05098ce583
SHA1 b32797a6b267ab00cc2db9a53c01cc89b7800915
SHA256 9ad61d40b5a246718fb581b0ed9d5ecd890f1d6d34b3b083f2675e960301dcf3
SHA512 56e75b5f520836e84492a700990e8a0a1e68d3055ecaa93e6c38747ea3680c7d20710dd01d177369fdd35462085e21d81ea2886ad13a44a749f43544bcc8c414

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\std\de.js

MD5 530b2aabf4482bf5bc5dd82c7f650766
SHA1 c56adeae6169c2796636cced67dd6ebe06c33719
SHA256 452437c2d16412644ce4add9ac0cb01063bb0f12e145e93b0407a4ebb5e1a1d6
SHA512 c1f2f808552bf2b22d2c697aa6a677d76dfa93186a3880981e322a1bbda967bf7529e01cdc0d9b23322b6c08b9ffc2c0f812ee76909c88390069907eb955337b

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\demo\tw.js

MD5 d52cbb40aeadbb9985aabda99d9d4d04
SHA1 e092549aafc9d6961b1541bc9e2b90c0502cf321
SHA256 6657dfec9b35cdc7465ba37675e0e3d661c4a08d803a29a24bbe1a7fc649b812
SHA512 6837a3764430f014a99e742ed4102e4182ed9b5642d89bb1afbbccbe73d4f1c3b0f13d6f17b0af2aa72e335c205e9da071a78320cd689c0007c0780ff870daf9

memory/920-1782-0x0000000076510000-0x0000000076725000-memory.dmp

memory/920-1780-0x00007FFD946F0000-0x00007FFD948E5000-memory.dmp

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\demo\jp.js

MD5 bbdc332e65aeb546f3574ad76ffcbc5f
SHA1 aa8b774b3dc080e4127a557bf7f9253771f3af42
SHA256 392f765db8ea9364561427688b2c51f2eaff98ec0d26b5060e1130a746f601d4
SHA512 a3ea537886835a43138e761e35059d55a4933d26b138a1c93578b5b745376e2571123581d6395eb4d086aa5782c32da27542f0b0ba6bd1b463d81f12d7ac80a5

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\demo\it.js

MD5 a129b17e89f354e8807c55533174e520
SHA1 24b6cba96a4f1adf7cb42e86ef16874020c22388
SHA256 4f6c3517a069189af84e7eca853acdf35c0a883576f6eac4307274be5aee2827
SHA512 7d14d1eecac2a987e4049594b0a812477b556ac66b9326a459b73836885556f34295e12324eb92cdf88e5f2112c7c66265976ffc30431cd8878d70b2a8e377e8

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\demo\fr.js

MD5 bcf1b792e2dd09750908ee850787198a
SHA1 433c48b42958f52f99399d440152fcfb15e7b2a7
SHA256 cdd4f08be67ab298f6e837c114e8f8f67e03396fb8a40ce4347e127fcd28eff6
SHA512 b0bc08a9b659ec1c348254318c7d1dca5363cd90e04d4aa2ac2b4cec2cef24e154ee82d55b3cc4205630ff459998cadf9949564a6b0e635932edeb04d65a2daa

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\demo\es.js

MD5 79a2b97b8388abd7b7d2cf70baaa2367
SHA1 6d5eb455b1ef818f90ca70f9b9149c037b628d3d
SHA256 49e436119da4590a919656723c7dc3fd9bc11839e9678646fa357bb8f56fbc69
SHA512 b68a16758153695ce151926fad4f17701222ec7271babbd02dc6c744fb2d2a69eb42703ac899058cd77567441694adef0aa6fea378b3ca4c1930c0e96f4eb82a

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\demo\en.js

MD5 6a310342a6c1d88bf38c986beb48da9e
SHA1 1f066782efd95252cd38bb4b02b77a567f467b31
SHA256 e6a458c381eeff6f9707c461aba0873b570d46bce6f03f5ca9c9fbab43931859
SHA512 232dfe842e727b0929e9d7846b653760f0902f0bd9ad76c6645b4e524fc142f6486529139ac9a748329223917880255cf0e5337c60c3bcc89d0643e4782db3d9

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\demo\de.js

MD5 248c85b6a20e50cc1be88dec6cea729d
SHA1 9227e036d329d63e1f8419ec3675c7f34599ae75
SHA256 455be7149a88acaac59cf0c669ee99205ef16dfb2b4e098c20852665f3acb8f7
SHA512 3065d53695a4b45ccd0826fa0f4da310ba8bef0d84dc27353b675e34d7a37230d742445ffed4014cf77f757dac88e4f19c6091d987db1509522104fc5aac1a6c

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\std.js

MD5 f3f4657aed5a6dbb8466ea10b67b6ffb
SHA1 d041e5790e4fa8fbf99c524c1906ab232915f80c
SHA256 3294fb2230fd96e629b9605c39bc7814625902c3efd7dff91240d2b2b99694bb
SHA512 a5cd62eec9dea1b78d54487841c5af4183ce74d677dd0f2f5ebf676f7813294c415caa8fbf475298fc5dafb1eaa71e239574dfeab2593afff6a1fc4e0ff5e054

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\jquery.tmpl.min.js

MD5 2b26540d6761fa6eb1e66d97ec176364
SHA1 5c6750574795fa5b9e2a7db63a3373d9522448ee
SHA256 dfee1fe127c3a828a6f88e3ef6e8d1d7f8a3750e6f9d9e24520992a2294696a6
SHA512 2dad16d0dd393efaa37af594d0dbb0cabf59925089de87cb1fe7a7ab6ee5474dd36fc43e63b395d172c646426c981f65eeb926e32bb3ada90ec789a503efae3a

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\jquery-2.1.4.min.js

MD5 7c7e9205e1f99a8ca5c02f6d55a4e307
SHA1 eaba4de229128f2a21fa1af524f69e296efe7683
SHA256 4c5602462a4369642dd58ec65375f91bf9da6d05f566b9367cec58c385e2c2b9
SHA512 150bece5766258b21d324da04302a29a88417e0b4bb95974154da09ee9d6ed3eeac169fb4c87e5a3775f8b2e8b12afff944ee4cd15e1cda4b13f746ea21eaea5

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\demo.js

MD5 caba2ea3f235cd4c9628b3fa7fccfc3d
SHA1 7b7c7e2d6638e28da08293d1903f78a2dd506cbd
SHA256 1d99f1955e6485036707426a1221fd28d9292dfa08d09f3f22ccf56494dfa2d7
SHA512 b5b6014ab802996e4b952f34f47a960486c3223491c3fd365d0e6046df97a79ba1703fdd918e5cf9bb8a9e12d85b931301cc883d9c11d9876a53752117216094

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\scripts\countdown.hasms.js

MD5 b2d8b96ac6f8dcabfbe34cb214be0b9f
SHA1 66429121060daef926c1db8cf61702c2c7d89ba8
SHA256 29abd3aa4030dfbe027c22c5c9e796c1bb5b7507da2a774c9bb1890d6ed91d19
SHA512 4b43f901904e02a4578f458f9a8b7ca0ec57fe78d6376929aebb79b66c9708ae051dddd3b2d511494b4bade1b1435ee61426601b2a513b46ed8ea035edcd43fa

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_version_hook.png

MD5 da531bab1f4cf9b760770bbdaeda4a7f
SHA1 246f4af4cc36abdc9e723bd1ff54cb13160a0e0e
SHA256 f6146f1b8ffb002f7ab1157131fc93ef147fbad8a5ecb49a5bd13377eab0efdf
SHA512 4538d7b199e4d5eff1943733b56ada71dd81f1b8727b4ddd2a8d3aa90445746edda3a5c04c528032e59e1013e123a84c6ea79ad8369ad5b90d95c2727634eec8

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_powerful.png

MD5 6e596ed6fe8dea8dc196457f6fe82715
SHA1 840638af6a5310f1b1ed65d03f40098ade3a4aee
SHA256 4ae37dac9de19fe735bcdc4d972439ac5982f1c2c4cfcb2b3f3cafa621e00b25
SHA512 df97b97cb79f047e04d8a6905c037300feac00df7992199a6491af52e5bff3f59991a5d37dca39b3234b4e4035f66e8cfea6b4e21b9d133f5ec2827afaefff87

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_permanently.png

MD5 d4366a0ba152f0d8ce93640fbb793aee
SHA1 62bfe8a6b2b2493bbc97a6235362c7a17358c4d5
SHA256 1574822f159c3ecf64229d8a37f74f229ddeb1cfe2a6e99c1583625343f0590d
SHA512 46797e490b3a12397c8f3f286350179d803146d0e20451148be65a1c21c3cb398e67d5f2893766f219cc6e179503544b68dd89105ef35441ec9466b20b12a337

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_option_unchecked_hover.png

MD5 8dbf5a001bff4495d8db4b5fc979b1e2
SHA1 4327083fa126b73fcf94424363840d6d0636d6a3
SHA256 31c01c3b3727bbe94f0b47d4fc18cb1652959421772b7c6202852e65fe6d3069
SHA512 27dce23c2f7e181273ccb478acdad9d206984ee28315a507cf8393b043d34fc589511f1649c9c852267281435639b845c9c8a616a54ff173fbc4df82a5b9334b

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_options_tick_press.png

MD5 e98f584a18f6a7826ef483d3be52700e
SHA1 9421df013e7b0475518cfaf67643d01a2f531447
SHA256 0d4d250ae5d186ed39d86a6ffa20faf4a6be84d5194041c2e8ae15bead17c305
SHA512 4d515b652b8cf252f26acec63d366d1c8dbfd86683905b97bcab7a2a9ab1be204578c124428740d79f9c0ffc71c50d41dc50e6dfdaab5aee579d38922172dd85

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_options_tick_normal.png

MD5 020fa1b97aa1756393bd8989a7930a08
SHA1 08881ceaed19cb148332b444d39fc011f2d91d91
SHA256 98fd5ab8e8e48dbb925e279ac5d4f7034502441dbb8ab90a38d2e0ffc2669b56
SHA512 c1fc493a2bb5a52e66250baa7fe1576a05e5cdf48022ff3de080bf1363b37b03437329ceb19f841f82d11f496e8180f201a0a696805365a623bbbd5205c4a6d1

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_options_tick_hover.png

MD5 3b93ff70a2f551991332b6d3c21c5c1f
SHA1 4c2c72defa61e055a776ef5e985bafc47044b242
SHA256 e76ff079cde849a880a886cc8ba223e834a9fea056febeab48a41df0a0968ddd
SHA512 8633c5f9f1f31bf60cdb49e9f4314ad62c1cf7421c7f884bb78f14f79f4b3d0b933c2b1003256d95819c30cf18b629a3942d0b38a18cb598a6d2e4c96f477fe6

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_nodata.png

MD5 68bbc3af79ebc433d5d4d6d706eceddb
SHA1 28e19e4b88c0a6ee682be3757b6c18e5f80849fe
SHA256 4a85588907cf84425deeba7e730bf417d6fec3cf725ddc71511c8e99451f00e1
SHA512 e800b69b17390af6bcf4f5930fdad561f08e90014d58ffb203dc6f9b2a13b5035f611150fb675804b79af59550db653171094a6c37c04542134ca673a62510af

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_nav_close_press.png

MD5 e70ee81b8916cc47d8087e042924438b
SHA1 5330b9c86b3728d9ce9fdf7cd4c63e69c499b902
SHA256 af3c1b09090a284d1d44cb18e831fe12581972f7804378e0a9f027553b7bfd25
SHA512 790c1e7ca6d8b699109f647fd6ca4c3419b887605dff6df5e6c4631271a5e599281c60e7e1ccf35ce6cdbbdfbb23d08e0daaaca206cdab830db15f50ff8feae9

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_nav_close_normal.png

MD5 cec0bf064fd209a1dc67ff75618a06c6
SHA1 74fdc4557a481e041b9a8f18efdd67eb66df89b5
SHA256 b84721244a7958d105d056d232f417a611a877790506a32b71db53f563ea3a12
SHA512 3f170edae5ae9237edaf3bfc0cb0d367cdd6138b21dd7e5f5a91377cf7b77d867dfe88fa9fb57649234514d730b3c031f3e5f00c3718ff05415c3d0044827075

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_nav_close_hover.png

MD5 d17f99c7c0f249724dfcf067152ed7d0
SHA1 5c8ac5f798fb1bb5dcd4879a8050fb684e461dac
SHA256 6641e5d8b4343df26db950d2432d5cdce18907fe759430ab965c4dccf85778c0
SHA512 39d5ddb46782400ad917f823173aee1a56b305ae2bda78fc89804d5a44ec5ddf32f13667af55e0436122a2c3cbcaabace45d8392ee096c8ffa2e62905d512472

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_loading_web.gif

MD5 8fb293fcae69f539b0e76d8e465dc88f
SHA1 cae10910a25cd9409e7d118fed3987a21d4ee7e2
SHA256 6b64f56e6d3ff8aa5111052fac9eb57ae6d7c5b22c3865592897ff932df8a727
SHA512 c95e162ce0331ba7a20f985d6b1f0adf16212b43e182a21fb92cb89eb36ffcad64254ea77c25eb6a5b6d564cfa6d2f5cc5f7b0a74abaf43410afc6a770f29ac4

memory/920-1698-0x00000000028E0000-0x0000000002CE0000-memory.dmp

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\loading.html

MD5 d47c7fcc2a769a664637660655a56763
SHA1 757fd2d120dcee5d1dda6dda88afb14c023958ba
SHA256 ebd7e35d4f9bd47f7140f34fcbc51e37266176c062c868f0b225ae0d2e88be1a
SHA512 3fa75839096dcfa4193d0b27938adc08fb51db08a92aff0ba289e4086e4a8decbfe5dd4eb1cd8c96cd9db8d7207518148933a76f7bce6ab9fc2346554e4a6cdb

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\demo.html

MD5 11e82a41d66084704bab46934b72cf0e
SHA1 bb73d55a9bef7888d97af309033a1385a692f388
SHA256 98ae663ea170104eb85b3f90e04746994f3ba6b418f522a1f3de125688fdb0ac
SHA512 afcf3d9558d02d936102ee9557045e6d6dd3ae12b6b040554e8c9f5e4fa5d8b20bfecb83f56b8730e3467a328e3d99ded923e5a4e6e0e503e615288659bab852

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_list_function_support_wt.png

MD5 982e9eabfc1fe566121e4fb014940f14
SHA1 317a0f6aebeb0f763c194987911714a17784a69c
SHA256 879c7efdae14eed69a6e673d6222b1d61670438d3e25c8b175079817f937e16a
SHA512 b2e027ceaf7bdb7b314cdda48c4398e227561c6fa1e3300e5e5d35269473747dce3d1c2bf4c1259664dffc8fafc6c769fd120f374241d75d0ded94e5fff8264e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_list_function_support.png

MD5 3fe4c5aec1e767f9f673d94d08596400
SHA1 9f07780c40856c3ca6145677e446c8c0f259b79d
SHA256 b7b27eeba18ad28a4c4afc7bfd1137357e827fe90506e03312a0fc4c13ce4b93
SHA512 c7bd3efe1c99fd13a4827c9975b3e808ae2531d0a1711ca374712a3ea9af66b25c99ecac9ab4a658ed2614885b2ecefd17389b433dcafee706775e124bed55e6

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_list_functionicon_list_function_wt.png

MD5 134432271feb9ef49ce48fb63af006a4
SHA1 84190b70204a2d6ca444aa98a9ee92e371842138
SHA256 b1500b8995842b5754a5ff384a35b6563111aba7360bb06ad23b38d1e76a5823
SHA512 3d919686c70bdd59d203aacfb1ff79e6e7be15ee929f9e7435afaf1b2e109dcd7867c52a7d7c8a3220eb8acdd07fffaa7eeffb175c8c8990f2c599065da33df8

C:\Program Files (x86)\AOMEI Partition Assistant\html\new\images\icon_list_functionicon_list_function.png

MD5 6cc30a78a0e508dce64e3b5d81b7742c
SHA1 04e26b606382a60c88fa630a821ba1dbd0546363
SHA256 ebde62ab2c44abe45b228b71ceea039ff1fc138f9a299a50e52c81619b73306c
SHA512 ac53bf82b2abfa9c6f4d7211023d55a414bd4b10e47dccd1c8a2e3b7f906f39ddfe5c2bcc8fb2d6ca3dff138daad5cab854ed4ccf9c19b67ff31239459b65789

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_list_arrow_white_up.png

MD5 58f4828b0680cc746d204a15670c1437
SHA1 4fb17995d00d06f742a8a47a36718ac7d4058faa
SHA256 53ea19ee82a227a4f41edb462996305443bb28d3bc94a8f5d97410fabe562613
SHA512 afd6d680dbbee4ef5f65b63215b377426a8b9e07a3d0a64f64f023bd27871f0407245c55e188e7b94d033720ba184446ea5ff200584cb544aba0471f5b3fdc62

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_list_arrow_white_down.png

MD5 b9e74217991526b2db418f286d3ea6d3
SHA1 3fa560be98959beb79a409f9645bd5183e8814d8
SHA256 e1053272f6b390a1c70fcd579375199c23fe45ca9e1dd286dbb67794b926f75f
SHA512 67ba0878b7b48cdcd79edf6db908d0a1c13658343b15c1028c6d35c836c6fe755e9a6cfda967353dc47061806282d097939df40100fdd441ab07a56cba264d06

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_list_arrow_black_up.png

MD5 8e2b0897715b1a276fe32430121fd921
SHA1 81ccc9415925a4d73a01c0e4cc64ad3268978da5
SHA256 681db225c37b23dac5bbf96ebb17caa9948b617cecfa5cce10907b43f182f109
SHA512 24c01e2ed3e4849eb1d4314f3b774fe589fc69d22b45a04fd4937c4566e688a3970969cbbbe93dad611793c81af54c0df8ff9f3c9f94e6875b29285ed4b43f53

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_list_arrow_black_dowsn.png

MD5 9a0aa9238418d1dbf85e64444048e9bf
SHA1 4e72e34b477b83c5441544d5bbafc9a4f43b3d2f
SHA256 1ccb3b45ea49a300671bfcfd4bab7da835bbb80d237d7a2b12f62386027a6845
SHA512 f62bd27db31fa5dfc348d9ac6e428904018298ff7d2a121258b6bf93ffc4352e16864423fc3f9276797a91f63dccc579c8ec6415c13b24bde89a1757fbe1d9f5

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_intelligent.png

MD5 fcf80cb59ab32bbe0dbd34486b702cfc
SHA1 14d0d8912d0a83d2edad3e47c2476c0fd22e9d28
SHA256 f1ecc64e5f6e38a71b82126f23e33eb4c09bed74966de1eb4ae285f97466f9f5
SHA512 61a5e1b1b8791afd3f9852c687209b06c8f8afb8a5d9f554c0b7147f3ccc0cbd92ad44155dc1dbeaa077e6ef54c0620c2a999a3fe3128d4e68d1c5d49d25f0bf

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_fully_bootable.png

MD5 a6bb8f5aa2c1997e406d8c5d2832dcea
SHA1 f845b83daf3faf22d88ae0c2c85df28f5a261d1b
SHA256 648f4ac576170812fc9c174e45090d9e0439841415c92f26de262b4e2bea8a1e
SHA512 e55269afc4b02b3652889816a686894fa546be10f25ce929b2265e8895b83e0982ca412079013069053afaaae11dc9eb986ace066f105fe2697079943f78d369

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_completely.png

MD5 cd7d93b31ea8097ccc8592940c3f8a75
SHA1 14342a6e48e23aaf5927bc7bb0232aceabff4f25
SHA256 5e344e8747c9f07d8663a5b72ced2cd6d3d26397e5730eab45474a1171643803
SHA512 6d4e5503b44b405a77f097856f5f21538b86ba2c86af1d57acda72397a23d918464635095527fb621600f92788416becdbc4e380598201687c6d2f058c5d0452

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_bt_arrow_right.png

MD5 0f8196ba547579e69a14346d5e4c2fb2
SHA1 b70266db6b67da945ad82bb7391c303565037635
SHA256 3ebe94c18db0f90c25ef0290a74fda1ef5d3a01fc383ba5eefddcd9bb85fe97b
SHA512 3f4e84cdf1615814359ae108b2f8271eaf4509a68a0175aadfc78d2d309fea33a192cc5912d8cf23f138aa02c068141808bfd9a6fb2e808fdd50648dc2e38f4e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_arrow_put_away.png

MD5 60cbdb35b2567dfac36f534177fdf47a
SHA1 1afd63d10d53b8f8bb7c656be933e2d35779bc79
SHA256 9df67dd6fbab4ac1a1701ef5a1d07356ad1fa66c7d2ad75205acafb1962e8b49
SHA512 12a34f77df66229a016164baccc00df3a1e6e7e239c36df0b4dfede4019c01531c823511e04a2da6f5cb90acd166f6fcaeb39086cec8a8380c68637c413d2a7a

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\icon_arrow_expand.png

MD5 8d571e9a31e2d50d69eb0365aede9638
SHA1 934fea16ae18debf40743ff2f54b02830f087dc6
SHA256 c296613aaac9369d21036c80f84067dc3329cc481a28c9b7d60d92e086fca387
SHA512 02b3f7a3777ac6d5c62298906154c92640fcb9996d52702d1e9aeeb33700a7b1e51deb986268ce9a342c40598a28a9d5149f501808a575dc83bc844f2358edb8

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\images\bg_top_blue.png

MD5 dde4f159b3e8af3fa0dc01f5899fd3ee
SHA1 97d14d43bd8b99d07110aa905910b6266a31fcfb
SHA256 ed8d6e7a305ca5746d4731ee1c0287c6227cb81caf19c18176f7f13d5760fe3f
SHA512 0a10bf67c7f771079c76ad3cc6deeaaae82b0fabdc8edb4408bcdf49cddc09fbdf0ed15b073ab9b12b1ad587721b490a46173652976fea29b942a43fea7b1edb

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\css\std.less

MD5 f0a8607f641429512a50b1dc7e0e9789
SHA1 46838f1548f370436080e0ef18aeab14cb5157f2
SHA256 3d30180ae1cf14ef592e4572f107a5198be3a078349ae421da3beda0506ffba3
SHA512 12f55d283c9a795df36b6850b50e6faf8fa98a125fbb42c5e93ce6fe9dbed04b876c27f54174a790b53f09234c466fa01956828c9ef8f7412b5e57199a7979b9

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\css\std.css

MD5 25ad8201c9098d7c27862fa0a4eb4fe5
SHA1 0c2ad21cce9a380ad8f2bf941910c2566961183c
SHA256 e6cc6cea1661bbf9e97180954fe9a78353eae3b122a8b7f745cc41d7fa481cf1
SHA512 a80b98535081930256d6601900679435bf70c6f3638f9ee4eba766c734e0ad93e7708a04e09224c9d6a951b2536d56e934411d931c745d9840f04c540fbbacdf

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\css\demo.less

MD5 003570bba7e0342dec614a580c40f2c3
SHA1 e0453d344fa06f799aac41b45fc8b07a138a2edf
SHA256 d1cf07d4151c38286e71219051e8a9ec3c142ac954795b3f0c934fc72dd73031
SHA512 82ed11e2ef61c5403157cb6b064d9a7f55f5f8b951d11282de36b91c51c4f552c2aa5045c914b8d66a2fc80aa68a07f2cdc0544749965e7cc05f33165e38ded9

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\css\demo.css

MD5 377071e01720170162ebebb9b7aafa6c
SHA1 c2e833f3c94bfe6060726cfc84a298715e7f09cf
SHA256 35e6b655a5730f48d18d646dca4cc06daa5035a78579b27af6dd5f5ae9ea8620
SHA512 76951a32ceeb76b865d1830c6607273b7bcd374e2430c1c37042f4950213e5db733e9b2b6148c1ea4f74ba8fc8e9c9f4c524a02bab2499829e12afe1bc798edb

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\.vscode\settings.json

MD5 ea4baeab19e6158a2fbb951a97985e46
SHA1 5548c3ce0903030a37d3ce6640d206d618f909c3
SHA256 713484fc9462a28055deaef882409d69e47a4b1525792b8c3bc61f52f037d310
SHA512 8932155a821e76c53e34f002b83006fbec78cf0b64beb9fac7cc03b0f4799713322f6af3b9628db8a79535284df09d73f8df7a2f44cab0710d0e12c9daa8e0c8

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\new\std.html

MD5 0d7ac892c866c3698f372623cf1a7e81
SHA1 d169f9a61f6e53338c2589d620a8d161f8d88b46
SHA256 4e778153070a4d3cab4b40d4d26aa9b0688f0164ebd402fb2dfada0c42cc5ca1
SHA512 3a7346f6924d4ae0df2e568e85b8822d134d9122cbc9a1e66ae68683b65a778f3a6199b572500d2661009c69a1783a5267e56a8f934e4c3a9183c62a56d3b3e2

memory/2008-1595-0x0000000076510000-0x0000000076725000-memory.dmp

memory/4432-1808-0x0000000000400000-0x00000000005ED000-memory.dmp

memory/4432-1809-0x0000000005D50000-0x0000000005D5E000-memory.dmp

memory/1864-1807-0x0000000000400000-0x00000000004A1000-memory.dmp

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\curver\pic.png

MD5 f7fdb453afd01e8e3057305c24b4a4b6
SHA1 1b55f856a4f8ef28fa0cd9268a293bbc8e90d206
SHA256 2dd294ab378305e24921e731ad020a2e11812ca8d0ad386522a3ff48fa3cda18
SHA512 ead029ddf938a93cc7bd81f4b54e673742a8ae10c1baaac46b80c8fc0ed282b3e0d176a69de23109cd5ada4ede58d9ed2f3331331ee875cfbff3e0e0e421ad46

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\inspect.html

MD5 2464c7ec52711784337d91d51d23276f
SHA1 8f83277385e223b5d1d05e3a7331adbdd8ac1a2c
SHA256 cd566f2982106aa8cf01e2a541e22c5295fff7accc590a53210fa0f1485541a7
SHA512 183ad08fc51d9263e43892e977cea5766d2cfdfe21d355953907459ba0604a72f47e97abdb457f85a76f25b1cbbb86ae19500484cf50d7ca11b21e2912ab9a15

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\inspect-pre.html

MD5 04ed2da149d83fc702157b029273153a
SHA1 c118e9aa8cfc69917649ea3fe4fbe19e8bf7a746
SHA256 171ae9dc3f4b79609c7192e40c8a5c1ec0309adec6732da9c04da3639c3a5c43
SHA512 faf8b12c11b356f02362bf3436455a27906494b0fb2640403fc2eb5c1f14c534250d9af94f95da5363cf4127ae0d326e08b3fd9673318e90d524ca7ad4b22329

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\inspect-complete.html

MD5 47bdc27af8640523e6c0c4d1ae36a20f
SHA1 a8d0cb1c8ddf379eb8943edaa1a7456dac7e0d0e
SHA256 44bd9fdc755044c35ec2a058e750eb8b35a00f61aef09e41a109989eff1de60c
SHA512 143c9d4fb1f047d132bd45f6a72f9b2c4af5c9e5ea33698fa1d682c49187f65b67474260a42a47471d460a25f7dc81374d15c4f53db852c34ae9adce16667f3e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\icon_windows11.png

MD5 aa588004df5f39946ff0d7130c55a12f
SHA1 a1525e7ae0c79d0376385c0d164e7119728a2fb9
SHA256 c428e4f3ac339f855ce32124cd68efe6b15cb345ad531816c11fcff66161d0d0
SHA512 0f8949795f328926b7d9e03d58b399c8f3aad6545f39b6ef7b758712bf793e5849cccedf4a0dcd195f24de8a4f669edf267bc0aad53225635fedda6f304aef50

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\icon_win11_knowledge.png

MD5 5c580fbcde0b1841a9e72953ec45a52b
SHA1 bcedaa2816ab1946d0bbd868c1a52d2ff1b4956e
SHA256 9917ee40c1f63018b36a4947091b04f9f2ca8aa32024e397ccb104afefbd82d9
SHA512 9ac443668eb2816d2d4113068609879a94938ce7fb7070abc28d03f04cb8834fa934a5a12255102ee73ecd99730a425f83c46a1db7c390e99fe5b48f39eaa6c5

C:\Program Files (x86)\AOMEI Partition Assistant\x64\html\Win11\icon_win11_install.png

MD5 d64dbfc523f90b96ceeb23b3ae526817
SHA1 95dddaa3c82c0b0e60cf6cf74338f515dc145af0
SHA256 7980ac71c7cd980679fb613d8edc2bdcc74684e328d8028d51f11356309f866d
SHA512 53b8dbbda5281c1af21361c7c080605eee504141b5f68a094862c095b0dffbe248efb7d3d719f966df60097d98fcc5cee2f3ee0fead7abb5c62e05100a6ca05a

memory/2008-1475-0x0000000003F10000-0x0000000004310000-memory.dmp

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\ar.txt

MD5 dc2b891761004b6be4278a84eac355e9
SHA1 00ffd15fd151e7565934bce51fd7a19c1e7db92b
SHA256 4453aa5897bfb33365cec72a9535e5789f7b1f0765adf4a003402e5419631027
SHA512 a1b82f6842d1f728d9511b3ebf35ff976825403f4f2035140068b9507c7777894bb53f6cf20fe399bd5f440ec2ca778b1a3b1e56076cb4122df65bbaa25f91c7

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\ca.txt

MD5 0f0bf98eaacac9e51a937ae41e0f21cc
SHA1 c1397ea670b46839d6936cc5cbb0070f5f250447
SHA256 1a0518c10ac64cfbee5047d1a169ae07e59be0bb5dbe7c8c6ced74ccc8076b87
SHA512 4d6c55eca6f945aac303c4b0e3f39f95aa1f510e01f2d19ab2d0a0ebb32349c1f7aa1b395c95afe1e0b2022a6bc87a69beb7e47b4fa116e5e30bfa2d5b72e22e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\da.txt

MD5 c6bd030d269c38dbb69a9a1a7c94dded
SHA1 71464356d9dff4e1682a0b22ba411310b0d43bb9
SHA256 1d239b78abc43c5b364c1e2a3912a86ebef05ff02afa2c2f1a0c370730493321
SHA512 ce1d1b1501e2c3672ec1f29e9bb660ed08ab203f4a3339af13edaec2bf50a7da89b718fec61dfcc0f8dfc91a99122ca15761bcaa61b947f0a65ddd67af36d330

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\de.txt

MD5 2f80d52808e3120d1447e9989147bcd5
SHA1 c3a9a654bc3d14b2fe5427c881d7358e215b2024
SHA256 3479f128e0fcda606ab16fa9b355a2e592c12d0710b5672a3cfea8b91b7856e3
SHA512 cc337a16fb9a72960e1c253c805fb9324b7c2b7cfd1eac8729b988de139910b4a09275e25dcef6c2a1c082cba467640888b066a934c417d195aa8af1d0127e4b

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\el.txt

MD5 87a8d85894b6a973da72dde055e67fc6
SHA1 562b1bb41b274f4cb6125d8679c3506f85ae3891
SHA256 32edc88597c8784c2cd753e5375fc2e7a7b6654910b58bc29bf7b827a24cecd9
SHA512 cc8b62fbf67efefc872d3b4ec5223b8ac7dca3847c31d3df4d938f75ee91b18c9e146b501cada473bdd3ae7f3811a0162096a34858a066e1771bc7876802071d

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\en.txt

MD5 c4dd63b604b8a0b795102d302c9dcf88
SHA1 57736e88752b02877cae4ba0768c8b0f049cd201
SHA256 7b87a5fea83235bb5d6958239086304f904af98e0413addd08f99acb66bf5724
SHA512 ce20e26530d410fcf21aaa1850b98896d7c7d144d625d2463d38ee88344f199ae007571c8f420540007986d0c9229f5d62ed72522b3a6f54487926958791d2f5

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\es.txt

MD5 d0db0cc7206551cb4dc160ac137c64bb
SHA1 b263237870c94027a39af833bb390e1caafffe47
SHA256 751d20a789d4385de7d4d95900bd4baf0672e1c72d69339c4683502aaf2881fd
SHA512 dc53837aa47258f7e9a6d934dc6dabf1b5b4f1738facafddeb13237d682972cc2df7afcb417c27233005c337c5ce213a721ba611f77d566309def0496ca06b9b

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\fr.txt

MD5 948fbdbc9294cc02fb7a9a9bb51250cb
SHA1 d99cbaba2f84316f76a4b595e486847c06388b68
SHA256 a8cd1961eded33a6b6b348bddb27f5f39d3ff8d74eca22330137ea820b691ae0
SHA512 a2aa32481489fb27131e53af818d6125053a5da7cd1cb7700612b7285cd68dceae0110627b7651d49ccc1631a5743c1b2ac5a147fdc20341975be5c5e0934f6f

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\hu.txt

MD5 cba9cd9c2e435b60575b0802f175c710
SHA1 3855ed81633241683528d8dad712d58b04c181ac
SHA256 fd88ece5220b73bcb2efadf663a8596a4443a01da088a09b932ca2bacebd72fc
SHA512 75589713c69986e0cb86ffe14b8d1d04b6e2a006ffb7ecd68e01cd361474db68d42b3fc9eddb5d9eacf639f599e80a91bf31f03034791259eef5bbcae1a90913

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\it.txt

MD5 017593c212c0cd70fd06c4b00e47e226
SHA1 7198445cfc3b390df87110a80f1766f156555d95
SHA256 362bd180867233c13f711c3e6f5d0a9275602a8fc2986f76a61ae242173e24a7
SHA512 f94642e5ae187edaab047573e5789bffab5cc9103a3b717fd808c2e2556af59eb0aeac0902b12ebf73e528a4cda8e62d8cef31dd76ed2a5b43043cdc9ef6a72e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\ja.txt

MD5 67e7f8a5dc6f25bdf7fdcefe8499b6be
SHA1 1067ba3c98351767952d7f37632468cbefcd1008
SHA256 a5d60a1c083ae5e86efec3e10b60b4094ea279fcfb53ad9bb8d1d083134aae34
SHA512 1809696af12450c9afce835e7562370b4248d886f25b284a4052a00b51ec947f3c8563654fd69793cfbf9460fb259444f4d0add3259a379e6048d2ce74381471

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\kr.txt

MD5 85f0e28d04383a4431b4f45f97dca412
SHA1 458e53d6a2350e8f9a5975f60bf1840a51d75902
SHA256 af320d6b6ab77c5ea5d4478bb68dd494a9924a34dcd8d8d54b5290888a2f9311
SHA512 e31e4ca71f407e5bb25567223e462323f241ffe9b0d8e5660f74e9422bc67b4cb322891c14b5f514b1ac5a432ab2d5954d84133abea481daf39265d336fe1246

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\nl-be.txt

MD5 520a0764fd5d4e8f216277cf2edbe5a3
SHA1 fdf1421ad88e1cb586d79fd957e467efa07138a2
SHA256 526517560bc5685de937a94cee6ae6439db45b705eb38ec59bf04629b9cd4da5
SHA512 21c841c719df4fd377b817200c84d6be4608852bef677d8ce4431c495ab1d9b86a06c9a295b3de94b43b45dd57d0269624c2b23df44c150279a23d25e2e4a6ab

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\nl.txt

MD5 91069c36aa4c14baf00e728449a784aa
SHA1 b0592c7c797e16cf4a317af6ca40ee0c001e060f
SHA256 4fb20bbf87660d79d8f37e34a3929ba11f0d0a9a05d4184237b3d0c39aa302fa
SHA512 ac6ebc10de521b66a833e345efac1f9432497b06914bda99715ea7e552262318a8c35ff8bfdcb57bb170dd9f2264753d7df95420fab521eabd3e8bb6671bfc12

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\pl.txt

MD5 802c142a4eca65421a40fd1a8c05da82
SHA1 038b7cb34df3a27bf722b396496c5f3a84c55b3c
SHA256 ed9a83f3cf8e5bbc58e84b63d4fa7f892850d0fc7a9235ef5a49dcc46fc6f3fe
SHA512 4bf5875404d2cd4c6e294c6b8e1afd9f2ae2757a7a5a6fefbca0242a13a568814d7bffe37be5f39ed70ba158d085238dceed302bfab786687eee81578a0cd9c5

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\pt-br.txt

MD5 204094cf2f6521d2b344f2694b2babbc
SHA1 e521fc1356379c575866aaf968783c25c235edee
SHA256 fad1dbf6708f4237e9445dfd81ee8b2cab2e98676722a93a14b2f1d52cb06768
SHA512 a562121cbd449de4cf40ff1d7c692280f6d1eb1a37ba7df3b6356a5498bfe6b94e6397751f36b094be2a47ed7d7fed8b614bfb33c3cba34d90e82668a58cc547

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\ro.txt

MD5 3d985c66438ebcef43abff1caa12420d
SHA1 c970769a87c5759966295e1eb13c193443400ee0
SHA256 31c1556679e762d8c377bdd209707e598c2029201b2ed0ade55eabe858640b03
SHA512 0c42c8b9b7b72b1166ed1128500c03dc3716b68011b28aa3d479ca7539388b5c81d761fbf3d999f1edc401dcfd7b175d3c6c0e0d5ef6276757aa02e4433886ec

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\ru.txt

MD5 7705ca75e83d4f3d4abb161131feb279
SHA1 48fc5d1f5070f022b677e0b71b94c3cd304df915
SHA256 121c59901abdf48a40303c4a1a05aabc09fa1c279df13990c36c1972ffd6029a
SHA512 a7f4bdf4fda61e23088c011fcfbde7fc1acfedd33356287c08dbd69f0a2d0fdaa5f0f42f015703a23d3bebebb6480c74c83c2f8d691456389bf4e668b8cfaeb7

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\sw.txt

MD5 9a3af464478c09977fc013dc02c02d01
SHA1 1c5862095782df3ab1ffa45e0e853bc05a9e7a91
SHA256 388e7f24203ba7cdbe3dd226e61dd145036a3de1e9b5654a62e0f86111139404
SHA512 00d9218acd03c9c2a2108b06e4d733483c5dd44ee33986460ae6a8e6e41c5af8d5119779883cbdb694f2dc1aa66d41ca4e5e1737436539985de93831569ed269

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\tr.txt

MD5 51721ff1dd46fe3bcf7a6810c94c143d
SHA1 77b5f5da712b6a63a5477821588e3772e8dbe8ec
SHA256 4f052ff4a2ff6c8e30bbaedb86843771eabd77fecc0b95a9aa2f25ec45e99f20
SHA512 706a68ed0c56089ee182440df1442d9fc9117e348008b953a16785822f42bf063675c96c6721da79e708222d2451ab101528057bc8ee6701585d9f4cfda4c745

C:\Program Files (x86)\AOMEI Partition Assistant\x64\winpeshl.ini

MD5 804e1bbc731f42ae9e668e50f2368018
SHA1 632c8a09ffc076dc4e2875d539c2a42dc9276b5b
SHA256 08d9656d146d58b11ed54d24fd39b6c2bd5e6a8c203c45b264e431a06e730182
SHA512 18340a4c7174592ed595dc5cdf0af6be9fa5092332de2d705e34460b98271a6737d31a3b2a5a38e102ac0b5d7f9c571577394d44aa670b8e26d6fbc6e256bceb

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\zh-tw.txt

MD5 9eeac9a8bcdb95d7ac07439c6eacc131
SHA1 189e316fa766422de86ecbd899fe3ed96a6becf9
SHA256 f2382110ea0f93c09ae7e41b6f8bc6f1ce16ccd7ff0887cc3b58546bf94e864e
SHA512 17b31c4ab9fd9ccbb1897037af3a926b9f50fd934f3280ac90f7256a9acab4ffca116645601bfe0c99ddf755f9a4ef359519648a298dd1591ed377c9e1013860

C:\Program Files (x86)\AOMEI Partition Assistant\x64\lang\vi.txt

MD5 b7b4cf795d6b93ac97c2f4d6764f8af9
SHA1 30be8e9c1e7e6a588e6834d4a9aed819371cf914
SHA256 6732748dbcaadde64489afe64944ae19a591b5fbf6fb63c814af023d9026889a
SHA512 d964956db82856b4cca8c66b65e609f85abc3e3f3d18fc531f3c2c7086c7004f9f37971c87248221f3caa4eb403976417deb7f1037d93570a0221bd30ece73ef

C:\Program Files (x86)\AOMEI Partition Assistant\LoadDrv_x64.exe

MD5 2580b3451f13144d9d1c77f9c90733a3
SHA1 e68c7ea8017b501a37d4095556161263bc0fd0ef
SHA256 d90631fec9db3b16c62567fe50ca14422e41b8e4d9af78a0c4129750230787f0
SHA512 a973e580043edf562ab099a986a8d38ee4839216758435fb52dfaa0c3f1eee60f85a2063ac6ebefcef4d2bc21c2f5c7d1b624912ebe1f2c3ca6cec1082c3a3ab

C:\Program Files (x86)\AOMEI Partition Assistant\x64\install.bat

MD5 d88880bd10ea40ba9992e56bc170ae45
SHA1 7f2d404ab5a31cf4398417c321292407973869ba
SHA256 cbdf198a9af351d7eab8e4ed8b4c5670b621c061b8137deaa843224418c22bdd
SHA512 c6ab03f2255c18af83a4c917e822c42a2824657c428114948f3f11c2d5696c7eca6088a8242ae524bcb7ec15b96a532a268b11a6d0eb22cdd85c2438c6679755

C:\Program Files (x86)\AOMEI Partition Assistant\x64\SetupGreen64.exe

MD5 a043cc5b57bab37ffa0d2150879f9939
SHA1 40446e2eb5cead127851613ca1816390fc9b8ce5
SHA256 356bd8409740e583898891bd3b49143757550f48bd3fe8286f6f1fcabe9818d0
SHA512 90702ab2ff5e691b25a1207592b50fc8d45d708236a67991e23a5c307c60ed16d021dc0b211ed5b0a3bb8fd66692b21c072bd42c84b7ddc678f2881c7fbb80f6

C:\Program Files (x86)\AOMEI Partition Assistant\native\wlh\amd64\fre\ampa.sys

MD5 d0c50c113fe59c21ad59932e6b9c202f
SHA1 41ff9cf9091fef6da6dfa3279310655a84ed5845
SHA256 01d51df682136cce453bb1da8964073e6bc7297ce4dae7301c753bb618a69469
SHA512 61a90f9933252ddc2ca9f5c829b9bac61dab4d309bea61f966da2c48885cb3d49b187b1edf445168f5c6d7bf05ce76ff65570953ac1139bf0b937004565a9d3e

C:\Program Files (x86)\AOMEI Partition Assistant\x64\native\wnet\amd64\fre\ampa.sys

MD5 c32b795b1f8d6ddd7a4969f9b633c86e
SHA1 87f72c6e21243788b01c1d9435fefbd8f3eea422
SHA256 fc3eb89dba30987372fc71432b069e402a5cca0747fb22562d195f873e548a05
SHA512 206cac7096c2ccad59ca0cb8c7a43e62647d5a17db74ae3dd0509838ca02185214df617874dbd1a572a3f44964b1913307e6d03b295834424dec899e09ca59b8

C:\Program Files (x86)\AOMEI Partition Assistant\x64\2Mbr_BCD

MD5 565ca60fc18a62a96704879d55aa9892
SHA1 efa08443b8b1dc4844eeeea012a93d0237e75ef5
SHA256 ae320abdeac87d41431b056e052b4ff46b5cd9a8676e556b60549afc96a3f4a0
SHA512 ac8d8a3fb0b57b822a730ec7a7c27a471c8f0d4c4b54fa5f618d4cc5a9755a6e2b6589f93616252008ffc89afc436f6eb68cbe1a3446978cdf04b5f33e136522

C:\Program Files (x86)\AOMEI Partition Assistant\x64\2Gpt_BCD

MD5 4b8ce628e373be38c138bb1c350242cf
SHA1 5130cc70fd4e61eca7bcc0832f6f9face7f78c6e
SHA256 3126b9cd21a087af7c07b5d585701d87e508bb50e8c0de9de1b96adcb3a5fb51
SHA512 35ab597426697bc3607583b0850a3b404cd73b088bc41ae138543ad7af9c85643150d061d2bca8811f7a8e457f2912706e04699cae3d36f5c1cfd3085bfae458

C:\Program Files (x86)\AOMEI Partition Assistant\x64\language.ini

MD5 86245adf3c65b9e44bae55075aaeb287
SHA1 b310865af56d00341b8f313450c3ef3baa82f0fd
SHA256 422682014f4a57c73f55ffc8a66ed93ee7b6b7edf132c561ac7754a7410b26bb
SHA512 1791b251449971d3ad996f6639bba49d454c66d2144e35dc7c6acaf22b4305fb6d06916f2230e68726e907f591be0122de4e444e3e06fa41de61a32d1abd0113

C:\Program Files (x86)\AOMEI Partition Assistant\x64\uninstall.bat

MD5 c30de019bc6d78ac5c1ffc8485d3596d
SHA1 a96acb232607662368a84fd530fe69a1be14bd12
SHA256 e504881bda5e853fd12dbcc31c752033fce09bcd4c814ca40f8b0b8a72f03ce4
SHA512 1da7b91ef18a7b72ae2150ce2f2a97b7d7f33f14c310882aa4b037d4a249a8191da44658f017f8b5517999e6a459301f5ee214560f3159c13a629163e4cc0cd3

C:\Program Files (x86)\AOMEI Partition Assistant\x64\native\Arm\amd64\fre\ampa.sys

MD5 b1a19d6a9f6fb9d06e42fef0c3b6a4c5
SHA1 e5e043ffe78d788c1fe1107a1f181e6e7e008af9
SHA256 a2c5aa5030a1c5e647838c20f796ffcdce8c7d0f2b431553a663e02528cff54a
SHA512 b89b07b51816543a60707d12c569d297f04be76582989a10720c199b284a8077d266c1c021450e7534c193327c0643fddc7449f3ff535ae73d6895fcceeb5741

C:\Program Files (x86)\AOMEI Partition Assistant\PartAssist.exe

MD5 62c9bc870b0ba3da146f0a3ad99ce797
SHA1 794fed5daf41a4bc86cf32ffe4a5e33fdcdd99fe
SHA256 ab92e3338c1f2324adc15ff368b1fb3813f8ba92be90750a09525243441af497
SHA512 ceda47d4bef3edf02b00d1f5cad8153b53d2b10cd8f5b6ab730f453be0c86683d3967f966081afcea7fb15208c0fd68f42e141f788122f6aca66dfcbe8a54b64

C:\Program Files (x86)\AOMEI Partition Assistant\cfg.ini

MD5 9a828275a668754dcbd0db76feee54cd
SHA1 674fed5afefdc4e70af9106d35ef416b87b0905e
SHA256 e15791694d238aea967ad8578b86977779499adc34767d2bbf06f85b04436b0d
SHA512 f2ab069428ddd1df80861088a1cdc1f7da5bb39e88fad182eced526fd3043ca71acf649c4e9be6c93182d68f3da20cabe699c16a3594b553634784f3448b3fe0

C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe

MD5 82bd642630764da26dc936a7b55717e9
SHA1 32dc58cfc5c2188d93bba1282c5053c20696774b
SHA256 7bbdc868ae2044ec18d3e3ed921dbee08aef2a46b0b5ca61511041620b7bd1a8
SHA512 df600acef2dce6cb2e496736d567ef1de89cd9fdc0b461a36a11ba1212dd6b245b81193512fa6ee2e6b69f8231a0cf8e5f85c712ecc4929dbc5a4f240f9e786d

memory/4432-2397-0x0000000005D50000-0x0000000005D5E000-memory.dmp

memory/4432-2396-0x0000000000400000-0x00000000005ED000-memory.dmp

memory/4432-2403-0x0000000005D50000-0x0000000005D5E000-memory.dmp

C:\Program Files (x86)\AOMEI Partition Assistant\other.ini

MD5 8094a23b465b483c802180279805c290
SHA1 4e46e7f5f28aa40ece1d0d38e78efd0318aca6c4
SHA256 5f6cfeae0c92a9bb5cb40b0a09a3e9794b552403c3775e0fafdbe3aee5b2e18c
SHA512 f99730b8e325bb302d505073d02d3803a321713f5af22603dc7533b478a1036dbc18bed44d3c45954f37027814a971e4d6d4010fe28f894bc17786d7bee76301

C:\Program Files (x86)\AOMEI Partition Assistant\gconfig.ini

MD5 d97a354c878b61edb942706b577b85c3
SHA1 451902ef3dab9b82d7f6b27b5ced65bfd7124ade
SHA256 df0371c587cd9df2147c30ca531811906e88fad57b2d5c53f88f6bee99828cca
SHA512 2f9d17f221bbe41571d458ef7edc03172c4c37b1851e3a805a74b51036962dea0e54b908fbf370945069af739449457da2495b5b2fb643cd3d281aa6738187d0

C:\Program Files (x86)\AOMEI Partition Assistant\ScanPartition.dll

MD5 fcc67112f5651a6515cad6b42cb9a582
SHA1 bc1eb3a332c1d011a59c7f9297ab9d056c07cff5
SHA256 d27d16a1d25f3a2187998a9914a10865348fc5606b4a763d0ec6a01f8e18fdc2
SHA512 02a1f36351210fe9ec7bbc9471ab15165e734f65258298921a6e3ac36dfeae00c2e1175227a50bf4036b31d14fc412297e13b92e5826ad6ce1d74e0c8431b24b

C:\Program Files (x86)\AOMEI Partition Assistant\DiskInfo.dll

MD5 c9d2c5c118e06af3ffbe194bfd17fcb2
SHA1 0bcf18e2c272f015572c8afef18bbd45d67cdaa1
SHA256 a0a0baedc8ae021b2f68042d4412ef8301d0a41581bff54d14e0ae10cb835d60
SHA512 1657f0d646a17fca930ceeed89e913f43c52d232beb49c699e2fe6dac206c00224fdadcf943f7f9072a9e944828ab25b320c4e296d5e68b7f50817ae43d396eb

C:\Program Files (x86)\AOMEI Partition Assistant\libssl-1_1.dll

MD5 cde1b5dad28abcd8b6771c298bf6e114
SHA1 064d7ad4f03a876d74a9388dbd14fa3e2af50a1e
SHA256 faaf83957839aa2df72149086d1eaa7e7242671244462a744aa8e9dc4e88b8b6
SHA512 e5cf7705c1949f7290507797eafd254758a9557a2f8908cf8dbe6763ce230185d8bb2f80fab2ca2d667d4368a177d4df8a4a8e8c7720c4e3f00391fa8d9ed690

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\bgtop.png

MD5 76275f33ed436a701ed7086655bba1f6
SHA1 7259179b01c7b5876ef7eef34216b7ea2bd5f244
SHA256 3d3694e4b72ab9f47e2435ee86c1ca731269050ede5f9eec5d62d60471d45414
SHA512 5e20d1bd443b93f347e94386cca17ef7222c355d16c1896591e39b9bbcc2a467d329f22206cb5a8abff798b3094a7dc12423264a06adaa461503dd5ab8c3becc

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\event.ini

MD5 c61c397549e4f560cc86ecb1163dea4d
SHA1 f090a481662a479522088fa55808571a78dd45a1
SHA256 2f79f5358134bf19d81685cde17642aa735920189eead78fff11fcfca1141e3b
SHA512 64cc17450515026d7016f17555a7ecf38e8c99a587cd47ceeb7bcfb3f1a4a07df8b147e652b70ef060b2d8b49ca95ecd66c60dd7455eb505c1a58a0e2bd245f9

C:\Program Files (x86)\AOMEI Partition Assistant\cfg.ini

MD5 926bb1757fda0e738032d25b4ed5854e
SHA1 aa78b28190e6a7072ab9028c61524fd7082140ea
SHA256 dc201dd10b213311d2e070e1d06cac5b8bdf0154fff81440a1749c0575518ff5
SHA512 21380b66b5c32f40f254afdb02ad82f2de2b0dd8eddd9f533917d63ce20e49b5035f3238fc52e0a316feec61d6a586fde58bcb4c29c76dea192bfc17ea66dc24

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\webctrl.dll

MD5 d0372bedb70710aeff382818ad683f54
SHA1 f960deffdde9cd5cb5fd3608185a49a91d398f3e
SHA256 b3daff58c8e7ca8ce6fe155ca78c681a7d3144a538c3ed4c2913e91a1d2bd717
SHA512 4b24a990ba155b664bad58884810123898f99f3ffe3d9704662c9576d31d60f1889c7a368589af7c3c9559e5fb9921cf87bc4faf73b4b83d1262b50c9bb5f706

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\textbg.png

MD5 142686cd6c1ef8f7b61a0f3f7c1bc067
SHA1 54acb0e6aa746714ae4494c4c8ba945d21d8052d
SHA256 4d4e11ad55f23d3e6584183ade93cd01189380687a44821cf5f5749b0e26c4ca
SHA512 c3090b16dfe1488ccb48d06eb49ebf42491778a6ee35d9398819ad65222ec3dc313a9d783a82f4d2851eaea86d3e487736b739fb594eb10e38b0dfcf4d1cd011

C:\Program Files (x86)\AOMEI Partition Assistant\SSDSecurityErase.dll

MD5 d81f264eb6b5a93f3b0a9a79ab3634c1
SHA1 19e63680524a67dab43d514c163dad7f0b701605
SHA256 89a51da73a5fb9f46bc7b2fc0bf81fff2e358cfe52811db462fdee8ea5bc6254
SHA512 33e83315feb7a70aa06a6b87986502662fef839f3e60625b64942a4c46f0121932b07cc9e81d13dea2fd59b8ecb8f7dfa3bacf7b663931a33e8a67e662ecc449

C:\Program Files (x86)\AOMEI Partition Assistant\WimMgr.dll

MD5 3cb4dde559fcc347f22300ee5f19e746
SHA1 22d3f7d4e4270ff549c8603bdf4edc35bd92c7c5
SHA256 a5bfff0bbac54b18b161317249400828fb3f57551979fc085f590520228788c8
SHA512 b0225ce8a70b5366f6721de7e3bced1d094580e9b73a6f7894caa3e8171c123204039401775b6d323ad673982648d490ced0378844fdcef108587b3b4230c18e

C:\Program Files (x86)\AOMEI Partition Assistant\PE.dll

MD5 0d21c191b1c58158e43523646de056ad
SHA1 06fec7d3386f7eef78a41cb0dcdc42fa3e3a37b9
SHA256 eb409056b5d44c491ef325d2521005a92ccca223770e03f83718f8a3c08d83e6
SHA512 6e1dc3ea4db5beff74353b5683deba393908f6338e247f1a8632b5f14b1e660895b457b363096fb1fb2bfd3bc15438fea583737f950014dabeef7ccb4e85d870

C:\Program Files (x86)\AOMEI Partition Assistant\WebView2Loader.dll

MD5 8fb7d2fa445716d23433ee696d41387d
SHA1 e9b64d19435fbcac962f2fc4de7853f4a5da2736
SHA256 d6f70c734b09917e1ef9abc54a0edc84afea3f784e31c8ec75fb525b2821eee5
SHA512 d9a572fd60697bf142255f59065cacda4b78bf4ffd242daf89041c2054b7fc980c3044678ee209ed93874aba0e59f55527bae934fe50d6e50cddf8319d44d0c6

C:\Users\Admin\AppData\Local\Temp\is-RHQ8U.tmp\ga4.exe

MD5 22977d9e823fb71a54c01c2b9ca471a2
SHA1 39c9bfca84e7894d1dbcc4f56bccd8c072f6ad46
SHA256 86df967ee26899a637759d2904c3ba99aa635800782246eda024247e34af9c66
SHA512 0c8bd3831d0527f2c686780195a8189a1ccbf73ebadb1910eefef18aebb6aef2eea0d37d047588c96f3c11754a17f4ad4b5317f509a0d26ce2abdc1914ae0e4b

C:\Program Files (x86)\AOMEI Partition Assistant\sysClear.dll

MD5 af5ffa6ae3102d0c650e9daff24eabf5
SHA1 1333859e7f04ba4ab54e942660660350413d7a5d
SHA256 88f567e5a9655e05797a3e96675f9c978c1b60cb670665d436402818bdf2d314
SHA512 2b91f6bf62b29f259c57f5cab4ca323687b324c28d97a4d86449738e8d4f4a20289ba7bb8c341edeb00dd6ab25a8e1fe29318213aea20de685ad143306db5f4e

memory/4432-2578-0x0000000000400000-0x00000000005ED000-memory.dmp

memory/1864-2579-0x0000000000400000-0x00000000004A1000-memory.dmp

C:\Program Files (x86)\AOMEI Partition Assistant\cfg.ini

MD5 b0b17c63708c1aa2e3a619a8578df62f
SHA1 9d46a45c1123c03715ddc3af03f8a2b03ff47bec
SHA256 0b9d5b04325ca61fc92f7eaa2395269b344e1c46ed5b5795b8148bceea2ae022
SHA512 c5b83c95c99ee39ddb855651a649c8f3d3c52f1da85f9acb828883502aa4c054ae8ed44dc273f4792006e590228283b72702b9f7d6a69f1f71e948db1e1c30d6

C:\Windows\ampa.exe

MD5 cdc57e2e448b3d07565a57810f9faf94
SHA1 6c7e551fe2a05d8a00bfe1193f7fadcd4148443a
SHA256 0befac606699268f5ea6c475d5d1aa92477184c5f113514b5cd9633b3ea953b9
SHA512 dc1f3ed0f672f474b388f7ab5a12e5637e042420eaedb0bcf52dbc029e8b3c829b35b384474e8c65c1b2e0a4ace4479a93de60024bce4333f938f06b7878853c

C:\Program Files (x86)\AOMEI Partition Assistant\upgrade-now.ini

MD5 1606360a3dc1588761e64a9e098f06a9
SHA1 7d6276d205514dd27db31bf7918ed726b44bbdf9
SHA256 1f179c7c6a24377f8f8bd222576ee4fadde612442a1392534cf0675402cfa18a
SHA512 a2697ebe68e40df767213571bdfb6e2ec3a1918c0a40fd7b5d7495e0092f1fad51825e4825a44d9ab8f3caadebfd4b4b26843ce8807fb8c468ba6bc3e1640c2d

C:\Program Files (x86)\AOMEI Partition Assistant\upgrade-now.zip

MD5 aa0e9dcf1d5e68a9391af27c55588f01
SHA1 295a1bfd000a2be2134d3ec372182f61fae0ff43
SHA256 70171335c530e04b68809054932c95bab271748bd4261542a9678e4061194b50
SHA512 7d254da896a1d25066899fcd881dc852630c91b868c1f1e4b777bf5a3aaa14720a9746a9327e606cb31363ede275b1b0bae1facd2c3d1b8961cc11248497541d

C:\Program Files (x86)\AOMEI Partition Assistant\uphtm.ini

MD5 f92590a7fda9c359581c9a9c28203599
SHA1 e3352d6847587a0bcb2ceaa5370e34f865f7adac
SHA256 75e89e9b679fb37436efdcf1ea900d5601c208b45f08ed815bc7dd95335ae575
SHA512 6f16f272919b0eb46fde3f4fb8124f8e52c5456a022b74c402b77e20b4d5b2829dcf33fa76c662604040573fdeb16a6829abd6e685d45803fe82abee8797b984