Overview

overview

7

Static

static

3

DRW14.0_Trial.exe

windows10-2004-x64

7

DRW14.0_Trial.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    108s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/09/2026, 18:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DRW14.0_Trial.exe
  • Size 43.1MB
  • Sample260924-xd8ctaydmc
  • SHA256 b444c158ba39475d318d609934f38cb03fb9268e3746171d592a58749b756ca1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarebootkitdiscoveryinstallerpersistencespyware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 55 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DRW14.0_Trial.exe
    "C:\Users\Admin\AppData\Local\Temp\DRW14.0_Trial.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Users\Admin\AppData\Local\Temp\is-0CBB6.tmp\DRW14.0_Trial.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-0CBB6.tmp\DRW14.0_Trial.tmp" /SL5="$60280,44562509,192512,C:\Users\Admin\AppData\Local\Temp\DRW14.0_Trial.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5648
      • C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe" /SendInfo "Window" "Langsel" "Activity" "Click_Confirm" "Attribute" "{\"Language\":\"en\"}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\AliyunWrapExe.Exe
          C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\AliyunWrapExe.Exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5868
      • C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe" /SendInfo "Window" "Setup" "Activity" "Click_Next"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3792
      • C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe" /SendInfo "Window" "Licenseagreement" "Activity" "Click_Accept"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:896
      • C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe" /SendInfo "Window" "Selectdestinationlocation" "Activity" "Click_Confirm" "Attribute" "{\"Path\":\"C:/Program Files/EaseUS/EaseUS Data Recovery Wizard\"}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2424
      • C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe" /SendInfo "Window" "Selectadditionaltasks" "Activity" "Click_Install" "Attribute" "{\"Test_id\":\"14.0Trial_2021-02-04\",\"Version\":\"Trial\",\"Num\":\"14.0.0.0\",\"Language\":\"en\"}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1424
      • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\EUinApp.exe
        "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\EUinApp.exe" DRWUI.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:3880
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.easeus.com/thankyou/install-data-recovery-wizard-trial.htm
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:6024
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffca58cc188,0x7ffca58cc194,0x7ffca58cc1a0
          4⤵
            PID:4588
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,2072673376272734950,16994139591891268569,524288 --field-trial-handle=2592,i,15904516565751512342,18025217475048420696,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:3
            4⤵
            • System Time Discovery
            PID:4004
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,8824556681590816286,18072123924802405144,524288 --field-trial-handle=2592,i,15904516565751512342,18025217475048420696,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
            4⤵
              PID:1004
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,14030865535954753226,2267750808882274393,262144 --field-trial-handle=2592,i,15904516565751512342,18025217475048420696,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
              4⤵
                PID:3940
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,17058715897482704316,8577450369346046335,2097152 --field-trial-handle=2592,i,15904516565751512342,18025217475048420696,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
                4⤵
                  PID:176
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,13338030585941665379,11250671370600259991,2097152 --field-trial-handle=2592,i,15904516565751512342,18025217475048420696,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
                  4⤵
                    PID:4356
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,9283016890110549243,10247027347071296593,524288 --field-trial-handle=2592,i,15904516565751512342,18025217475048420696,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
                    4⤵
                      PID:1764
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10912829271778112531,13075319298338431533,524288 --field-trial-handle=2592,i,15904516565751512342,18025217475048420696,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
                      4⤵
                        PID:1952
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,7531738144603069776,13058641670738430037,524288 --field-trial-handle=2592,i,15904516565751512342,18025217475048420696,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
                        4⤵
                          PID:5292
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,7531738144603069776,13058641670738430037,524288 --field-trial-handle=2592,i,15904516565751512342,18025217475048420696,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
                          4⤵
                            PID:6028
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                            4⤵
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:5388
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffca58cc188,0x7ffca58cc194,0x7ffca58cc1a0
                              5⤵
                                PID:1788
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,14045767644507434108,11884066539628291575,524288 --field-trial-handle=2276,i,15631247647395840511,12474580742058432801,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
                                5⤵
                                • System Time Discovery
                                PID:796
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,13246762133496491056,5451863446493483508,262144 --field-trial-handle=2276,i,15631247647395840511,12474580742058432801,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
                                5⤵
                                  PID:3668
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,5751879252398619074,8235186300243647903,524288 --field-trial-handle=2276,i,15631247647395840511,12474580742058432801,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
                                  5⤵
                                    PID:4372
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,14114360388043526944,1429043942572721606,524288 --field-trial-handle=2276,i,15631247647395840511,12474580742058432801,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
                                    5⤵
                                      PID:5176
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,14114360388043526944,1429043942572721606,524288 --field-trial-handle=2276,i,15631247647395840511,12474580742058432801,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
                                      5⤵
                                        PID:2840
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,7455260578025324113,16748479234359945955,524288 --field-trial-handle=2276,i,15631247647395840511,12474580742058432801,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
                                        5⤵
                                          PID:2908
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,12107996409254613562,6603405284251197298,524288 --field-trial-handle=2276,i,15631247647395840511,12474580742058432801,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
                                          5⤵
                                            PID:1032
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,10707152633207022233,3664750865070058980,524288 --field-trial-handle=2276,i,15631247647395840511,12474580742058432801,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
                                            5⤵
                                              PID:5292
                                        • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\DRW.exe
                                          "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\DRW.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious use of WriteProcessMemory
                                          PID:896
                                          • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\DRWUI.exe
                                            DRWUI
                                            4⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Maps connected drives based on registry
                                            • Writes to the Master Boot Record (MBR)
                                            • Drops file in Program Files directory
                                            • Checks processor information in registry
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: GetForegroundWindowSpam
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:4760
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Checkingupdate" Activity "Trigger_Checkingupdate"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:4656
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\EuDownloader.exe
                                              "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\EuDownloader.exe" "https://update.easeus.com/update/drw_eng/drw.ini?time=134347528635790000" "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard/Upgrade.ini"
                                              5⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4328
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Loading" Activity "Result_Downloadconfig" Attribute "{\"Elapsed\":\"7\",\"Error\":\"116\",\"Result\":\"Fail\"}"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:832
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\EuDownloader.exe
                                              "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\EuDownloader.exe" "https://update.easeus.com/update/drw_eng/InnerBuyRSS_Trial_140d.zip?time=134347528640390000" "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard/InnerBuyRSS.zip"
                                              5⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3168
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Checkingupdate" Activity "Result_Checkupdate" Attribute "{\"Elapsed\":\"1\",\"Error\":\"\",\"Result\":\"Success\"}"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:2132
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Updateavailable" Activity "Click_Cancel"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:1908
                                            • C:\Windows\System32\Wbem\wmic.exe
                                              wmic DISKDRIVE
                                              5⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4328
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Loading" Activity "Info_Wmic_Diskdrive" Attribute "[\"Availability BytesPerSector Capabilities CapabilityDescriptions Caption CompressionMethod ConfigManagerErrorCode ConfigManagerUserConfig CreationClassName DefaultBlockSize Description DeviceID ErrorCleared ErrorDescription ErrorMethodology FirmwareRevision Index InstallDate InterfaceType LastErrorCode Manufacturer MaxBlockSize MaxMediaSize MediaLoaded MediaType MinBlockSize Model Name NeedsCleaning NumberOfMediaSupported Partitions PNPDeviceID PowerManagementCapabilities PowerManagementSupported SCSIBus SCSILogicalUnit SCSIPort SCSITargetId SectorsPerTrack SerialNumber Signature Size Status StatusInfo SystemCreationClassName SystemName TotalCylinders TotalHeads TotalSectors TotalTracks TracksPerCylinder ___ 512 _3_ 4_ 10_ __Random Access__ _Supports Writing__ _SMART Notification__ WDC WDS100T2B0A 0 FALSE Win32_DiskDrive Disk drive //./PHYSICALDRIVE0 2.5_ 0 IDE _Standard disk drives_ TRUE Fixed hard disk media WDC WDS100T2B0A //./PHYSICALDRIVE0 4 SCSI/DISK&VEN_WDC&PROD_WDS100T2B0A/4&215468A5&0&000000 0 0 0 0 63 232138804165 2105791381 274872407040 OK Win32_ComputerSystem VYPMRCYQ 33418 255 536860170 8521590 255 ______\"]"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:1156
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
                                              PowerShell "Get-PhysicalDisk | Format-Table -AutoSize"
                                              5⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5580
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Loading" Activity "Info_Powershell_Getphysicaldisk" Attribute "[\"__Number FriendlyName SerialNumber MediaType CanPool OperationalStatus HealthStatus Usage Size________ ____________ ____________ _________ _______ _________________ ____________ _____ ______0 WDC WDS100T2B0A 232138804165 Unspecified False OK Healthy Auto_Select 256 GB______\"]"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:2492
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Loading" Activity "Info_Hardware" Attribute "{\"Cpu\":\"Intel Core Processor (Broadwell)\",\"Memory\":\"16384MB\",\"Os\":\"Microsoft Windows 10 x64\",\"Oslanguage\":\"0x409 English (United   States)\",\"Processornum\":\"8\",\"Windows\":\"10.0.19041\"}"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:736
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Loading" Activity "Info_User" Attribute "{\"Country\":\"United States\",\"Timezone\":\"GMT-00:00\"}"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:5480
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Loading" Activity "Info_App" Attribute "{\"Language\":\"English\",\"Num\":\"14.0.0.0\",\"Packdate\":\"2021-02-04\",\"Testid\":\"14.0Trial_2021-02-04\",\"Version\":\"Trial\"}"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:3496
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Loading" Activity "Info_Start"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:2116
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Loading" Activity "Trigger_Enumpartition"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:1608
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                              /SendInfo Window "Loading" Activity "Info_Installedapps" Attribute "{\"Installedapps\":{\"competitors\":[\"\"],\"easeus\":[\"1\"]}}"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:2964
                                            • C:\Windows\system32\fsutil.exe
                                              behavior query disabledeletenotify
                                              5⤵
                                                PID:1032
                                              • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                                /SendInfo Window "Loading" Activity "Info_Disk" Attribute "{\"Diskinfo\":{\"Disk0\":[\"WDC WDS100T2B0A\",\"SSD\",\"internal\",\"262144.00MB\",\"MBR\",\"\",\"on\",\"\",\"WDC WDS100T2B0A\",\"\"]}}"
                                                5⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                PID:2512
                                              • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                                /SendInfo Window "Loading" Activity "Info_Partition" Attribute "{\"Partitioninfo\":{\"Partition1\":[\"WDC WDS100T2B0A\",\"System Reserved\",\"\",\"lost\",\"300.00MB\",\"\",\"\",\"ntfs\",\"\",\"basic\"],\"Partition2\":[\"WDC WDS100T2B0A\",\"Windows\",\"C\",\"existing\",\"220882.00MB\",\"200556.85MB\",\"20325.14MB\",\"ntfs\",\"\",\"basic\"],\"Partition3\":[\"WDC WDS100T2B0A\",\"F\",\"\",\"lost\",\"20480.00MB\",\"\",\"\",\"ntfs\",\"\",\"basic\"],\"Partition4\":[\"WDC WDS100T2B0A\",\"F\",\"F\",\"existing\",\"20480.00MB\",\"58.28MB\",\"20421.71MB\",\"ntfs\",\"\",\"basic\"]}}"
                                                5⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                PID:4556
                                              • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                                /SendInfo Window "Loading" Activity "Result_Enumpartition" Attribute "{\"Elapsed\":\"0\",\"Error\":\"\",\"Result\":\"succeed\"}"
                                                5⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                PID:4528
                                              • C:\Windows\system32\fsutil.exe
                                                behavior query disabledeletenotify
                                                5⤵
                                                  PID:5260
                                                • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                                  /SendInfo Window "Selectlocation" Activity "Click_Exit"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:904
                                                • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                                  /SendInfo Window "Exit" Activity "Click_Exit"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:460
                                            • C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe
                                              "C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe" /SendInfo "Window" "Install" "Activity" "Click_Finish" "Attribute" "{\"Launch\":\"Check\",\"Participate\":\"Check\",\"Url\":\"https://www.easeus.com/thankyou/install-data-recovery-wizard-trial.htm\"}"
                                              3⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:5996
                                            • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\SetupUE.exe
                                              "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\SetupUE.exe" /Enable "{\"Language\":\"en\",\"Version\":\"Trial\",\"Version_Num\":\"14.0.0.0\",\"UE\":\"On\"}"
                                              3⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4256
                                              • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                                "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe" /Enable
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                PID:3292
                                              • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                                "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe" /SendInfo "Window" "Install" "Activity" "Info_Userinfo" "Attribute" "{\"Language\":\"en\",\"Version\":\"Trial\",\"Version_Num\":\"14.0.0.0\",\"UE\":\"On\",\"Country\":\"United States\",\"Timezone\":\"GMT-00:00\",\"OS\":\"Microsoft Windows 10 64-bit (10.0.19041.1.256)\",\"Test_id\":\"14.0Trial_2021-02-04\"}"
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4324
                                                • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\AliyunWrapExe.Exe
                                                  "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\AliyunWrapExe.Exe"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1860
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                          1⤵
                                            PID:4184
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                            1⤵
                                              PID:404
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                              1⤵
                                                PID:5296
                                              • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\DRW.exe
                                                "C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\DRW.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:1524
                                                • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\DRWUI.exe
                                                  DRWUI
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious behavior: AddClipboardFormatListener
                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2936
                                                  • C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\InfoForSetup.exe
                                                    /SendInfo Window "Running" Activity "Click_Know"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3244

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    DRW.exe
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\DRW.exe
                                                    • Size 294KB
                                                    • SHA256 9d965021e4a200ced3056052f0cca2f2b8329fb5dcf9e010a74b6aa3b8df7699
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    DRWUI.exe
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\DRWUI.exe
                                                    • Size 9.6MB
                                                    • SHA256 2bc2d98b1df0948f7c51e17ff48ea5c45f89dd3038c8d8d8ff8fd902308c2891
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    EUinApp.exe
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\EUinApp.exe
                                                    • Size 25KB
                                                    • SHA256 49b747b0108bd5742887f223c65d0dab341430de703cef0e53b0f022d9d122cb
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-56MLI.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-56MLI.tmp
                                                    • Size 531B
                                                    • SHA256 8d84e26342416daef19c31d66a3108a0377e776f953f2fce658f78da4eeb0837
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-5BLJA.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-5BLJA.tmp
                                                    • Size 218B
                                                    • SHA256 8b42d4ccc3ad6dad756bcbebbf387ac693eedcb7ec26830a9714fa048cf15bdf
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-5KPHD.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-5KPHD.tmp
                                                    • Size 68B
                                                    • SHA256 bdfeb0fe6d4db2f8078ca3e7c014a40f2df32dac10d543f49133b028a51d0bf6
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-5UKUB.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-5UKUB.tmp
                                                    • Size 1KB
                                                    • SHA256 15fb0280344ca0c0668995cc88fe36016558adcaf6852f079f416efd2691ab2c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-8S7H9.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-8S7H9.tmp
                                                    • Size 28KB
                                                    • SHA256 e677dfe2397ae52514b1af6b48e3bb8f9d5e7a6d35e642c43a15dbf8d40529be
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-FCVLU.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-FCVLU.tmp
                                                    • Size 608B
                                                    • SHA256 84be8a482ff0492b07b371533d84308bbd3049791cde70c00eb283d53b24bd60
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-GETIO.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-GETIO.tmp
                                                    • Size 292B
                                                    • SHA256 313e1bebbd1b29c7b225223c2a43bab6f6a651d0e0b0cab276b2e431fe70eac2
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-HAHJP.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-HAHJP.tmp
                                                    • Size 468B
                                                    • SHA256 d419fed3c58ea20520d627b5001adcfa7f3d324b94ddc6a4ea9ea67d56305269
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-JIOF9.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-JIOF9.tmp
                                                    • Size 587B
                                                    • SHA256 924f38150935b6c497ae6564e49d59178aae124636ebc0217ee5ae53522248ee
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-M7IL7.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-M7IL7.tmp
                                                    • Size 444B
                                                    • SHA256 4a4c16a3663485a410c50a6cf58d8150cf2b96a4fed1492a1ac37053fb12af8f
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-MREGK.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-MREGK.tmp
                                                    • Size 235B
                                                    • SHA256 17975226d3e14d3cb1ffc5dffaa313d671a39627506d21e9c621ad97e4cf0f90
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-Q9766.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-Q9766.tmp
                                                    • Size 22KB
                                                    • SHA256 0dd4bd4dffff66f72203e7fe0ce9363e99f532fd34a6549dfbb0600611f89186
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-SDPRS.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-SDPRS.tmp
                                                    • Size 480B
                                                    • SHA256 36b3e359140d948d35f63163b04eaa4ea17e0a160d0d15e39d57b12dadee4b62
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-VFHPV.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\images\is-VFHPV.tmp
                                                    • Size 1KB
                                                    • SHA256 398c77e086d09e114265c9530f7f604c1651f084b03d2ac64d53451c7a6674c4
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-7D5F4.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\ChineseTrad\js\is-7D5F4.tmp
                                                    • Size 93KB
                                                    • SHA256 8b48a9b29ba3ebc5280048d46cba4e9a282ac3b2f8475aacfae2b67e2d6483a0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-NABMF.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Danish\images\is-NABMF.tmp
                                                    • Size 1KB
                                                    • SHA256 80a5c9e7fe1933b011d75a68eef857ae42f3e4184b81a4347299ffece3fcbb2c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-AGIRB.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Danish\is-AGIRB.tmp
                                                    • Size 8KB
                                                    • SHA256 f2bc58f7aac80633d734a8a7305d37336d6aa432bef1d8985ec3258b37775b11
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-P94OT.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\InnerBuyRSS\Italian\images\is-P94OT.tmp
                                                    • Size 1KB
                                                    • SHA256 743fcbb110742fb4b9946928b5923d7b11025fa1aac7c88ee9d0ae56c4edd4c8
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    PubLog.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\PubLog.dll
                                                    • Size 22KB
                                                    • SHA256 8ecf3fbea58e9678258019352b7f5c0780e942b93bfc0cba44dc8861fcb38939
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Qt5Core.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Qt5Core.dll
                                                    • Size 5.3MB
                                                    • SHA256 0863213800019dbeedd8548f57c5a04d51545ec1235a275e48d95c3b1af197f6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Qt5Gui.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Qt5Gui.dll
                                                    • Size 5.7MB
                                                    • SHA256 b2f2b83b73898a1349e865387c5ac6bcfcb3b60262d86756fcaa719e11764962
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Qt5Widgets.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Qt5Widgets.dll
                                                    • Size 5.3MB
                                                    • SHA256 ea7a2da56cb649c31553c4afcc5410e6485df53ef87e72fe2a34acd926076495
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Qt5WinExtras.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Qt5WinExtras.dll
                                                    • Size 275KB
                                                    • SHA256 2bc571e6362e75310eab3afd9abf6f010a346ab1f7bdda87ee371a6b2611c2ba
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-3NBPM.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\DriveTypes\shadow\is-3NBPM.tmp
                                                    • Size 3KB
                                                    • SHA256 1ae2b7ca4a1aecf8a475c1307189a732a9c3c971cecdbefe20b30141fd0c06bc
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-D7P3V.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\DriveTypes\shadow\is-D7P3V.tmp
                                                    • Size 2KB
                                                    • SHA256 583bdbaaef626429ec14fba5a20883233ed5daac1c5e17bb73df14d07e6dac26
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-POQS0.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\PopWnd\ActivateBuy\AutoActivate\is-POQS0.tmp
                                                    • Size 5KB
                                                    • SHA256 a9008cdcc72b953d8419b38481cecf88ef871f580775c0cd1a4023952eaed9d6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-M5O2A.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\PopWnd\Bitlocker\AutoDecrypt\is-M5O2A.tmp
                                                    • Size 6KB
                                                    • SHA256 183b3e402297e6e88d1b61947bd81c232f4fc75f0b17e2fa479f1619c966364b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-35DSV.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Preview\PngSequence\LoadingAudio\is-35DSV.tmp
                                                    • Size 6KB
                                                    • SHA256 8aee9ba35afcb7ca50c1b4df05bca92e86282ea7ac5ffebc795eb8cf8c19139e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-606I2.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Preview\PngSequence\LoadingAudio\is-606I2.tmp
                                                    • Size 7KB
                                                    • SHA256 0763ae76411bbe3eb22275d86825135f27e1be0147791b43e71fce261d561537
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-BVVN9.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Preview\PngSequence\LoadingDoc\is-BVVN9.tmp
                                                    • Size 3KB
                                                    • SHA256 db75c84c0702fbe11d7d0135ba1b1a1ee9198fccb67681f3b0fd0442cccf73d3
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-S0CAK.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Preview\PngSequence\LoadingDoc\is-S0CAK.tmp
                                                    • Size 4KB
                                                    • SHA256 8f6ca1300752b1059e9d652e7d66b48b4c7ada441181209fbcc5815ca785a606
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-91TVL.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Preview\PngSequence\LoadingImg\is-91TVL.tmp
                                                    • Size 3KB
                                                    • SHA256 eb377f7ff94e36981101ed7e66a0daf7106c52c68a3b1a76438553d58534a7a0
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-B0F5N.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Preview\PngSequence\LoadingImg\is-B0F5N.tmp
                                                    • Size 205B
                                                    • SHA256 85c41b9381b13f22d7b5af1d8782df184ae5c66262fd442c61e4096abf505c7e
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-DOQDS.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Preview\PngSequence\LoadingImg\is-DOQDS.tmp
                                                    • Size 4KB
                                                    • SHA256 7160409d4064578911fc3177f15d28314a04786fa0c69c90c745d81ea7180196
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-K7OGD.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Preview\PngSequence\LoadingVideo\is-K7OGD.tmp
                                                    • Size 4KB
                                                    • SHA256 be360c27b4a219e6bb7e6a2e4a3cfe89396d5cbe90f69437a0536df5b992dfef
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-V2DC4.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Preview\PngSequence\LoadingVideo\is-V2DC4.tmp
                                                    • Size 4KB
                                                    • SHA256 a3c964063a06827aa68b8985cad369541abeb58d17a2c6caafbf061c49dd399b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Refresh_00022.png
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Refresh\PngSequence\Refresh_00022.png
                                                    • Size 4KB
                                                    • SHA256 9f270b95cb521200e2f004a488bd7d1d5855079f499a55f869beb9ef81623acc
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-4R5AO.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Refresh\PngSequence\is-4R5AO.tmp
                                                    • Size 4KB
                                                    • SHA256 0063587b2f2a2620a5bbd15b2407be2e2bdc13d3877678c79c834aa3778add67
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-RHAQ0.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Refresh\PngSequence\is-RHAQ0.tmp
                                                    • Size 4KB
                                                    • SHA256 bf6fff91abe043c615e26546e8a7d6f341511f78beab194311e18666f8fbed98
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-SCRV0.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Refresh\PngSequence\is-SCRV0.tmp
                                                    • Size 4KB
                                                    • SHA256 c83668019ba157e91af893a1fa02600480c216d93c9297c70d35b0aab4b59ad3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    is-SAIGV.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\Repair\PngSequence\is-SAIGV.tmp
                                                    • Size 437B
                                                    • SHA256 5790415408472aadfcf7a059f0c073fb5451de2b7b1ed0e0284f511e4891d561
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    is-5DK03.tmp
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\Resource\ScanProgress\PngSequence\Scanning\is-5DK03.tmp
                                                    • Size 3KB
                                                    • SHA256 bc2a42d5f4023c39ad2d1c32716a0468a34a11a666aba605b5c16b3f7d0ec271
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 816B
                                                    • SHA256 5393e824c0ec3fb382393927a890381d20c2e2dcf0715ae77bb599f1fb4c8c05
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 1KB
                                                    • SHA256 e6ef7857228e5ed5058d725a4bd494d2c11beb711748526ec32195d390b22135
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 1KB
                                                    • SHA256 9b2d4ef7c054dbed2211a092084d479c4a619ed61a6d8b0cb8b637bfaf42f6f4
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 1KB
                                                    • SHA256 0175b558c3d823330a857bbc7d5d42407444ab83c6734b22b55108f0096b7b10
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 1KB
                                                    • SHA256 967f70a50d0c87acc1a08172c472ee8a607ae4d3899bba9f4a0a0cc118bb68f8
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 936B
                                                    • SHA256 5cd87b0b15edeca6f62387ce873ea9cf8f1814701778b804c011aeed9e465893
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 514B
                                                    • SHA256 581d2ed8169bdba87800a9b366eb27d32c923e35a254cd8c65b74077cbdbac21
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 4KB
                                                    • SHA256 4441750e9a73ec0faf976617496e9422f9c02946dfa91826fafc6ab2538c6830
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 4KB
                                                    • SHA256 709270018ff196e49610e30ff3f2597d26cd299ca2493acd3791a6c0cd2aaa8f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 2KB
                                                    • SHA256 d87c993348c51959e36a995de9ea03536d4ac73f6af448198298637b1f510062
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 1KB
                                                    • SHA256 c2ff93f11df559a803afdc62b35323cf5ae18ba1c2e983e233990dce3bd5f9f8
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 768B
                                                    • SHA256 cf5b61dd47681f5e1d24f59daeca8683b57dede1f9beee577aabb7e27db5c245
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 1KB
                                                    • SHA256 ae888ac72e921c6a204bc8a63f37d5e216c0044c9cae5325bc59e6160c4faf61
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 1KB
                                                    • SHA256 0ac7d430353687fc13d322717fb9e923a4f8790af42357cd3617296d1a64bad3
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 2KB
                                                    • SHA256 0e1c868b78fce760ebde8b434e00f983208be415615ab2d6907960266486b38f
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 2KB
                                                    • SHA256 1d0875987f605ac078e6d4d9e8cb7439b8a02d52970f2979aa9b92f09140cead
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 2KB
                                                    • SHA256 5d4937254b6d71a0aa045f67209942f5341057451e2805ddefa43d7ff5c96906
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 1KB
                                                    • SHA256 f73f1e40d02d072da78fc457ee5522f1a08bcad16a4f6ca91816387f07b42a2b
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 504B
                                                    • SHA256 c09d652cc17ad2800bf57f13d5e3749a8417ffb2a1cc6490e715995fecdb1436
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 354B
                                                    • SHA256 400c3d3f35e81dfdd9e993af2fb5215c8bd24aa28b989310ff3ac10b2104701d
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 334B
                                                    • SHA256 01fbebbc633e238ac01d6d3d4c5d1567590414b3c71520a411f92a165ab86fc9
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\aliyun\DataFile.ini
                                                    • Size 340B
                                                    • SHA256 530197013b32e5b691d9450a11c5ef069d46a3e639506a0e87c749c1b5f1b24b
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    config.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\config\config.ini
                                                    • Size 1KB
                                                    • SHA256 067b08cc7dfe26ed5f279f6eaec96b45e6135914d4847d248e33f24fcbfff068
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    config.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\config\config.ini
                                                    • Size 1KB
                                                    • SHA256 b12c411211560046eb030045f656a8cf86d1a74bb82a65b9bdcb9a8c9ded2349
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    config.ini.Hp2936
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\config\config.ini.Hp2936
                                                    • Size 1KB
                                                    • SHA256 806febcef0c78a9536f4049d0d4fbe87c535c5daafd74c8a9da611acced6c72c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    config.ini.Uh2936
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\config\config.ini.Uh2936
                                                    • Size 1KB
                                                    • SHA256 d8de6e16e53e416527341d99990770ccf5620730196b69baa16e3fec7bb0bebb
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    config.ini.Xd4760
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\config\config.ini.Xd4760
                                                    • Size 1KB
                                                    • SHA256 c024aa6756f481f0392777c4ceeb0eecfa260363ef22107195cf214827421552
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    config.ini.lock
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\config\config.ini.lock
                                                    • Size 20B
                                                    • SHA256 18330aea67a62076fa649face40e05b1809b3dc58fc090b15946a07f5128477a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    config.ini.lock
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\config\config.ini.lock
                                                    • Size 20B
                                                    • SHA256 c2123d84f13a4d25e4d23ec937c47acb5277646ec3cc835d8825268085ae5a92
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    version.ini
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\config\version.ini
                                                    • Size 126B
                                                    • SHA256 4649b1434e59cac858af084c350b2055e7d4c4a2e778dc9df0b3fe43ecc3ca65
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    libcurl.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\libcurl.dll
                                                    • Size 256KB
                                                    • SHA256 9a274288b17d64a402789b4114cb49bc7346bcc2202ec6f3e3d828b82c6eed16
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libeay32.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\libeay32.dll
                                                    • Size 1.6MB
                                                    • SHA256 a966097f9592271d6beb53b65d938efe522c874ac47b56b67eddd2a672975d88
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    msvcp120.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\msvcp120.dll
                                                    • Size 644KB
                                                    • SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    msvcr120.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\msvcr120.dll
                                                    • Size 940KB
                                                    • SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qminimal.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\platforms\qminimal.dll
                                                    • Size 32KB
                                                    • SHA256 09f119db0ecdc5e653e014b862b0f451584d77a2befc1530cb63c5cb70d30051
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qminimald.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\platforms\qminimald.dll
                                                    • Size 92KB
                                                    • SHA256 769941973e8216c0fd79b24e95497a665afbee3b0f16dd7582f4f10509b1a411
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qoffscreen.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\platforms\qoffscreen.dll
                                                    • Size 632KB
                                                    • SHA256 c1e4b38e53f362e5f3c53b8ffb98832f13ff10ad9c1299524bec4bccbc08d709
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    qoffscreend.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\platforms\qoffscreend.dll
                                                    • Size 1.2MB
                                                    • SHA256 978b07287c0753c2657d72065a35261353833973e93e4b30d10513fd92c1be86
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ssleay32.dll
                                                    • Path C:\Program Files\EaseUS\EaseUS Data Recovery Wizard\ssleay32.dll
                                                    • Size 345KB
                                                    • SHA256 b0eb1fe0964d5f8ba57fefa47bd6f175129bc811d026a33a7ab726c76d946cb1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 bc826aaa75d7da810bfdc30a1671df54c18887a7ddc779d5b9f03835587852b4
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 ed455462339f617c2ca56fdcb412c55e19895a6b807c5c9977355fe9a3083132
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    BookmarkMergedSurfaceOrdering
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                    • Size 6B
                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    BrowsingTopicsState
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                    • Size 649B
                                                    • SHA256 8ae1815a5dfb7bde7f18a3c5b3f42059e9a7129b9e22bb6db36a0c0edc622464
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                    • Size 3KB
                                                    • SHA256 3925b846fd917740d3c200935a98d64c090d3c65ae59043e7ed69928c262c122
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    the-real-index~RFe59f052.TMP
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f052.TMP
                                                    • Size 3KB
                                                    • SHA256 5ec65877720511399174ade1d80cdce19de2f3848d59d19c334e428fef9357a5
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    data_1
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                    • Size 264KB
                                                    • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    SiteList-Enterprise.json
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                    • Size 2B
                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Network Persistent State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                    • Size 4KB
                                                    • SHA256 490641ff1077ac3df232eca42ccab76d19b23a1fdc21981adf60743cc38eb494
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SCT Auditing Pending Reports
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                    • Size 2B
                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Sdch Dictionaries
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                    • Size 40B
                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 12KB
                                                    • SHA256 40c5bff1693713870cd8309c9b35b325140b2047e942d8f943c15b5c33304eed
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 14KB
                                                    • SHA256 995319d45eed378f04bd0755d99b97fe6c1b0f79a36457ec9077ed9db0df1d0f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 14KB
                                                    • SHA256 8a1204c6736b0d53a8643f0a18199ba250004600b7633c0814a791b2ca454355
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 12KB
                                                    • SHA256 6fb64521c020f76914841b0f822e4d6285d7bc68cc488097bbbb3ab4285ac570
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 14KB
                                                    • SHA256 b027f340bf8d45478e70dea266f3ca0ebbe38ae94aeff25d693457875d40039f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Secure Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                    • Size 32KB
                                                    • SHA256 4c11653f5e25933d6f6943222c3b00b1c7f2d878062033659f40d6fd7657202b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sync_diagnostic.log
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                    • Size 24KB
                                                    • SHA256 24c2fbefc812e77d98d4cdc719bcc75e9e21be061dc08b20e4328e5b249c4d1f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 25KB
                                                    • SHA256 d07fae03675184bf92372c8032bf476c55f5ff447c0fa55af7b2e3705683bdb9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 25KB
                                                    • SHA256 fde1917c9121e50a20f7d1f923cc66b84dcabf9ee18dc820539d6241123a2651
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 31KB
                                                    • SHA256 e59b5fbd232dc3335381497152275627dedeafa5f0c6bd126f18f4d3b39073f8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 27KB
                                                    • SHA256 2aa7a741012c9b39dc793f4f49f16e38cc1b8f2227e7a673c772da3cc1458b96
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                    • Size 2KB
                                                    • SHA256 7e85587341a0c799b4bdef550b8af46186e7ab1eff7d4104b8e5da81a992294b
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    __PSScriptPolicyTest_3lclbpqn.kda.ps1
                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3lclbpqn.kda.ps1
                                                    • Size 60B
                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DRW14.0_Trial.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-0CBB6.tmp\DRW14.0_Trial.tmp
                                                    • Size 1.2MB
                                                    • SHA256 7ad0f906750160eebeb6b310fe9f72e646a12886b5d6a15d1333b6e231c9a7fc
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    AliyunConfig.ini
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\AliyunConfig.ini
                                                    • Size 1KB
                                                    • SHA256 afa3f22bbaf95db7065c7658902579eb0a995611fa60a9c75f33a896b03b8cdf
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    AliyunWrap.DLL
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\AliyunWrap.DLL
                                                    • Size 493KB
                                                    • SHA256 8da0ff79fae2725cb1587d60e5d7f4a234fe5736727468aa2a4055bc75222367
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    AliyunWrapExe.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\AliyunWrapExe.exe
                                                    • Size 115KB
                                                    • SHA256 f5585d4c9f9893745ab0098ad653f32e246612dff12a2378d0e6c8e3ac362c6f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\DataFile.ini
                                                    • Size 560B
                                                    • SHA256 2661fade3c41551972a30ab6207f2bce847f8eb2a90fc3da8f0f58c43190e2db
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\DataFile.ini
                                                    • Size 598B
                                                    • SHA256 858a9657a69e63ec798f5020e85017eac5614cb6b4a4ce1a7b3c241eb93fc1b3
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\DataFile.ini
                                                    • Size 434B
                                                    • SHA256 807ac1b2bf774fa4fdaeaea6044dbe1744715952508b43256389138c8e87698c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\DataFile.ini
                                                    • Size 636B
                                                    • SHA256 a17ff424f04cb1fd551878e0da201d7b04af2a80d4fe6b26579b1986abb299c2
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\DataFile.ini
                                                    • Size 84B
                                                    • SHA256 7cc1ace189105e49f37b44da6e2e3c68e5cb0a09b0983ff22c9deff1b27aa19f
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\DataFile.ini
                                                    • Size 336B
                                                    • SHA256 deab374c0aea170e13cecdff0e0f88748d711935d79ed9e530e815ac0ac18d69
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DataFile.ini
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\DataFile.ini
                                                    • Size 362B
                                                    • SHA256 bf79f01dcfdd59c96d7cb442e8cdd7ac4e1691edcb5bf0aca75ef4ffe22dcbd0
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    InfoForSetup.exe
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\InfoForSetup.exe
                                                    • Size 63KB
                                                    • SHA256 cbb2b0741adf6ed7d9720d6727ef014be9f2007fea7ffb7b1ce2cad45796511d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    tempInfo.web
                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-49OGK.tmp\tempInfo.web
                                                    • Size 1B
                                                    • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    memory/2840-5063-0x0000020F848E0000-0x0000020F858E0000-memory.dmp
                                                    Download

                                                    memory/2936-4868-0x000000005E830000-0x000000005ED79000-memory.dmp
                                                    Download

                                                    memory/2936-4874-0x00007FF6B7130000-0x00007FF6B7AE0000-memory.dmp
                                                    Download

                                                    memory/2936-4871-0x00000000011F0000-0x00000000011F8000-memory.dmp
                                                    Download

                                                    memory/2936-4872-0x00007FF6B7130000-0x00007FF6B7AE0000-memory.dmp
                                                    Download

                                                    memory/2936-4873-0x000000005E830000-0x000000005ED79000-memory.dmp
                                                    Download

                                                    memory/2936-4869-0x0000000001180000-0x00000000011DA000-memory.dmp
                                                    Download

                                                    memory/4760-4087-0x0000000001680000-0x00000000016DA000-memory.dmp
                                                    Download

                                                    memory/4760-4085-0x000000005E830000-0x000000005ED79000-memory.dmp
                                                    Download

                                                    memory/4760-4091-0x00007FF6B7130000-0x00007FF6B7AE0000-memory.dmp
                                                    Download

                                                    memory/4760-4090-0x00000000016F0000-0x00000000016F8000-memory.dmp
                                                    Download

                                                    memory/4980-0-0x0000000000400000-0x0000000000439000-memory.dmp
                                                    Download

                                                    memory/4980-56-0x0000000000400000-0x0000000000439000-memory.dmp
                                                    Download

                                                    memory/4980-4198-0x0000000000400000-0x0000000000439000-memory.dmp
                                                    Download

                                                    memory/5580-4848-0x000001F0420B0000-0x000001F0420D2000-memory.dmp
                                                    Download

                                                    memory/5580-4865-0x000001F05AA60000-0x000001F05AA84000-memory.dmp
                                                    Download

                                                    memory/5580-4864-0x000001F05AA60000-0x000001F05AA8A000-memory.dmp
                                                    Download

                                                    memory/5648-3505-0x0000000000400000-0x000000000053E000-memory.dmp
                                                    Download

                                                    memory/5648-57-0x0000000000400000-0x000000000053E000-memory.dmp
                                                    Download

                                                    memory/5648-123-0x0000000000400000-0x000000000053E000-memory.dmp
                                                    Download

                                                    memory/5648-4042-0x0000000000400000-0x000000000053E000-memory.dmp
                                                    Download

                                                    memory/5648-5-0x0000000000640000-0x0000000000641000-memory.dmp
                                                    Download

                                                    memory/5648-4184-0x0000000000400000-0x000000000053E000-memory.dmp
                                                    Download

                                                    memory/5648-58-0x0000000000640000-0x0000000000641000-memory.dmp
                                                    Download

                                                    memory/6028-4593-0x0000022080000000-0x0000022081000000-memory.dmp
                                                    Download