General Info

File name

epm.exe.malware

Full analysis
https://app.any.run/tasks/9689c938-e471-43a8-a047-4b76ef4ccca3
Verdict
Malicious activity
Analysis date
11/8/2018, 15:37:23
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:

installer

adware

installcore

pup

Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386, for MS Windows
MD5

2604e3d6f11ce5d77e3ff6373a431a00

SHA1

36f0f30412ac9b9d2109962c0105c8a21ac020c3

SHA256

e11f754d7722d2aeb155466ab9ccf216007096f18e9b6c3a81e980f795064ba0

SSDEEP

49152:SaZF8oh458aTnPwFeHjtwVjPOJ2a+5lz5oCJHN3+FnxJL:/v8om5RQVTJael1R910nnL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
180 seconds
Additional time used
120 seconds
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (68.0.3440.106)
  • Google Update Helper (1.3.33.17)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Application was dropped or rewritten from another process
  • TrayTipConfig.exe (PID: 360)
  • TrayTipConfig.exe (PID: 608)
  • EuDownload.exe (PID: 3084)
  • EuDownload.exe (PID: 4080)
  • uexperice.exe (PID: 2812)
  • EuDownload.exe (PID: 2644)
  • epm0.exe (PID: 3436)
  • TrayTipConfig.exe (PID: 3548)
  • Main.exe (PID: 3752)
  • EuDownload.exe (PID: 2576)
  • Main.exe (PID: 3956)
  • TrayTipConfig.exe (PID: 1984)
  • EuDownload.exe (PID: 2404)
  • epm0.exe (PID: 292)
  • TrayTipAgentE.exe (PID: 3596)
  • uexperice.exe (PID: 1688)
  • uexperice.exe (PID: 3188)
  • setupempdrv03.exe (PID: 2648)
  • uexperice.exe (PID: 4044)
  • uexperice.exe (PID: 2232)
  • uexperice.exe (PID: 2568)
Loads dropped or rewritten executable
  • TrayTipConfig.exe (PID: 1984)
  • Main.exe (PID: 3752)
  • epm0.exe (PID: 292)
  • epm0.exe (PID: 3436)
  • uexperice.exe (PID: 2812)
  • TrayTipAgentE.exe (PID: 3596)
  • TrayTipConfig.exe (PID: 360)
  • TrayTipConfig.exe (PID: 3548)
  • Main.exe (PID: 3956)
  • uexperice.exe (PID: 1688)
  • uexperice.exe (PID: 3188)
  • uexperice.exe (PID: 4044)
  • uexperice.exe (PID: 2232)
  • uexperice.exe (PID: 2568)
Changes settings of System certificates
  • Main.exe (PID: 3752)
Changes the autorun value in the registry
  • TrayTipAgentE.exe (PID: 3596)
INSTALLCORE was detected
  • epm.exe.malware.exe (PID: 1320)
Connects to CnC server
  • epm.exe.malware.exe (PID: 1320)
Creates files in the program directory
  • Main.exe (PID: 3752)
  • TrayTipConfig.exe (PID: 608)
  • uexperice.exe (PID: 2812)
  • EuDownload.exe (PID: 3084)
  • TrayTipConfig.exe (PID: 360)
  • uexperice.exe (PID: 3188)
  • epm.exe.malware.exe (PID: 1320)
Adds / modifies Windows certificates
  • Main.exe (PID: 3752)
Low-level read access rights to disk partition
  • vds.exe (PID: 1744)
  • Main.exe (PID: 3752)
  • vds.exe (PID: 3848)
Application launched itself
  • cmd.exe (PID: 2008)
  • epm.exe.malware.exe (PID: 3912)
  • cmd.exe (PID: 3628)
Starts CMD.EXE for commands execution
  • cmd.exe (PID: 2008)
  • cmd.exe (PID: 3628)
  • epm.exe.malware.exe (PID: 1320)
Executable content was dropped or overwritten
  • epm.exe.malware.exe (PID: 1320)
  • SETUP.exe (PID: 2316)
  • SETUP.tmp (PID: 128)
Reads Environment values
  • epm.exe.malware.exe (PID: 1320)
Creates or modifies windows services
  • setupempdrv03.exe (PID: 2648)
Changes IE settings (feature browser emulation)
  • SETUP.tmp (PID: 128)
Reads Windows owner or organization settings
  • SETUP.tmp (PID: 128)
Reads Windows Product ID
  • epm.exe.malware.exe (PID: 1320)
Reads the Windows organization settings
  • SETUP.tmp (PID: 128)
Reads CPU info
  • epm.exe.malware.exe (PID: 1320)
Reads internet explorer settings
  • epm.exe.malware.exe (PID: 1320)
Creates files in the driver directory
  • SETUP.tmp (PID: 128)
Creates files in the user directory
  • SETUP.tmp (PID: 128)
Reads the machine GUID from the registry
  • epm.exe.malware.exe (PID: 1320)
Creates files in the Windows directory
  • SETUP.tmp (PID: 128)
Loads dropped or rewritten executable
  • SETUP.tmp (PID: 128)
Creates a software uninstall entry
  • SETUP.tmp (PID: 128)
Dropped object may contain Bitcoin addresses
  • SETUP.tmp (PID: 128)
Application was dropped or rewritten from another process
  • SETUP.tmp (PID: 128)
Creates files in the program directory
  • SETUP.tmp (PID: 128)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Inno Setup installer (81.5%)
.exe
|   Win32 Executable Delphi generic (10.5%)
.exe
|   Win32 Executable (generic) (3.3%)
.exe
|   Win16/32 Executable Delphi generic (1.5%)
.exe
|   Generic Win/DOS Executable (1.4%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
1992:06:20 00:22:17+02:00
PEType:
PE32
LinkerVersion:
2.25
CodeSize:
40448
InitializedDataSize:
25600
UninitializedDataSize:
null
EntryPoint:
0xa5f8
OSVersion:
1
ImageVersion:
6
SubsystemVersion:
4
Subsystem:
Windows GUI
FileVersionNumber:
0.0.0.0
ProductVersionNumber:
0.0.0.0
FileFlagsMask:
0x003f
FileFlags:
(none)
FileOS:
Win32
ObjectFileType:
Executable application
FileSubtype:
null
LanguageCode:
Neutral
CharacterSet:
Unicode
Comments:
This installation was built with Inno Setup.
CompanyName:
FileDescription:
Hetoh Setup
FileVersion:
LegalCopyright:
ProductName:
Hetoh
ProductVersion:
1.8
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
19-Jun-1992 22:22:17
Detected languages
English - United States
Comments:
This installation was built with Inno Setup.
CompanyName:
null
FileDescription:
Hetoh Setup
FileVersion:
null
LegalCopyright:
null
ProductName:
Hetoh
ProductVersion:
1.8
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0050
Pages in file:
0x0002
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x000F
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x001A
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x00000100
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
8
Time date stamp:
19-Jun-1992 22:22:17
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
CODE 0x00001000 0x00009D30 0x00009E00 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 6.6048
DATA 0x0000B000 0x00000250 0x00000400 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 2.75472
BSS 0x0000C000 0x00000E90 0x00000000 IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0
.idata 0x0000D000 0x00000950 0x00000A00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 4.43073
.tls 0x0000E000 0x00000008 0x00000000 IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 0
.rdata 0x0000F000 0x00000018 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_SHARED 0.204488
.reloc 0x00010000 0x000008C4 0x00000000 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_SHARED 0
.rsrc 0x00011000 0x000053F4 0x00005400 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_SHARED 5.42502
Resources
1

2

3

4089

4090

4091

4093

4094

4095

11111

MAINICON

Imports
    kernel32.dll

    user32.dll

    oleaut32.dll

    advapi32.dll

    comctl32.dll

Exports

    No exports.

Screenshots

Processes

Total processes
91
Monitored processes
36
Malicious processes
11
Suspicious processes
7

Behavior graph

+
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start epm.exe.malware.exe no specs #INSTALLCORE epm.exe.malware.exe cmd.exe no specs timeout.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs setup.exe setup.tmp setupempdrv03.exe no specs uexperice.exe no specs uexperice.exe no specs uexperice.exe no specs uexperice.exe no specs uexperice.exe no specs uexperice.exe traytipconfig.exe no specs traytipconfig.exe no specs traytipagente.exe epm0.exe no specs main.exe traytipconfig.exe no specs eudownload.exe vdsldr.exe no specs vds.exe no specs eudownload.exe epm0.exe no specs main.exe no specs traytipconfig.exe no specs eudownload.exe eudownload.exe vds.exe no specs eudownload.exe cmd.exe no specs timeout.exe no specs cmd.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
3912
CMD
"C:\Users\admin\AppData\Local\Temp\epm.exe.malware.exe"
Path
C:\Users\admin\AppData\Local\Temp\epm.exe.malware.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Hetoh Setup
Version
Modules
Image
c:\users\admin\appdata\local\temp\epm.exe.malware.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shell32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\version.dll
c:\windows\system32\olepro32.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\propsys.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\sspicli.dll

PID
1320
CMD
"C:\Users\admin\AppData\Local\Temp\epm.exe.malware.exe" /RSF /ppn:YyhwYgxaFRAiP211FM5W /mnl
Path
C:\Users\admin\AppData\Local\Temp\epm.exe.malware.exe
Indicators
Parent process
epm.exe.malware.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Hetoh Setup
Version
Modules
Image
c:\users\admin\appdata\local\temp\epm.exe.malware.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shell32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\version.dll
c:\windows\system32\olepro32.dll
c:\windows\system32\cryptbase.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\sxs.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\winsta.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\mlang.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\msimtf.dll
c:\windows\system32\jscript.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\imgutil.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\pngfilt.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\shdocvw.dll
c:\users\admin\appdata\local\temp\in2c8a3b3e\09367de5_stp\setup.exe

PID
3628
CMD
/d /c TIMEOUT 1 & cmd /d /c copy /B /Y "C:\Users\admin\AppData\Local\Temp\D48420095553501.dat"+"C:\Users\admin\AppData\Local\Temp\D48420095553502.dat" "C:\Users\admin\AppData\Local\Temp\in2C8A3B3E\09367DE5_stp\SETUP.exe" & cmd /d /c del "C:\Users\admin\AppData\Local\Temp\D48420095553501.dat" & cmd /d /c del "C:\Users\admin\AppData\Local\Temp\D48420095553502.dat"
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
epm.exe.malware.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\timeout.exe

PID
3744
CMD
TIMEOUT 1
Path
C:\Windows\system32\timeout.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
timeout - pauses command processing
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\timeout.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
3768
CMD
cmd /d /c copy /B /Y "C:\Users\admin\AppData\Local\Temp\D48420095553501.dat"+"C:\Users\admin\AppData\Local\Temp\D48420095553502.dat" "C:\Users\admin\AppData\Local\Temp\in2C8A3B3E\09367DE5_stp\SETUP.exe"
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
2548
CMD
cmd /d /c del "C:\Users\admin\AppData\Local\Temp\D48420095553501.dat"
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
4000
CMD
cmd /d /c del "C:\Users\admin\AppData\Local\Temp\D48420095553502.dat"
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
2316
CMD
"C:\Users\admin\AppData\Local\Temp\in2C8A3B3E\09367DE5_stp\SETUP.exe" /SP- /VERYSILENT /LANG=English
Path
C:\Users\admin\AppData\Local\Temp\in2C8A3B3E\09367DE5_stp\SETUP.exe
Indicators
Parent process
epm.exe.malware.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
EaseUS
Description
EaseUS Partition Master Setup
Version
12.10
Modules
Image
c:\users\admin\appdata\local\temp\in2c8a3b3e\09367de5_stp\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\version.dll
c:\windows\system32\shell32.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\users\admin\appdata\local\temp\is-5l9s3.tmp\setup.tmp

PID
128
CMD
"C:\Users\admin\AppData\Local\Temp\is-5L9S3.tmp\SETUP.tmp" /SL5="$C05C2,37452199,119296,C:\Users\admin\AppData\Local\Temp\in2C8A3B3E\09367DE5_stp\SETUP.exe" /SP- /VERYSILENT /LANG=English
Path
C:\Users\admin\AppData\Local\Temp\is-5L9S3.tmp\SETUP.tmp
Indicators
Parent process
SETUP.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Setup/Uninstall
Version
51.1052.0.0
Modules
Image
c:\users\admin\appdata\local\temp\is-5l9s3.tmp\setup.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\version.dll
c:\windows\system32\mpr.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\profapi.dll
c:\users\admin\appdata\local\temp\is-r7n71.tmp\_isetup\_shfoldr.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\rstrtmgr.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\bcryptprimitives.dll
c:\users\admin\appdata\local\temp\is-r7n71.tmp\euactiveonline.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\imageres.dll
c:\windows\system32\clbcatq.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\windows\system32\msftedit.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\program files\easeus\easeus partition master 12.10\bin\epm0.exe
c:\program files\easeus\easeus partition master 12.10\bin\cleanupui.exe
c:\program files\easeus\easeus partition master 12.10\unins000.exe
c:\windows\system32\apphelp.dll
c:\windows\system32\setupempdrv03.exe
c:\program files\easeus\easeus partition master 12.10\bin\uexperice.exe
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\traytipconfig.exe
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\traytipagente.exe
c:\windows\system32\netutils.dll

PID
2648
CMD
"C:\Windows\system32\setupempdrv03.exe"
Path
C:\Windows\system32\setupempdrv03.exe
Indicators
No indicators
Parent process
SETUP.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\windows\system32\setupempdrv03.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\winmm.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msacm32.dll
c:\windows\system32\version.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\mpr.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
3188
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe" -t 20483 "12.10"
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe
Indicators
No indicators
Parent process
SETUP.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\uexperice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\easeus\easeus partition master 12.10\bin\uexper.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll

PID
2232
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe" -t 20484 63
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe
Indicators
No indicators
Parent process
SETUP.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\uexperice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\easeus\easeus partition master 12.10\bin\uexper.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll

PID
4044
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe" -t 20485 "1033"
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe
Indicators
No indicators
Parent process
SETUP.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\uexperice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\easeus\easeus partition master 12.10\bin\uexper.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll

PID
2568
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe" -t 20486 "English"
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe
Indicators
No indicators
Parent process
SETUP.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\uexperice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\easeus\easeus partition master 12.10\bin\uexper.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll

PID
1688
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe" -t 20487 "EPM_1_05"
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe
Indicators
No indicators
Parent process
SETUP.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\uexperice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\easeus\easeus partition master 12.10\bin\uexper.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll

PID
2812
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe" -i 1
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe
Indicators
Parent process
SETUP.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\uexperice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\easeus\easeus partition master 12.10\bin\uexper.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll

PID
608
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipConfig.exe" Tray pid=1 edition=13
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipConfig.exe
Indicators
No indicators
Parent process
SETUP.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\traytipconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll

PID
360
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipConfig.exe" AppParams 1 InstallTime
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipConfig.exe
Indicators
No indicators
Parent process
SETUP.tmp
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\traytipconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\appparams.dll

PID
3596
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipAgentE.exe" begin
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipAgentE.exe
Indicators
Parent process
SETUP.tmp
User
admin
Integrity Level
HIGH
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\traytipagente.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\uexper.dll
c:\windows\system32\ole32.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\cryptbase.dll
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\traynet.dll
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\libcurl.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winmm.dll
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\zlib1.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\rasadhlp.dll

PID
292
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\epm0.exe"
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\epm0.exe
Indicators
No indicators
Parent process
SETUP.tmp
User
admin
Integrity Level
HIGH
Version:
Company
EaseUS
Description
EaseUS Partition Master Loader Application
Version
10.8.0.0
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\epm0.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\easeus\easeus partition master 12.10\bin\eulicensedll.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\apphelp.dll
c:\program files\easeus\easeus partition master 12.10\bin\main.exe

PID
3752
CMD
Main.exe
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Main.exe
Indicators
Parent process
epm0.exe
User
admin
Integrity Level
HIGH
Version:
Company
CHENGDU YIWO Tech Development Co., Ltd
Description
EaseUS Partition Master Main Application
Version
10, 8, 0, 0
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\main.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\program files\easeus\easeus partition master 12.10\bin\libcairo-2.dll
c:\program files\easeus\easeus partition master 12.10\bin\libfontconfig-1.dll
c:\program files\easeus\easeus partition master 12.10\bin\libexpat-1.dll
c:\program files\easeus\easeus partition master 12.10\bin\freetype6.dll
c:\program files\easeus\easeus partition master 12.10\bin\libpng14-14.dll
c:\program files\easeus\easeus partition master 12.10\bin\zlib1.dll
c:\windows\system32\msimg32.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgdk_pixbuf-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgio-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libglib-2.0-0.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgmodule-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgobject-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgthread-2.0-0.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgdk-win32-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libpango-1.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libpangocairo-1.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libpangoft2-1.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libpangowin32-1.0-0.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgtk-win32-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libatk-1.0-0.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\winspool.drv
c:\program files\easeus\easeus partition master 12.10\bin\libintl.dll
c:\program files\easeus\easeus partition master 12.10\bin\log.mo
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\program files\easeus\easeus partition master 12.10\bin\fatlib.mo
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcp80.dll
c:\program files\easeus\easeus partition master 12.10\bin\ntfslib.mo
c:\program files\easeus\easeus partition master 12.10\bin\fixup.mo
c:\program files\easeus\easeus partition master 12.10\bin\ntfscopy.mo
c:\program files\easeus\easeus partition master 12.10\bin\callbackoperator.mo
c:\program files\easeus\easeus partition master 12.10\bin\ntfsutil.mo
c:\program files\easeus\easeus partition master 12.10\bin\reglib.mo
c:\program files\easeus\easeus partition master 12.10\bin\mergepartition.mo
c:\program files\easeus\easeus partition master 12.10\bin\ntfsresizemove.mo
c:\program files\easeus\easeus partition master 12.10\bin\resizentfs.mo
c:\program files\easeus\easeus partition master 12.10\bin\deviceadapter.mo
c:\program files\easeus\easeus partition master 12.10\bin\licensemgr.dll
c:\windows\system32\oleaut32.dll
c:\program files\easeus\easeus partition master 12.10\bin\partition.mo
c:\program files\easeus\easeus partition master 12.10\bin\extresizemove.mo
c:\windows\system32\version.dll
c:\windows\system32\psapi.dll
c:\program files\easeus\easeus partition master 12.10\bin\appcenter.dll
c:\windows\system32\msi.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\profapi.dll
c:\program files\easeus\easeus partition master 12.10\bin\thread.mo
c:\program files\easeus\easeus partition master 12.10\bin\devicemanager.mo
c:\windows\system32\cryptbase.dll
c:\program files\easeus\easeus partition master 12.10\bin\intl.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\propsys.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\program files\easeus\easeus partition master 12.10\bin\buynow.dll
c:\windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4c\mfc90u.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\dwmapi.dll
c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_49768ef57548175e\mfc90enu.dll
c:\program files\easeus\easeus partition master 12.10\bin\eulicensedll.dll
c:\program files\easeus\easeus partition master 12.10\bin\euactiveonline.dll
c:\program files\easeus\easeus partition master 12.10\bin\updateinfo.dll
c:\program files\easeus\easeus partition master 12.10\bin\eudownload.dll
c:\program files\easeus\easeus partition master 12.10\bin\eudownload.exe
c:\program files\easeus\easeus partition master 12.10\lib\gtk-2.0\2.10.0\engines\libepmtheme.dll
c:\windows\system32\windowscodecs.dll
c:\program files\easeus\easeus partition master 12.10\bin\ldmmanager.mo
c:\program files\easeus\easeus partition master 12.10\bin\device.mo
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\program files\easeus\easeus partition master 12.10\bin\fsclog.dll
c:\windows\system32\vds_ps.dll
c:\program files\easeus\easeus partition master 12.10\bin\adds\xsssdk.dll
c:\program files\easeus\easeus partition master 12.10\bin\adds\tbexportsdk.dll
c:\program files\easeus\easeus partition master 12.10\bin\filesystemanalyser.mo
c:\program files\easeus\easeus partition master 12.10\bin\fatfilesystemanalyser.mo
c:\program files\easeus\easeus partition master 12.10\bin\common.mo
c:\program files\easeus\easeus partition master 12.10\bin\ntfsfilesystemanalyser.mo
c:\program files\easeus\easeus partition master 12.10\bin\extfilesystemanalyser.mo
c:\program files\easeus\easeus partition master 12.10\bin\uexper.dll
c:\program files\easeus\easeus partition master 12.10\bin\autoupdate.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\userenv.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\schannel.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\credssp.dll
c:\windows\system32\secur32.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\p2pcollab.dll
c:\windows\system32\qagentrt.dll
c:\windows\system32\fveui.dll
c:\program files\easeus\easeus partition master 12.10\bin\filesystem.mo

PID
3548
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipConfig.exe" AppParams 1 StartTime
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipConfig.exe
Indicators
No indicators
Parent process
Main.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\traytipconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\appparams.dll

PID
2644
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.exe" http://www.easeus.com/update/epm/innerbuy/epm_Plug_OB.ini "C:\Users\admin\AppData\Local\Temp\euphtupdate.ini" 0 "" 1 2108
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.exe
Indicators
Parent process
Main.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\eudownload.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll

PID
3200
CMD
C:\Windows\System32\vdsldr.exe -Embedding
Path
C:\Windows\System32\vdsldr.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
HIGH
Version:
Company
Microsoft Corporation
Description
Virtual Disk Service Loader
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\vdsldr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\vdsutil.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\vds_ps.dll

PID
3848
CMD
C:\Windows\System32\vds.exe
Path
C:\Windows\System32\vds.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Virtual Disk Service
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\vds.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\osuninst.dll
c:\windows\system32\vdsutil.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uexfat.dll
c:\windows\system32\ulib.dll
c:\windows\system32\ifsutil.dll
c:\windows\system32\uudf.dll
c:\windows\system32\untfs.dll
c:\windows\system32\ufat.dll
c:\windows\system32\fmifs.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\vds_ps.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\vdsdyn.dll
c:\windows\system32\vdsbas.dll
c:\windows\system32\vdsvd.dll
c:\windows\system32\virtdisk.dll
c:\windows\system32\fltlib.dll
c:\windows\system32\hbaapi.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\system32\iscsidsc.dll
c:\windows\system32\iscsium.dll
c:\windows\system32\fveapi.dll
c:\windows\system32\tbs.dll
c:\windows\system32\fvecerts.dll
c:\windows\system32\logoncli.dll

PID
4080
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.exe" http://www.easeus.com/update/epm/innerbuy/epm_Free_Plug_OB.zip "C:\Users\admin\AppData\Local\Temp\updateconfig.zip" 0 "" 1 2656
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.exe
Indicators
Parent process
Main.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\eudownload.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll

PID
3436
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\epm0.exe"
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\epm0.exe
Indicators
No indicators
Parent process
epm.exe.malware.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
EaseUS
Description
EaseUS Partition Master Loader Application
Version
10.8.0.0
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\epm0.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\easeus\easeus partition master 12.10\bin\eulicensedll.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\apphelp.dll

PID
3956
CMD
Main.exe
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Main.exe
Indicators
No indicators
Parent process
epm0.exe
User
admin
Integrity Level
HIGH
Exit code
3221225547
Version:
Company
CHENGDU YIWO Tech Development Co., Ltd
Description
EaseUS Partition Master Main Application
Version
10, 8, 0, 0
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\main.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\program files\easeus\easeus partition master 12.10\bin\libcairo-2.dll
c:\program files\easeus\easeus partition master 12.10\bin\libfontconfig-1.dll
c:\program files\easeus\easeus partition master 12.10\bin\libexpat-1.dll
c:\program files\easeus\easeus partition master 12.10\bin\freetype6.dll
c:\program files\easeus\easeus partition master 12.10\bin\libpng14-14.dll
c:\program files\easeus\easeus partition master 12.10\bin\zlib1.dll
c:\windows\system32\msimg32.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgdk_pixbuf-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgio-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libglib-2.0-0.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgmodule-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgobject-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgthread-2.0-0.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgdk-win32-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libpango-1.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libpangocairo-1.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libpangoft2-1.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libpangowin32-1.0-0.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\easeus\easeus partition master 12.10\bin\libgtk-win32-2.0-0.dll
c:\program files\easeus\easeus partition master 12.10\bin\libatk-1.0-0.dll
c:\windows\system32\comdlg32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\winspool.drv
c:\program files\easeus\easeus partition master 12.10\bin\libintl.dll
c:\program files\easeus\easeus partition master 12.10\bin\log.mo
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\program files\easeus\easeus partition master 12.10\bin\fatlib.mo
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcp80.dll
c:\program files\easeus\easeus partition master 12.10\bin\ntfslib.mo
c:\program files\easeus\easeus partition master 12.10\bin\fixup.mo
c:\program files\easeus\easeus partition master 12.10\bin\ntfscopy.mo
c:\program files\easeus\easeus partition master 12.10\bin\callbackoperator.mo
c:\program files\easeus\easeus partition master 12.10\bin\ntfsutil.mo
c:\program files\easeus\easeus partition master 12.10\bin\reglib.mo
c:\program files\easeus\easeus partition master 12.10\bin\mergepartition.mo
c:\program files\easeus\easeus partition master 12.10\bin\ntfsresizemove.mo
c:\program files\easeus\easeus partition master 12.10\bin\resizentfs.mo
c:\program files\easeus\easeus partition master 12.10\bin\deviceadapter.mo
c:\program files\easeus\easeus partition master 12.10\bin\licensemgr.dll
c:\windows\system32\oleaut32.dll
c:\program files\easeus\easeus partition master 12.10\bin\partition.mo
c:\program files\easeus\easeus partition master 12.10\bin\extresizemove.mo
c:\windows\system32\version.dll
c:\windows\system32\psapi.dll
c:\program files\easeus\easeus partition master 12.10\bin\appcenter.dll
c:\windows\system32\msi.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcp90.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\profapi.dll
c:\program files\easeus\easeus partition master 12.10\bin\thread.mo
c:\program files\easeus\easeus partition master 12.10\bin\devicemanager.mo
c:\windows\system32\cryptbase.dll
c:\program files\easeus\easeus partition master 12.10\bin\intl.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\propsys.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\program files\easeus\easeus partition master 12.10\bin\buynow.dll
c:\windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4c\mfc90u.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\dwmapi.dll
c:\windows\winsxs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_49768ef57548175e\mfc90enu.dll
c:\program files\easeus\easeus partition master 12.10\bin\eulicensedll.dll
c:\program files\easeus\easeus partition master 12.10\bin\euactiveonline.dll
c:\program files\easeus\easeus partition master 12.10\bin\updateinfo.dll
c:\program files\easeus\easeus partition master 12.10\bin\eudownload.dll
c:\program files\easeus\easeus partition master 12.10\lib\gtk-2.0\2.10.0\engines\libepmtheme.dll

PID
1984
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipConfig.exe" AppParams 1 StartTime
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipConfig.exe
Indicators
No indicators
Parent process
Main.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\traytipconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\appparams.dll

PID
2404
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.exe" http://www.easeus.com/update/epm/innerbuy/epm_Plug_OB.ini "C:\Users\admin\AppData\Local\Temp\euphtupdate.ini" 0 "" 1 3156
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.exe
Indicators
Parent process
Main.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\eudownload.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll

PID
2576
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.exe" http://www.easeus.com/update/epm/innerbuy/epm_Free_Plug_OB.zip "C:\Users\admin\AppData\Local\Temp\updateconfig.zip" 0 "" 1 2236
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.exe
Indicators
Parent process
Main.exe
User
admin
Integrity Level
HIGH
Exit code
6
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\eudownload.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll

PID
1744
CMD
C:\Windows\System32\vds.exe
Path
C:\Windows\System32\vds.exe
Indicators
No indicators
Parent process
––
User
SYSTEM
Integrity Level
SYSTEM
Version:
Company
Microsoft Corporation
Description
Virtual Disk Service
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\vds.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\osuninst.dll
c:\windows\system32\vdsutil.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\msctf.dll
c:\windows\system32\imm32.dll
c:\windows\system32\uexfat.dll
c:\windows\system32\ulib.dll
c:\windows\system32\ifsutil.dll
c:\windows\system32\uudf.dll
c:\windows\system32\untfs.dll
c:\windows\system32\ufat.dll
c:\windows\system32\fmifs.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\vds_ps.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\vdsdyn.dll
c:\windows\system32\vdsbas.dll
c:\windows\system32\vdsvd.dll
c:\windows\system32\virtdisk.dll
c:\windows\system32\fltlib.dll
c:\windows\system32\hbaapi.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\system32\iscsidsc.dll
c:\windows\system32\iscsium.dll
c:\windows\system32\fveapi.dll
c:\windows\system32\tbs.dll
c:\windows\system32\fvecerts.dll
c:\windows\system32\logoncli.dll

PID
3084
CMD
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.exe" http://www.easeus.com/update/epm/innerbuy/InnerBuy_Free_Plug_OB.ini "C:\Program Files\EaseUS\EaseUS Partition Master 12.10\InnerBuy\res\InnerBuyConfig.ini" 0 "" 1 1148
Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.exe
Indicators
Parent process
Main.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\eudownload.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll

PID
2008
CMD
/d /c TIMEOUT 3 & cmd /d /c del "C:\Users\admin\AppData\Local\Temp\EPMEXE~1.EXE"
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
epm.exe.malware.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID
844
CMD
TIMEOUT 3
Path
C:\Windows\system32\timeout.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
timeout - pauses command processing
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\timeout.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
3236
CMD
cmd /d /c del "C:\Users\admin\AppData\Local\Temp\EPMEXE~1.EXE"
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
HIGH
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\program files\easeus\easeus partition master 12.10\bin\traypopupe\traytipconfig.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll

Registry activity

Total events
1614
Read events
1494
Write events
119
Delete events
1

Modification events

PID
Process
Operation
Key
Name
Value
3912
epm.exe.malware.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3912
epm.exe.malware.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
1320
epm.exe.malware.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
1320
epm.exe.malware.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
1320
epm.exe.malware.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASAPI32
EnableFileTracing
0
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASAPI32
EnableConsoleTracing
0
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASAPI32
FileTracingMask
4294901760
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASAPI32
ConsoleTracingMask
4294901760
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASAPI32
MaxFileSize
1048576
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASAPI32
FileDirectory
%windir%\tracing
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASMANCS
EnableFileTracing
0
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASMANCS
EnableConsoleTracing
0
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASMANCS
FileTracingMask
4294901760
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASMANCS
ConsoleTracingMask
4294901760
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASMANCS
MaxFileSize
1048576
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\epm_RASMANCS
FileDirectory
%windir%\tracing
1320
epm.exe.malware.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
1320
epm.exe.malware.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
1320
epm.exe.malware.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter
52
128
SETUP.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Owner
800000007E46A1C27077D401
128
SETUP.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
SessionHash
6D7FCCB6921CD172825C8B309D18ADADCBD6FFF6D42B2EBDC753BA933FBEF7BC
128
SETUP.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Sequence
1
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\EaseUS\EPM
install_tmp
1
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\EaseUS\EPM
EPMInstallPath
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\
128
SETUP.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFiles0001
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\x64\Windows\System32\oledlg.dll
128
SETUP.tmp
write
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
RegFilesHash
C305A7492D91CD2223742B0D47E20A483AA9BB2A5946B56E291362B6E106DB57
128
SETUP.tmp
write
HKEY_CURRENT_USER\Software\EaseUS\EaseUS Partition Master\AutoUpdate
StartChk
1
128
SETUP.tmp
write
HKEY_CURRENT_USER\Software\EaseUS\EaseUS Partition Master\PopUp
StartChk
1
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\EaseUS\EPM
Language
English
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION
Main.exe
9999
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
Inno Setup: Setup Version
5.5.8 (u)
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
Inno Setup: App Path
C:\Program Files\EaseUS\EaseUS Partition Master 12.10
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
InstallLocation
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
Inno Setup: Icon Group
EaseUS Partition Master 12.10
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
Inno Setup: User
admin
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
Inno Setup: Selected Tasks
desktopicon,quicklaunchicon,uexpertask
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
Inno Setup: Deselected Tasks
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
Inno Setup: Language
English
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
DisplayName
EaseUS Partition Master 12.10
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
DisplayIcon
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\epm0.exe,0
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
UninstallString
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\unins000.exe"
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
QuietUninstallString
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\unins000.exe" /SILENT
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
Publisher
EaseUS
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
URLInfoAbout
https://www.easeus.com/support.htm
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
HelpLink
https://www.easeus.com/
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
URLUpdateInfo
https://www.easeus.com/
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
NoModify
1
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
NoRepair
1
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
InstallDate
20181108
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EaseUS Partition Master_is1
EstimatedSize
173867
128
SETUP.tmp
write
HKEY_CURRENT_USER\Software\EaseUS\EaseUS Partition Master\AutoUpdate
URL
https://update.easeus.com/update/epm/epm_update.ini
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\EaseUS\EPM\Version
Flag
58
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\EaseUS\EPM\Version
InstallVer
58
128
SETUP.tmp
write
HKEY_LOCAL_MACHINE\SOFTWARE\EaseUS\EPM\Version
OEM
Fusion
128
SETUP.tmp
delete key
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
2648
setupempdrv03.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EPMVolFlt
Type
1
2648
setupempdrv03.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EPMVolFlt
ErrorControl
1
2648
setupempdrv03.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EPMVolFlt
Start
0
2648
setupempdrv03.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EPMVolFlt
DisplayName
EPMVolFlt
2648
setupempdrv03.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EPMVolFlt
ImagePath
\SystemRoot\System32\drivers\EPMVolFlt.sys
2648
setupempdrv03.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EPMVolFlt
Group
PnP Filter
2648
setupempdrv03.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}
UpperFilters
EPMVolFlt
2648
setupempdrv03.exe
write
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}
UpperFilters
PartMgr
3596
TrayTipAgentE.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
EaseUS EPM Tray Agent
"C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipAgentE.exe"
3752
Main.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3752
Main.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3752
Main.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers
DisableAutoplay
1
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASAPI32
EnableFileTracing
0
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASAPI32
EnableConsoleTracing
0
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASAPI32
FileTracingMask
4294901760
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASAPI32
ConsoleTracingMask
4294901760
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASAPI32
MaxFileSize
1048576
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASAPI32
FileDirectory
%windir%\tracing
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASMANCS
EnableFileTracing
0
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASMANCS
EnableConsoleTracing
0
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASMANCS
FileTracingMask
4294901760
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASMANCS
ConsoleTracingMask
4294901760
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASMANCS
MaxFileSize
1048576
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Main_RASMANCS
FileDirectory
%windir%\tracing
3752
Main.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
3752
Main.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
460000006A000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
3752
Main.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\61\52C64B7E
LanguageList
en-US
3752
Main.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\61\52C64B7E
@%SystemRoot%\system32\p2pcollab.dll,-8042
Peer to Peer Trust
3752
Main.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\61\52C64B7E
@%SystemRoot%\system32\qagentrt.dll,-10
System Health Authentication
3752
Main.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\61\52C64B7E
@%SystemRoot%\system32\dnsapi.dll,-103
Domain Name System (DNS) Server Trust
3752
Main.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\61\52C64B7E
@%SystemRoot%\System32\fveui.dll,-843
BitLocker Drive Encryption
3752
Main.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\61\52C64B7E
@%SystemRoot%\System32\fveui.dll,-844
BitLocker Data Recovery Agent
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81
Blob
0F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE09000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030353000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C01400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB5748501D00000001000000100000005B3B67000EEB80022E42605B6B3B72400B000000010000000E000000740068006100770074006500000003000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B812000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68
3752
Main.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81
Blob
190000000100000010000000DC73F9B71E16D51D26527D32B11A6A3D03000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B810B000000010000000E00000074006800610077007400650000001D00000001000000100000005B3B67000EEB80022E42605B6B3B72401400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB57485053000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C009000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B060105050703030F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE2000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68
3956
Main.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3956
Main.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3956
Main.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers
DisableAutoplay
1
3956
Main.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers
DisableAutoplay
0

Files activity

Executable files
294
Suspicious files
22
Text files
832
Unknown types
35

Dropped files

PID
Process
Filename
Type
1320
epm.exe.malware.exe
C:\Users\admin\AppData\Local\Temp\D48420095553501.dat
executable
MD5: 11079b7900c237db41d527cb3b7cda53
SHA256: 32543a015dcff16ff492f43512e5294329ad072b4b868fb92508e35097990c64
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\mfc80.dll
executable
MD5: 9173f70af60c0a864eecdfb3342dc789
SHA256: c52fef7cc96a573d35ade1af0067ec4f0bd01291289eaffe814a5c257d22ebf8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libpangoft2-1.0-0.dll
executable
MD5: 82cc0bb22b6eee16d68ea86d8a4518c6
SHA256: 3f83d9227a0586525443c0431d490854002624b379719f8d6967e348d6c36008
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\mfc80u.dll
executable
MD5: 21ee912784a013dc44071ecc4f932388
SHA256: a52418bbb36e76beb042b2ee1201057b4740232c619fa477bd6922f69677fc18
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libpangocairo-1.0-0.dll
executable
MD5: f1926484ec4b1fdd47e73dc26fa82e8a
SHA256: 63b2b56a854075add9220ac502b9b6408f4945385e8f23780b105daa1c35a4a4
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libpangowin32-1.0-0.dll
executable
MD5: 826bbce67470808e37016c43b6ca343d
SHA256: 63266553bb52ac00806f88ce8ccdffa409552f3b7a12cda35e89854dd4815ce0
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libpango-1.0-0.dll
executable
MD5: f0dc3c677f7ac71415a5fca485ff2bb9
SHA256: 555c06735eec7cf2d2fcfb3c3a53f11a66b798d58396d1339dc658dcc619cf74
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\mfcm80u.dll
executable
MD5: 47acd0aea4a32ef2b446b01076c62d28
SHA256: 21090da489ab5c21860c95cd581528921a1a8e38852606601afdc6a322ce0222
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libintl.dll
executable
MD5: eb2d4c4d4a527bc88a69a16cc99afcf5
SHA256: 682d4277092472cac940558f9e679b44a6394159e49c9bbda299e33bfc6fdc92
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\msvcm80.dll
executable
MD5: 60a6de55aa50d57a01b7148b0a7ea139
SHA256: 2fa2a2a4a0511493c5a360e66c7d62f0ea5891925636eac61cd9db09dbed5637
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libgtk-win32-2.0-0.dll
executable
MD5: 254af1837d1da447a790f85f326afe54
SHA256: f97e8f33a3bf2ca4a9dd451466d3ec6333593e2dd4b55746c234284ff7c9a076
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libxml2-2.dll
executable
MD5: 6ec706e01fa5ef7a4e74526dd6ceea22
SHA256: 2162fd773dafbb41eb422418761eade228321ab0790040646028c5f4f867ee42
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\msvcp80.dll
executable
MD5: c332db81197e6e5d4a67d3789dbeb02a
SHA256: d3ed3fef0f3fd9d547d7ef60d5f532d6aab5bd45966abcb24bdf61dec60c813e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\LicenseMgr.dll
executable
MD5: 69e7a6e972ea362734bd24569235f6e5
SHA256: 701af9ba417e9383fe2843ace5388dd51c9ba3621ed99a1a278a29d311090d78
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libgthread-2.0-0.dll
executable
MD5: 17dc627f9486441cbd0c805957b4b6d6
SHA256: 73e699ffa1ac190850cd4ab96fcabd3ac647eab8f23d42cdeb36ac2a9a6bed4e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libpangowin32-1.0-0.dll
executable
MD5: 5afe3a001c4cf23bb4341725fc5644c0
SHA256: ccbbacf4e4a1a664185036b3bf0d6476703989ac145a59eb406d5df2676525e8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\msvcr80.dll
executable
MD5: 4d89f6191db56cfa659388378f3dd688
SHA256: 2219e15b66aba301909128e6775e0b4f8b28b529b3ec087161edae55e2676c65
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libpng14-14.dll
executable
MD5: f3a15497e25baaa721f96638d7a4d2f8
SHA256: 7644c698cb5c823b9fd238d9e88b25d14e04816a0a2c77c48170309957c69efd
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libgobject-2.0-0.dll
executable
MD5: 4841b329d2a3a855dd0dc806be1cd9e8
SHA256: 40511c71e75bf7b4bce19409043911af91372571ee2b1ddd50e5b1d424418da4
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libpng14-14.dll
executable
MD5: 3e00f7b9b98859f4650eb7a473485af9
SHA256: 51d8f1fdc57fc7e277104cc3ea1a4dc2573ad473829e525af22ee2fb0b0db9c5
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\ssleay32.dll
executable
MD5: d36f4039a2b1d77305e8e104ceb044f7
SHA256: 5baf7aefce57518d418d06d9160fdb0c650f836f410155a635aaa05ad9339c59
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Log.mo
executable
MD5: aeab47a373153c58a06b9b8aee21ebde
SHA256: 956fe0b13b070f6a6196f893b42fa25f1c179fca93de596e5ea6cf6ae0c2d747
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libgmodule-2.0-0.dll
executable
MD5: fe4a3f6ded7352e53c0947a82d0e9786
SHA256: 393dda811539a4a845ef544199c521e4d3cbfadd58708e3fad2997dae3cce542
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libpangoft2-1.0-0.dll
executable
MD5: 7360002ec4346643320c3ca577e9b9bf
SHA256: 2349f3ef178987c99215dc488aeb109e8dfbec1d62335e6d09f9c8fbde0968a6
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\zlib1.dll
executable
MD5: f8afe5b39bd512d26870a7a7d21b36ae
SHA256: a2ac91db618f4b7c7b25da854a3c06663fafe5f13eb3f57261e67d1d4a02f1af
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Main.exe
executable
MD5: 742ce215db630615fdc97429f638cb5e
SHA256: 8fc319b45c008abd10ae093245ef6e27e66e04b6e0aed98048e99f4a9c2fd920
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libglib-2.0-0.dll
executable
MD5: 221d264ce667e1d61a07134ce3b9fd83
SHA256: 997b9155902ed4c1d5206aa15cf4756f26694c796016882097e8da489e50d893
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libpangocairo-1.0-0.dll
executable
MD5: 055c444be08945547b454bf86f6e5d7b
SHA256: 6910f8aa60b6c414cfdee1466b0c0e158a9c29a6c04782004f4b3234a9ae43e8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\lib\gtk-2.0\2.10.0\engines\libepmtheme.dll
executable
MD5: 04d669823f8a315daa8575afd32e7a26
SHA256: 593f2ca725dfe2eb0e0cd1d6907cb03b3c77e8475b458c765755059e849c8648
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\MemGather.dll
executable
MD5: 91655c090baacf2fe9bf654356c1c389
SHA256: 096124fe99c843dbdf6e647d73d29bd28cc0ad37ab5fcf05996788754a1f126e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libgio-2.0-0.dll
executable
MD5: 5d1c26c12b2b83dfa25bfe93ca2db490
SHA256: 3ce5725a81e95a2853810a6c1eb93f5cbe56e49257051a3aa2cdd27779a3fabf
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libpango-1.0-0.dll
executable
MD5: 7fa55d38156d29623ebd1a883b8d0ad4
SHA256: 1744718edc35dbb2840084a470fce5e2ed79d811f016ab21f38d4c3a3f6c6916
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\lib\gtk-2.0\2.10.0\engines\libpixmap.dll
executable
MD5: 76dfd8463c5463deca64c842c1b151f8
SHA256: 20c773aa9f3f1a6a28d67c1303dce149d3cc68965d16fe1f276a76d46ee58db7
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\MergePartition.mo
executable
MD5: 41c3ceb235c20ad5be9ef096776b7940
SHA256: 68613eccc2bf1d028c26b46ad7e3c5b905caad0379a7782fe0be109ebae1ca0a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libgdk_pixbuf-2.0-0.dll
executable
MD5: cdc38a16d23d546f8921199f15bdf4d6
SHA256: 4411506abb2c35f74aa13a80d8183a4fe34dd280052003ff21f5e4bd61c53995
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libintl-8.dll
executable
MD5: fd27a9a2a0bbbf1f9a1779585da702b1
SHA256: 7cf5a705c825e082d8e7b57d113ebcba897a9421f465a7e43ad610b89a359b14
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\lib\gtk-2.0\2.10.0\engines\libwimp.dll
executable
MD5: 43fde93cf18bfd7fb589cec93d545a7e
SHA256: ed0059950268d9dbee7156a06223c767e8352a092ab03eb773c5f3b2daa123d4
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\mfc80.dll
executable
MD5: 1b7524806d0270b81360c63a2fa047cb
SHA256: ceef5aa7f9e6504bce15b72b29dbee6430370baa6a52f82cf4f2857568d11709
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libgdk-win32-2.0-0.dll
executable
MD5: bd8dd5c3c1e3b1e5d310868389b4acad
SHA256: abbdce0a10f16bf8ce9740c2e3e29fa48d250165a1168ff5d30d1cf2d44f6422
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libiconv-2.dll
executable
MD5: a885d3776b14b6ef7e24d0e04df69f86
SHA256: 954b8740a7cbe3728b136d4f36229c599d1f51534137b16e48e3d7ff9c468fdc
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\lib\gtk-2.0\2.10.0\engines\libuitheme.dll
executable
MD5: 4887d49fd15795571fd89141b5e8555a
SHA256: ffe9ca3f37119f28a7d294f865549cda6014dc000ac3330d95ce99c990609432
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\mfc80u.dll
executable
MD5: ccc2e312486ae6b80970211da472268b
SHA256: 18be5d3c656236b7e3cd6d619d62496fe3e7f66bf2859e460f8ac3d1a6bdaa9a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libgcc_s_dw2-1.dll
executable
MD5: 4f037115c873203ba48a9d5c6ce5f4a5
SHA256: 0c51bfc948ed711bbc17078e05595fcaf6c54b0b889bb2f0fc9ae53ce7c2e189
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libgtk-win32-2.0-0.dll
executable
MD5: a38ccb75cd90a92afb6ff0cd295bf9e8
SHA256: 48e46ae0d53a8235f178717330745cc85468b7ee2b99220d3428a652ff3fc399
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\lib\gtk-2.0\2.10.0\engines\msvcm80.dll
executable
MD5: 60a6de55aa50d57a01b7148b0a7ea139
SHA256: 2fa2a2a4a0511493c5a360e66c7d62f0ea5891925636eac61cd9db09dbed5637
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\mfcm90.dll
executable
MD5: d4e7c1546cf3131b7d84b39f8da9e321
SHA256: c4243ba85c2d130b4dec972cd291916e973d9d60fac5ceea63a01837ecc481c2
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libfontconfig-1.dll
executable
MD5: dd583bedc5efe7bbd21a8ef107dec88d
SHA256: 1c0a17ef42755d653d496dd7f52a4a2ca488b89ea1cf0df08f7fa32216f4c051
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libgthread-2.0-0.dll
executable
MD5: 518b659ed8b4caeed43d19d670a31625
SHA256: f49aabf9d780bcaae8f72870a2f2a6817e987efd115aaee6c9442d401ab4bb34
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\lib\gtk-2.0\2.10.0\engines\msvcp80.dll
executable
MD5: c332db81197e6e5d4a67d3789dbeb02a
SHA256: d3ed3fef0f3fd9d547d7ef60d5f532d6aab5bd45966abcb24bdf61dec60c813e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\mfcm90u.dll
executable
MD5: 371226b8346f29011137c7aa9e93f2f6
SHA256: 5b08fe55e4bbf2fbfd405e2477e023137cfceb4d115650a5668269c03300a8f8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libgailutil-18.dll
executable
MD5: 30e720a6235dc6da71c7e8a40be1c19f
SHA256: 8f34f358cf851cf4892e230ac0cfe60d3a97fc39ccea6d3967fff14b255d8369
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libgobject-2.0-0.dll
executable
MD5: 395ebbf84188133f61a2c57deba9f910
SHA256: 28ca3fe5392dce2e8c48b6157baa9da31f88ebb7103dc2ce7feeca7d5a3b17ca
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\lib\gtk-2.0\2.10.0\engines\msvcr80.dll
executable
MD5: 4d89f6191db56cfa659388378f3dd688
SHA256: 2219e15b66aba301909128e6775e0b4f8b28b529b3ec087161edae55e2676c65
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\mfcm80.dll
executable
MD5: c84e4ece0d210489738b2f0adb2723e8
SHA256: ed1dcdd98dac80716b2246d7760f0608c59e566424ac1a562090a3342c22b0a7
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libexpat-1.dll
executable
MD5: 701659d3689bf4a8265b669b7d774255
SHA256: f2e500f501c03d3d09609c6d0b2ea4c51bb433762d9c8f82ac6163877a780bc8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libgmodule-2.0-0.dll
executable
MD5: d6d2762dcabcf541ff98e92766bebca7
SHA256: 2043c628ce391ef5fec66f5e80698ebeed9eba7d6e130351b66694d4fa55a555
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\lib\gtk-2.0\modules\libgail.dll
executable
MD5: 32242e968b3b22f35e5612deeb5e13ac
SHA256: 9e32e7feb53f026f0bc0fc3162413acc9caecd7e66547d9946e58a37a5167b3e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\mfcm80u.dll
executable
MD5: ddad68e160c58d22b49ff039bb9b6751
SHA256: f3a65bfc7fce2d93fdf57cf88f083f690bc84b9a7706699d4098d18f79f87aaa
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libepmtheme.dll
executable
MD5: 2266a6f05c57046f8e47f928c2940a70
SHA256: 1b1b28383897da7ac246fdce7f5e26ab26796b5e122c98f16d68ac23c46aa3ab
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libglib-2.0-0.dll
executable
MD5: 873a04d10c64ebbba47f319a65a7ca57
SHA256: 0c3720b588874fc3c60f66b486c4172c4976c56b0b0f04908f730d7215c93400
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\x64\Windows\System32\epmntdrv.sys
executable
MD5: db6c3dbf15dcfe149e247b44fea6ad46
SHA256: 2ad4f0e20a48174c47d0b7e5f8ef152ed1299b8b67530da0648dad3e94e48f7c
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Mom.mo
executable
MD5: 2e7f37db9ef7cef9cbef6bbc41550af9
SHA256: e693cda692e0eadca208177513c175c5af1445e28b52aeff84ae31183b4dca9a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libcairo-2.dll
executable
MD5: 8c0c2ec604e293e90e957525b3ba446d
SHA256: ea6cb8cf98f635d730b9e8d3a8c27b3d1256ce7286f0c1a1f42646db6d212d00
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libgio-2.0-0.dll
executable
MD5: a13c9a58885aace13e59834db0b20928
SHA256: da70f3618cf0d9789a41cf5ed5cfcd05c006223a29521c1cdfbc8404767faf24
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\x64\Windows\System32\oledlg.dll
executable
MD5: 263e9a047d17cd50baa9d3c02910d18d
SHA256: f526648358ad121001d2776e0acc333ec4ac168ca07b40a3d3c06c5ce6a361c3
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\msvcm90.dll
executable
MD5: 4a8bc195abdc93f0db5dab7f5093c52f
SHA256: b371af3ce6cb5d0b411919a188d5274df74d5ee49f6dd7b1ccb5a31466121a18
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libasprintf-0.dll
executable
MD5: 990b64d66317e8fc56d4d1550a884343
SHA256: 6a47c74c8318842f0023906c0de84cadd3aa1e8e6437703903d14df15683edd0
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libgdk_pixbuf-2.0-0.dll
executable
MD5: 9f10cd4594ea883db9a4feb2b091c87f
SHA256: 87cde24f8f568e7ac72f5f1c06767cf3f29608d2906aab00c4be5a50712eab1e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\x64\Windows\SysWOW64\epmntdrv.sys
executable
MD5: 5dd3dd499b8d76b0ec39b39171c819f4
SHA256: 963466936d3b9a52adc4d52b74a870ac260db156cb7731e67b07080925c160bc
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\msvcm80.dll
executable
MD5: cae6861b19a2a7e5d42fefc4dfdf5ccf
SHA256: c4c8c2d251b90d77d1ac75cbd39c3f0b18fc170d5a95d1c13a0266f7260b479d
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libatk-1.0-0.dll
executable
MD5: 00284606a850dd7d79cd7c02cc4f01bb
SHA256: 90208ac978977500f402f2bf1e4a529b65e2a5a55d55e03023add9865750ccb8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libgdk-win32-2.0-0.dll
executable
MD5: 81cadf1413cadba0e3f67b52fd3f3c88
SHA256: 2039f0b3795c7e20b0185fe32f70aa8d85b4e6d19fb38fbd10ba37a9c39b7db7
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\x64\Windows\SysWOW64\oledlg.dll
executable
MD5: 936f728e04accf3f38801cffcf1e3f40
SHA256: 59ca86096f4b928e364b6a3c0408615f068bb8bc02dcfc5eaf4873ec6d6e0797
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\MSVCP60.DLL
executable
MD5: cb21d826d9c39aed19dd431c1880f5de
SHA256: f1fd0f1a54f196b19a6f21044092c89c02353dad173c236d80f6474cb8a7ea7f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\LdmManager.mo
executable
MD5: 7e7acac26f886f174c7201a52bb3fac4
SHA256: 36983b749b5d772f78285cc714cb3ae81059521640d5897b3e54224a549318e8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libfreetype-6.dll
executable
MD5: c706383d3fecb0a96411319d95dd4f9d
SHA256: 61af8fc24f955435a48bcb2bc0f5f1420914f280cd55231dd2180dc2b94987b4
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\x86\drv\epmntdrv.sys
executable
MD5: 5f2d1f871ff277ede5faeb971d8335ed
SHA256: 5e8b32d70be5854f26f8ceead539a5e28b54e2dee764456507083bfbcb301538
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\msvcp80.dll
executable
MD5: 4c8a880eabc0b4d462cc4b2472116ea1
SHA256: 2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\gdiplus.dll
executable
MD5: a08ef2fc9b3e688128e89d9c193f7652
SHA256: 2be272a683c26255a674d4afedb3a495d214adce69d819ea2ade77f489b30487
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libgailutil-18.dll
executable
MD5: cf72818a626bb93eaab07f680f31a8dc
SHA256: 5668c7323acf2a06e53dc7f049f1890209a6f9128cbb3a3dd97a873700ab47fe
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\x86\Windows\System32\msi.dll
executable
MD5: a3b0e93f22461c2af93598839d1770f1
SHA256: 2e184b2bbb588fd76c31d5d9d4d2e3c6b59ea2b00a7bca4d09aebb5a10676cfc
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\msvcp90.dll
executable
MD5: 6de5c66e434a9c1729575763d891c6c2
SHA256: 4f7ed27b532888ce72b96e52952073eab2354160d1156924489054b7fa9b0b1a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\GarbageGather.dll
executable
MD5: b6c3747c1f29694cdb11b0b715e9440a
SHA256: 4aeb1ec5f76528db2520bcd75a40988d6cd7f08b1c497ec9ace03715444e4a53
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libfontconfig-1.dll
executable
MD5: 085caaeae0666f81d05861264f696633
SHA256: 3ef428951c93f9de9cb80218aa214bf6b9fac1d39990424a8e9550dbdfcd5c4f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\x86\Windows\System32\oledlg.dll
executable
MD5: 936f728e04accf3f38801cffcf1e3f40
SHA256: 59ca86096f4b928e364b6a3c0408615f068bb8bc02dcfc5eaf4873ec6d6e0797
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\msvcr80.dll
executable
MD5: e4fece18310e23b1d8fee993e35e7a6f
SHA256: 02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\freetype6.dll
executable
MD5: 5155ae6efacc75084fb1a9884be552ea
SHA256: 2f44cbfe8b02974e029fa4b97f4bc342553167d6f715be082f8f52ac604cbb66
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libexpat-1.dll
executable
MD5: a885413bb090e288fba73eff0ec46412
SHA256: ba66b4a911c53419a7199828a987f3e5648af82e1c89cd900fca4e55152eb048
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\x86\Windows\System32\drivers\epmntdrv.sys
executable
MD5: 5f2d1f871ff277ede5faeb971d8335ed
SHA256: 5e8b32d70be5854f26f8ceead539a5e28b54e2dee764456507083bfbcb301538
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\NTFSCopy.mo
executable
MD5: 9cddd6d003d21720447063c86d2af953
SHA256: c6bc01daa6b95ac811b6c8ee34a7be4c3ca6af22c3d9e27386b6055eed1fb512
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FragAnalysis.dll
executable
MD5: 41c32728abd65b3443dbd51170e13fa0
SHA256: 9e7a3aab9ae3a76cf54db948a5648231b15922e1203d0a4ba72e6f87963daa38
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libeay32.dll
executable
MD5: db0d73d56fce7a6351aac61fc756be95
SHA256: 8f772f5699eb6955642c931131ba43052aff419e4cdd04524d847b83b7702ded
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\AutoUpdate.dll
executable
MD5: b0b9b2911852be1852064e06ead3448d
SHA256: 6c511faf8c4560c4a899eebecd72be87c3d12662daff430c42104f6010154d6c
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\NTFSFileSystemAnalyser.mo
executable
MD5: 2c4f54c5f961e75776d35f29c780e3a1
SHA256: daa08336b9bc1a83f55ff55912a334558e2d334452e4d2c8149627dceb639533
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Fixup.mo
executable
MD5: 8d26c96181f06825ecaafbdf25b984d7
SHA256: 4deefaed53db53ff1b97ed109351a49485da53c00521339c27797247ff5b5d54
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libcairo-script-interpreter-2.dll
executable
MD5: 66eaa1bafa03beed6f1669e769013c25
SHA256: 033defdc9e8e04d824a3f7f98b47881aae17f25cc875cfcf5e60164563bc08e1
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\CallbackOperator.mo
executable
MD5: 7d4ae4176940d8b6bff10198918547e8
SHA256: 891b06d8d80a2942c88b33d900f030131dbf2ceac5a80e164614d5cebc0789d8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\NTFSFormat.mo
executable
MD5: 67fbb320650a0f78d65b572cc742010c
SHA256: d45eb9302a1ff9ffdd9245f87a275fde8d6d08d521ff02dc43ed40b2852a2074
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FileSystemCheck.mo
executable
MD5: 7a74c7ec20e74bfacf57c365f5ee7f0f
SHA256: 1f20352dab22b50b927ddce067384ed783c2600d994cc4b1891b76dad0664d48
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libcairo-2.dll
executable
MD5: b2bb842451a11585d73b3eb65878ece9
SHA256: 23c5674b4c8685b1721976c591ee52051fab6e274a11df783c8f220577fa3f93
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\CheckVersion.mo
executable
MD5: 479712dec1bd3e96af8b8628b1517219
SHA256: 4d445b18fe36576f98a7ff5fe77ca000cb6c8670d49d29099c3523f619cec525
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\NTFSLib.mo
executable
MD5: 2691799ace60a4f84f711f45145d8762
SHA256: a9f879ff3fc27190642aa340eb645c59feba5f25c1828324480bf48e12028044
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FileSystemAnalyser.mo
executable
MD5: 29b16e6dace57451ffa41c316c401014
SHA256: 7fbd36df24682b00b5102ad038c4915d5ddf84ae149e7699d1fbf4d34dc05aae
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libcairo-gobject-2.dll
executable
MD5: d16b292282398324baa2dd0408c9515e
SHA256: 32711b24d49bcab423c603948649539beeef2ab637bf35c3fb22c67759598079
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\Common.mo
executable
MD5: 33c411a19eba6d3c67e04b79706fdc32
SHA256: a6307cb93c46d46bcda25d591fae2389b3055c51b934b697ef0916bd5b4fc975
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\NtfsResizeMove.mo
executable
MD5: bf0d69ca6cd466d83c3617c4beed6044
SHA256: 5a8d8d64793e179a33267448307a555d57ad916aa56214f05778444ec6821135
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FileSystem.mo
executable
MD5: 8f396c6ebb4850264169211c7493d243
SHA256: 1e22406f03a5ac5b9177163ae82f9f7886ab648e9daccea83bc25cc5f848e8a3
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libatk-1.0-0.dll
executable
MD5: f95d9eefcf85aeca128c218cb23c90e2
SHA256: 58f2d066b7e5f2f2ab213078974d414319849f3ac1a78c5c1853d514e2766a41
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\ConvertFat2NTFS.exe
executable
MD5: 84a9fd218b3ecc3d0aaba04e7b96f47b
SHA256: daad0c27a7e835ba03c1c49f782b0edf25fee7899457ded04652273e0265748c
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\NTFSUtil.mo
executable
MD5: 46785e4a262d332156eee280daa75fdc
SHA256: 1945f3770cdb2f4076aa055ef79b5eb13f7ce393bd250b68f691588cb61b43de
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FHProcess.dll
executable
MD5: 0704b678c9eab70d69a7950926651e67
SHA256: 75fe313c625478a859b803aae3874ec16d2ecefc021a69ea39732885795058dd
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libasprintf-0.dll
executable
MD5: 946ca7dae183e3cded6ca9505670340a
SHA256: b5bf1a473d8c8cce986d460e69d1661780b51be6b635caec6c8e518cc7a15fc8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\Config.mo
executable
MD5: 6d26003168e181db2371915156d75ceb
SHA256: 54a998166938403976c8e3c8c7073f5e6da6bf694817b54aa4e217f72210207d
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Partition.mo
executable
MD5: db5dc3129f6619ece448c4e1cf4acd8c
SHA256: 434586655023c047eaa3debf16c08989cc03bd40f8a84101bc358b5bb5e95f93
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FatResizeMove.mo
executable
MD5: 100807e15f5e17021b5f9a3e920ebcdd
SHA256: 59a1e39cf3edfda99c382a1e9d29e265e3de228b40386f9965b177a5ba45368e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\atl80.dll
executable
MD5: 8ad2485047cc64cb04b66040e62fe5fd
SHA256: 59b40ef6ab24faf3772a74db39b30065550a58cddc76af21552aa9e89674507a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\ConvertFatToNTFS.mo
executable
MD5: a226d634388d5d87341181f02e879a19
SHA256: bb55285522ba42c835486c9730baa3f8aa4f759610f48dc21f432defb0511e35
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\PartitionRecovery.mo
executable
MD5: 5e0e215de78e55c6741d9d3c10bf1c10
SHA256: c9f178e8db1c03756724a142f1b371d37eac7aa1f93ab85f03ba811b582c72a8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FatLib.mo
executable
MD5: 9c4fa3a89170f6104d8b08f2d8ca14f0
SHA256: c610ff14e36677d5cdbce2b90f70a5464b1285e60924fade1c37e26b07caa080
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\AddDrivers.exe
executable
MD5: bda6c0832a1a83417526d24f616ef3c4
SHA256: 93f366c71926a4ee5fac0447501dbe3b93fc6c119e3a1e58e52ea445e5290e73
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\Device.mo
executable
MD5: 50423e18e554974504ab0367956066b4
SHA256: 7d7d435127604b2e2286e5ca56c013d6614cd5be01b048d44ad0a70377adc4e8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\RegistryGather.dll
executable
MD5: 8fb160fba649dc42b8c433c2251ffbf7
SHA256: 7c861cb64c7854521867f714eaa209ea757db9424d6c834495d88e7f978f04ba
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FatFormat.mo
executable
MD5: 8fbe2d51587497b022c0247dc53e95b9
SHA256: 9848d4bc9576ce88e80bfe0dd65113bee1fb8f31f0e68bb5843f747ee6e73878
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\bin\x64\AddDrivers.exe
executable
MD5: bda6c0832a1a83417526d24f616ef3c4
SHA256: 93f366c71926a4ee5fac0447501dbe3b93fc6c119e3a1e58e52ea445e5290e73
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\DeviceAdapter.mo
executable
MD5: 8394827c74c75c02be8f712c01d56ede
SHA256: 066057ae54969934e83e07b3aaebc92482900da7499cc5672cc8d6c0664a9dcc
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\RegLib.mo
executable
MD5: 13728c23b7212f6291b49e1a12e1d2db
SHA256: 723e7a7dd6a3850926f0fa34260451971c1602832af8dce4da9cd4baabd4690f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FATFileSystemAnalyser.mo
executable
MD5: 83484e59955b41801dfd3fa6c550e015
SHA256: 299f7c903f6f25e5ef0e531eb43026eeab459ab3b854c225d66a175fff9df0fa
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\bin\AddDrivers.exe
executable
MD5: def6f715c97021b14754a03beccc66a3
SHA256: 07976f65be6766418fcf4c60ca30680a993dc93fa1cc9a13d54adb671ea1bd21
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\DeviceManager.mo
executable
MD5: b44c9216daaffdd5fa9db47349d6f3be
SHA256: 38e9736d779b5ac7967d9da267220b66337cacbda0789a2badf9918d0ab7a6ba
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\SectorCopy.mo
executable
MD5: 25c1bd6d1f1f29981d95830a039cc7e4
SHA256: e3793e7eaedb151c20f25b83d9bafc1751894c2b5a0451efff3a0ecc4f8fb753
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FatFileSystemMove.mo
executable
MD5: a18550804bc931a47c3cdbff8573be54
SHA256: e03ced501ac82812fa4e1c88f3d240ca9020e3837192031672352a34a13fa5db
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\UpdateInfo.dll
executable
MD5: 35cb3887c053ff4f1f8537448c58849a
SHA256: bac887f76fdf215857c8113c4e066d109f0654962a6a5630c0aa514ed12a7202
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\EFIBoot.mo
executable
MD5: 73531f3be3496a471b89a95d19111c6f
SHA256: 3ec5ce290925552178519603eeb1515246408fd2eb2b1636bf08948c326179be
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\ResizeNTFS.mo
executable
MD5: 460737f9a4f7a87ef0765863cf8db601
SHA256: 929bae3095e9658d68d52203d846d3a0c257cf8dffd4debc0412cdd8ea5d7e6c
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FatCopy.mo
executable
MD5: e298e23e937f884ebe570cc98de9c258
SHA256: 9da69269562493f0bf6b99c5f4561b9f8c1ef817d2baf17f8ee0ac3138129445
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\BuyNow.dll
executable
MD5: 20028e94036381f8c5fb7dfebc5cefdd
SHA256: 080723790bcf71c3efe3026e87795a6623bfe942777e2d1298eb74f056dde989
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\Error.mo
executable
MD5: d00ef6b755cbd1af24ae479508b994dc
SHA256: 95d39f52c9337fb2fbbaacd43b54a8e7812c0314f38dbd283ed4da4b14efe231
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\ureport.exe
executable
MD5: c7a21edb1319c187d52930d855c8ebe6
SHA256: 97f094b66e59b1ce85471c6af754f9384750bc2695eda84547635f8d7d175352
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\ExtResizeMove.mo
executable
MD5: eb290afdfa08aca1753a3405f71366b1
SHA256: e131c9c4775eb6eeebc8ff3ca9196d17c7177ccb5e56feadbf00c43c75d35c42
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\euLog.dll
executable
MD5: 59f0efeb653e3530342be0ca0ec23efa
SHA256: 8136e97668b9d67ceb4999f8cca826ebb58a5cdd7f91b03048aa62442ec30f9e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\ErrorReport.exe
executable
MD5: 6b66e7990daee41de525ed541f7451e6
SHA256: 81bce9631dc2a3be3d1ec57df9b5a7c972ca5923b60dd5de0ebd9f0c1f938307
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Thread.mo
executable
MD5: 533a1c48b8e6c4f4f4eb65513e4a0469
SHA256: 317c0178ad5f760616d76b555223860f7041e795793d6050acda662ea3b03756
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\ExtFormat.mo
executable
MD5: 1cd563cf4899bb99c6c88f7e6a915ca7
SHA256: 7b2571ea8ef9f7a4dbd2aa56eb5d29df64fb982c48c52cfa49a950ed9347949a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\platforms\qwindows.dll
executable
MD5: 885985e00a051b4b0544b29e4e27d8a5
SHA256: 80fd9d297eb5b2b06a9e6ee9084c98a3156f0a0c008862da09ac8132e1501b30
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\EULicenseDLL.dll
executable
MD5: 6c7c2bf67200241ffca5e3b8cf4ecbad
SHA256: cad0db96610b62758ff1e0cc0d73631bb23d1677609481bf7ebd0664ecfcfd53
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\spawn.exe
executable
MD5: 3bfe5491d8de2403f5bad0f692af807d
SHA256: 7df1e27dbecf2eb24fbecaf5eb7b83ccb7cb6847c5b0d4c0c474aef2807781bc
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\ExtFileSystemAnalyser.mo
executable
MD5: 53488cf8e6f20d2d221c3eb44f108131
SHA256: a4648f444147e9a09063e55184a4b7c24d08d371e9c0600e171a07f7888f6a86
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\platforms\qoffscreen.dll
executable
MD5: 475eb4f3245ae46e8ca74cc484ceb27b
SHA256: 8f5339177972bd87d8edafdc8e3d0b93641ca924cc773ea64099f2cf7cb70439
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\ExtFileSystemAnalyser.mo
executable
MD5: c9dc94f5adbf2c4d8c8ed897105e0534
SHA256: b9af459596bd128497ce8e98fe17b4958329c3020e6fd1add67a84ed7c125d86
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\WinFormat.mo
executable
MD5: 4a59f283ad54422051eee967aa6ddbd6
SHA256: 0dd82153ab46ba17e3f9596b10a45cef37a853d39c155a907511d39bfa6fe707
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EULicenseDLL.dll
executable
MD5: 70d8c05a9017a03733b8ed269de6823a
SHA256: 7bb3bce2b384a512b7761de24d778a3c11a04df969f5955c54e8b75bd56c3d23
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\imageformats\qico.dll
executable
MD5: 522028ee963eaf8f50a950fd41b685d8
SHA256: 75a6e262bdbccca3ba445c564263ce23947d0fb654abcddbc04c70e99625eb36
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\ExtFormat.mo
executable
MD5: c0b28267b9be19bea72cc22ea012a344
SHA256: 77108cc5e28fc852d3200c8cc70e1886f256c61f25933fb342cd87c543ae6114
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\WinChkdsk.exe
executable
MD5: f79e367eade4c94befac3f5d3f43f7ae
SHA256: 578fca5018602c5b2715c10f84831e047d92eae0928c1966abc6971f0cdb931e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\ErrorReport.exe
executable
MD5: 4e544d0b5efaf6e70e256bc397eb0e49
SHA256: 0b28fd6b99af101fd6b408f6fd749531180a845e1f58cfa3a551cb8686d3e591
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\platforms\qminimal.dll
executable
MD5: b32af365c19d60f55f83e7b5a201e5bd
SHA256: cab17d3cc03b70c21c1e2257e796a17c11d7a4b91d6de0f1470887c2cbe557aa
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\FatCopy.mo
executable
MD5: c954f1fbacb0bb4c29322586d5139c0b
SHA256: 38a5507c13492e76d32a9368625e44bd777b1073a1c497792336135fad727562
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\adds\TbExportSdk.dll
executable
MD5: 6943ce5da8feef18eb92d8c882226359
SHA256: 1254897ca3b8f2b852d0103d55e0facb6da83aa48e30d4001b920d5c5ca077e9
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Error.mo
executable
MD5: 17444a2b9d7d29f570839fbcd54ac3d5
SHA256: c427339b1963fe7ced8875185bbfae2d6b66ec27d87b096180261424e07700af
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Qt5WinExtras.dll
executable
MD5: 2b532522918b9e365239229f93d7eea4
SHA256: 5b7d74d11e98b9d3181791ac0ea33f8fa51049c54d32da50614b430a0528558f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\ExtResizeMove.mo
executable
MD5: 355ac5f9881b4a2f51f5fda997aae639
SHA256: f172bb71f81eb0a816d4582bd47752d29330322d5b9861f3f8b7380c19b6899b
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\zlib1.dll
executable
MD5: d90dad5eea33a178bac56fff2847d4c2
SHA256: 104162a59e7784e1fe2ec0b7db8836e1eb905abfd1602a05d86debe930b40cbf
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\epmConsole.exe
executable
MD5: 27638ef34e5ba94339b62bf8508a8ce6
SHA256: 34356b40278a387250e7718047e10460c4f07e6b37f2072ab252fb8d5c8985b6
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\imageformats\qgif.dll
executable
MD5: d7000ef4dbffd2217c42f4d80584529c
SHA256: e5bdf8088372bdbbe6ad35f00970fc2751f279e2f6309dd56a6e67d3eda5c3ae
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\FATFileSystemAnalyser.mo
executable
MD5: fd58496b9e9087f6490fa7288e100bef
SHA256: 37f623f2aaf808d4c11282e2ef5d36b966204f1f803fad6cd68374fc0111ddc9
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\adds\xsssdk.dll
executable
MD5: 795226279ffd405953a35f152626a409
SHA256: 2678d52b97dd0bfb9b185fe71a63f526e0e5648369457602a1c4f7f7370a8317
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\epm0.exe
executable
MD5: 501e9c3cf353db278ed3d671d19c714f
SHA256: e02919cfc36de2c0782834c761f8c83e726d5db50242e98339c0754d9dcb8b4a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\iconengines\qsvgicon.dll
executable
MD5: f6dad96c8a5c67b0c2f0e95c960bd785
SHA256: f6323ba62e42f39e7b99dbb0b853ab072f68b519bd136998f6d581afcef17325
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\FatFormat.mo
executable
MD5: 09cbb7840b10e589c3d94c37310aaf06
SHA256: 2746a92468d52552de25d1c0d871bd59dd9907d6c743bd31bcab131acb98194b
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\x64\ConvertFat2NTFS.exe
executable
MD5: fabf8f01bb1f1f09bb73d7ff9614d6ee
SHA256: 542b3c4da73a8fbabb28962aaa6f30058df622f053a641fa7f4f784f0f8b8dac
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EnumVolumes.dll
executable
MD5: 5ac851e45ec55ef827a29e58aaba721f
SHA256: 2aa6f30ea859f0761d629e29e45de5006a8633a25e77d13e99415f7388eb02cf
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Qt5Widgets.dll
executable
MD5: e07cea82429fc3664d8dab1514f1a74f
SHA256: c9516c2eaa8074b718ec30fd70b5705ed7360a6773e56a7c0965440a92593898
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\FatFileSystemMove.mo
executable
MD5: 074aef7a341feae0c384951968e02660
SHA256: f6256c270a9fdfe24f0013dd47cf4c2529f6199dda4571fcbe2729eeb6cf85a6
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\x64\msvcm80.dll
executable
MD5: 60a6de55aa50d57a01b7148b0a7ea139
SHA256: 2fa2a2a4a0511493c5a360e66c7d62f0ea5891925636eac61cd9db09dbed5637
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EFIBoot.mo
executable
MD5: 2f982c60cc47e094c6af7cc44c16faba
SHA256: c8f22ebf9a2fc99c5ced8765c01e7f4927d4c35d7c3d8c900b2a706722a8df14
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Qt5Gui.dll
executable
MD5: 6c57dabf657c0a8c0c9967a20a3b407f
SHA256: ff9dcf8ec666c048a483ff57a41bfcacce8044b93455604b4448e58ecb853a80
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\FatLib.mo
executable
MD5: 53812358ff9fd4cf2cfb58bc8b492dd9
SHA256: e0455290af04a669e1179dbd548d5160c7609f88af50e78bd42ce7d3b4a25b9c
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\x64\msvcp80.dll
executable
MD5: c332db81197e6e5d4a67d3789dbeb02a
SHA256: d3ed3fef0f3fd9d547d7ef60d5f532d6aab5bd45966abcb24bdf61dec60c813e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\DeviceManager.mo
executable
MD5: efcbac2f6126bc23b961206eb345f10a
SHA256: 1ff964834f56054e37c72bb64ac53ff6b92a00c106db81e349467906ed13bd4f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Qt5Core.dll
executable
MD5: 30a6f0d262058b61f589f35d8438ad93
SHA256: ed318a230664cc229f26a41f731bb94f630a8d8ea197b1163db3b9404652ab64
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\FatResizeMove.mo
executable
MD5: 89d00df9fcd3467330724ca8d08239ec
SHA256: cd209d000775f9ee62c07568876537c4e8dca5a5743deaf540a3ef34596ffcf4
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\x64\msvcr80.dll
executable
MD5: 4d89f6191db56cfa659388378f3dd688
SHA256: 2219e15b66aba301909128e6775e0b4f8b28b529b3ec087161edae55e2676c65
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\DeviceAdapter.mo
executable
MD5: 033b494ffbd6e9a92d0766fdc00ba676
SHA256: 3038e8fd2df96d5062fc43ebb72685d82c82d1c435e1b388fa573732512da0c9
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\msvcr120.dll
executable
MD5: 034ccadc1c073e4216e9466b720f9849
SHA256: 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\FileSystem.mo
executable
MD5: cd93afc1b420555b3a6890c30aadce61
SHA256: 6d3ef5bc4fe8c853ef9a31a0730ca29067b514f2aafad5cb0037aa7f23347d21
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\x64\WinChkdsk.exe
executable
MD5: dd95f0fe055cb3a02a89adbd778f65e1
SHA256: 6d3ebffc609aa8152ba863d7e8828adfb8a0e14a9438a3ac3c0a253accc3a12b
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Device.mo
executable
MD5: 906a4d888e9c9a208ab07c8632c3e05a
SHA256: 111f6125754bc5ee68ef75edd4d68281da6886d77e93dc418a420cec4a1f7323
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\msvcr100.dll
executable
MD5: bf38660a9125935658cfa3e53fdc7d65
SHA256: 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\FileSystemAnalyser.mo
executable
MD5: ea77c1e6f0a704d186a5b93b7ed9ed8a
SHA256: 7e7e5b520eec602287e1983b337cd69b35a9b977096d1af99f5f16cd7440ed55
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\lib\gtk-2.0\2.10.0\engines\libpixmap.dll
executable
MD5: e5224fd7c4d3adb11ffbef0e843da4e3
SHA256: fbe45333754dadbbe7f3821ce2a44d57e252009a4fc793b4de3cf7aaa12d730f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\ConvertFatToNTFS.mo
executable
MD5: 54c2caec8b44cf20387eac27fef9701c
SHA256: b131664df61f6a87300ec4cb6674959b9eea70b2dfd8055f2b0e4ce6b020a169
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\msvcp120.dll
executable
MD5: fd5cabbe52272bd76007b68186ebaf00
SHA256: 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\Fixup.mo
executable
MD5: 3cc3288794c615f3295541965edd7045
SHA256: 2d4fce7312f191d1e499a6da24b3a4cfb0c06baddd9172c918984f1bc7dde846
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\lib\gtk-2.0\2.10.0\engines\libepmtheme.dll
executable
MD5: 75783682db4ccf36b0e5729eb1471800
SHA256: b9aa362434a109cb6407a1df509b5f418f0c945a70a72f72ced0d65411a6f77c
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Config.mo
executable
MD5: f2820c62b0a0725b4f8eddc1f72f775f
SHA256: fe7283fde026e696c7d57ca4b7fb798050465036de6431b5bed2259015fa799a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\msvcp100.dll
executable
MD5: e3c817f7fe44cc870ecdbcbc3ea36132
SHA256: d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\FileSystemCheck.mo
executable
MD5: ca53e79a0c6a25ddafc8e88f1129fc94
SHA256: 3178bb3abea6d34fdd477bc2d3bbe31e9884ab095a051d030bb47dc86292bfd2
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\lib\gtk-2.0\2.10.0\engines\libwimp.dll
executable
MD5: 5764c5b2c54d831735a6efb53e5b2ea8
SHA256: bf43a8730ba2a2fcab44ffc378f36838a1e169d7874dece4cefcfd4395cb6422
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\ConvertFat2NTFS.exe
executable
MD5: 1f028602668a886268923846172efd28
SHA256: 9ed02eac40895ab1a3199a402cb9353363f35603e62e5c24789fad7d2eecd89b
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\fscLog.dll
executable
MD5: ef4c07e18cabc86f85fc01108efa6e88
SHA256: a46a440eb2fbd997442f25fb04b03b93860c0ee83436790ffa069b560d502f19
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\Help.exe
executable
MD5: 92cd61f4fb49b981b29d44f2b93ea8d7
SHA256: de5301a52309f54fdb2396b150644a4cd0944307a93668bb4ec4670a4948af7d
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\lib\gtk-2.0\2.10.0\engines\msvcm80.dll
executable
MD5: cae6861b19a2a7e5d42fefc4dfdf5ccf
SHA256: c4c8c2d251b90d77d1ac75cbd39c3f0b18fc170d5a95d1c13a0266f7260b479d
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\CleanUpUI.exe
executable
MD5: 8381ef99243fbc9b3e03242312dd539b
SHA256: 871245b3a79046202515d24fbbe9d391f0f7b2014b139f77bee65c4a26d1924f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\zlib1.dll
executable
MD5: e4d7dd0a413519b21621ccb7d1d78fa4
SHA256: f4b42f671cf34329584afe4193c311dbb2a0396524499a23819467431a2b673d
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\LdmManager.mo
executable
MD5: 23c3dc80c56701371d92fc59db128072
SHA256: 581f1e91813303321645b99e0af84849af95d5ae2da8c2f6fb2718208895c5f3
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\lib\gtk-2.0\2.10.0\engines\msvcr80.dll
executable
MD5: e4fece18310e23b1d8fee993e35e7a6f
SHA256: 02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Common.mo
executable
MD5: fb22a198ad3ebe650a7395c85c0bd481
SHA256: 5a1d49ed5fa3ad402d63ec0c218cc8158c56c27ad613b7fdd273fa9915bd71a1
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\uexper.dll
executable
MD5: 68d64f46ae4490d8962232ff0b42b503
SHA256: 3eef8539fa9c8d8295f098d50c6c65370eb3374f26a514266119a327ad07a431
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\libepmtheme.dll
executable
MD5: a0abe6ad3cded5a0186520e035205601
SHA256: 3a9a1fc06bb0f2074a3628d1e965018432ce6770be2c15b3f46b58dbd9daa62b
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\lib\gtk-2.0\2.10.0\engines\msvcp80.dll
executable
MD5: 4c8a880eabc0b4d462cc4b2472116ea1
SHA256: 2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\CheckVersion.mo
executable
MD5: 67228a41f42c2ce62f4d552040bb8d72
SHA256: 5a8cfc89d4cb66c606fb6b7786841dda32df66b51f4c365c4f7883095857285f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipConfig.exe
executable
MD5: eb6c1612f8c1bf231fbb4ffd3a62aa5b
SHA256: 360cb9252b1e907be1934920d834975880f9e90a8de7ae4c6ce3d8e4bad55945
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\LicenseMgr.dll
executable
MD5: d1a11d0ce67951bb901d63ea163bbbe6
SHA256: 30409a8b2a5cfb42a189737f931669ed09306abd522b20ad5632b99b9baa4a3d
128
SETUP.tmp
C:\Windows\system32\BootMan.exe
executable
MD5: 400ce19ebf426eff3316125642c1ff81
SHA256: e9a3533ac3fd6a2ca446e074656a09158d90afa2c8c8c86de1534b4bc0364acf
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\BigFileGather.dll
executable
MD5: 6b8e6c731e40236a2cee60c9b373d3ad
SHA256: c70194171660d62c50a67d13ce4eb543b5c3c7384c1c7d073685d3f24b7d50bf
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayTipAgentE.exe
executable
MD5: ed94afd1e9ae25c8413cb32034160f0b
SHA256: a6b9406573736923403e6a200f77b40caaf11a21621f517aab306f421397f053
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\Log.mo
executable
MD5: 9ecb77f5bc2d929d16d6d7fff69bc7a3
SHA256: 606f3eae63390913e2d150f2f397aa3efbe4e97e12b3c6b291931c271f3c6c97
128
SETUP.tmp
C:\Windows\system32\EuEpmGdi.dll
executable
MD5: 980f2eedacfebd6c371a165046fd6237
SHA256: 0e227d17f76757df77d3908ad2e1f787c114facb7eeba5dd47ed1a1587190181
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\CallbackOperator.mo
executable
MD5: 2438a1c4edcc545203b085ea7de550e8
SHA256: 7881cd133b5773c788df88ad772a988e4e623002d5df0cefc60f96468370039e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\TrayPopup.exe
executable
MD5: a520d41a7d5ff70e2afaab74dac5ab6c
SHA256: e9f15fcdfed07826ac3c41f2c56f1a8faa8853263a982c7c32aeb73fd92a84d6
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\Main.exe
executable
MD5: fcdadf740144fd9e2e43a0a003057ba5
SHA256: 3a27f163cc19f7139639f520990cf005bbb559f0a013e38f2d16ef5df636fefe
128
SETUP.tmp
C:\Windows\system32\epmntdrv.sys
executable
MD5: 1dd50f307e4700f564666d2c8df73e47
SHA256: 105fde32cd7606da7def76bca34c22547edf6cd8b5d88e950efec9c7bd54d56f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\atl90.dll
executable
MD5: 64eca1f64e4a988a6c5c93f3e5d66236
SHA256: ab93df816c284ac247b9087663bc449beb26e6f64d9f8a6be2efecafa7a9cedc
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\traynet.dll
executable
MD5: 0f385fdaa722ecb064c006a5b9376bfd
SHA256: 54430a630f7abf05d26b6856f25b508f85944c82278da8d879ddb056875ac293
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\MergePartition.mo
executable
MD5: 90c33203602f3adfdb3f8f1276870a01
SHA256: ef02173b0716c6b70ea4fc084049fff3655b8cd39d96c3f57b04621a68fb68de
128
SETUP.tmp
C:\Windows\system32\EuGdiDrv.sys
executable
MD5: 886cdc85e0b6c9ac2547f919e5b224a3
SHA256: 88210b2651b27a669307e464150ae87486647558a0e2b40e308a20e72a4bd2fd
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\sm.exe
executable
MD5: 8e669ed8484365d275d1d664543f458e
SHA256: 907a2037c1b6f08e0f5596fdb396401d2aabf6654ce26c67295d9bb8f4ad3981
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\libcurl.dll
executable
MD5: eb70fd53d5689e06743c4cc2f2d37395
SHA256: a294fee3b2c1ff3122dc47e51523e7f32f120cf69caa6e0e09c9efdb408e582f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\Mom.mo
executable
MD5: eb19ba180ce42c1a31ed71e11ec38fbd
SHA256: 1b87aa1331aec90e5300aca8d7ba03e1e46bed245c99a4c3ea162e3676970fa6
128
SETUP.tmp
C:\Windows\system32\EPMVolFlt.sys
executable
MD5: b1a6f987a6bc7e21ae3988de49ec66cc
SHA256: e3d44f30af6653db7dbaa9d26ccf9e27fd3f45d90926d3f82dd8f0518f903149
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\AutoUpdate.dll
executable
MD5: b2210fef342e4fb32fed51541c3708e5
SHA256: df1ff6d985c4512335e5276acbf64a8c9a15390a58e1b4fcf6cde4fbe80acc42
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\TrayPopupE\AppParams.dll
executable
MD5: abb9e9d967792706af43ae1552ec24fd
SHA256: aea60201d10beade55c974c0661f51180a04698e887b95f4de5d566cd8d25c1d
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\NTFSCopy.mo
executable
MD5: 16c2a3477c934fe44549e1daa14607e0
SHA256: 50de4ca431e0a57ee4bc1095549ae60d1192afbe3fe1fb10c9ce4f0450d4e07e
128
SETUP.tmp
C:\Windows\system32\setupempdrv03.exe
executable
MD5: 678d56141c0dc079f94b8f0cf3663b65
SHA256: 7e62e3da09a5bb1993b66afd3d3bb86351442a6b5989ab58db0a940c75337088
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\mfc90u.dll
executable
MD5: a76104d8d9aba3670fd3cea603d70ada
SHA256: 443fd2e5fce845e3e682f6057081b8209e4b7d1f50e2938f7cfc003f2a6b1a01
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\XmlWrapper.dll
executable
MD5: 3c9b00519a739563ad71f6b223ea2770
SHA256: 4061cd9b901ba5fb858c596bd3a8f938edce6179b95842c03f828d8d436d287a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\NTFSFileSystemAnalyser.mo
executable
MD5: 6834cfb96ccb23aa96bcfae1a6d9788c
SHA256: 1aced8a526e3b06cad311c4d9f675f7ae90e195a2ba1e4e2db235a2d9ebd7bba
128
SETUP.tmp
C:\Windows\system32\drivers\EPMVolFlt.sys
executable
MD5: b1a6f987a6bc7e21ae3988de49ec66cc
SHA256: e3d44f30af6653db7dbaa9d26ccf9e27fd3f45d90926d3f82dd8f0518f903149
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\mfc90.dll
executable
MD5: 462ddcc5eb88f34aed991416f8e354b2
SHA256: 287bd98054c5d2c4126298ee50a2633edc745bc76a1ce04e980f3ecc577ce943
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\UserResEx.dll
executable
MD5: b7ba206767d9c79b5e75d75332711b6c
SHA256: 277b8d048e71e1f0fecbffc3acfff281b4316691c3a379f563731de85394846d
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\NTFSFormat.mo
executable
MD5: 0a9008aabbb627d03686617d3ce9f82b
SHA256: aecfb3106d836ee42d6e3a7b3ae323bd16914d05349295e93e116b8320556991
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\AuConv.dll
executable
MD5: fd306a29934d84ed646e71661f25f4f5
SHA256: 6d4c96d9e2470d814450e196a5788366a99b6f341716c0d06169a9408f395e27
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\tb_free_installer.exe
executable
MD5: a93e1e7bc817adc8945ae2046478714e
SHA256: 99cf51f20f41fa5fdaff8f0a8e783e5198c5d591ec920ab3330e4ca73f6b3c1e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\UserRes.dll
executable
MD5: 098e1a87229cd911324a0468f53df622
SHA256: 3bf17bdb26844b63022a70249efa647e8282d6f574ca6ddc823157c2c7273be7
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\NTFSLib.mo
executable
MD5: d0cc8d86a552eeecc09686106e276d47
SHA256: c9b765fd46488b6e4209022022432e0f74e7218d14dab806619df33efb70f48d
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\7za.exe
executable
MD5: b46f1bbf9212bf6ed6e370a330aec77d
SHA256: 82aee6567a93126b90cc28e121706515e2311e185ecc931775463b7932e3675c
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexperice.exe
executable
MD5: c0401264e0fea3e868624ecea0f5fef0
SHA256: f73ff61551afea02447a30e10a7c9c2b1cfbbdc9ad01838ae59ae7a2d72be1e8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\ssleay32.dll
executable
MD5: fff207fae4b1a2da488a0b3fd176fd4e
SHA256: e9925071aa401150977a665cc58e7a2db5a38067e663a3177a7441fe34d5da99
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\NtfsResizeMove.mo
executable
MD5: f9d42796751d0b76864d9e739bacbd38
SHA256: 9cfb95ba6c3c4f30a3fc6aa2dd7145b036aab9d18e32e1f032f6002cfb73c5b6
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\AuConvEx.dll
executable
MD5: e66211f9dd062cb43a8543a8e0e845d1
SHA256: 1960acb6f59da5fb8be25feec0e1b9736d7ead75b0f57d772025806046d198c7
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\uexper.dll
executable
MD5: 3496b30de6452f02e04197250ccde833
SHA256: d70b65fec672aac001ee4ec156f495d01894bf8de37f0d20fc49c9d293eee519
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\syslinux.exe
executable
MD5: 6688147d33bd968e6bcdeb431eaace59
SHA256: b366947ed4d5cc6858eeed5c12e47e62ebfd095a5ac0086a691f0bf86a887e0b
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\NTFSUtil.mo
executable
MD5: 69ada58677b831a2ff39a549c9762d6d
SHA256: 1952266d5d7806f78e894f2e58519c120a35e2bf194fed72abe931f7676308c7
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\bcdedit.exe
executable
MD5: 3c2a9f3195cddd8943971dc8a677ef25
SHA256: 28c47b5017260ec82ae70456455953f6deac2d6b6590cec206f9ab8c5d3fde50
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.exe
executable
MD5: dd55f390a6c4ba45d1a2a4bf9f415aec
SHA256: bdc1273fa1c79853a10bb707b95c9425c7771d2c8aac24904b74133fc13c5776
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\RecLib.dll
executable
MD5: d5f29700bb1c0a3757d32bbaaa215efb
SHA256: a5fefad13b72c8b9534881d62eece47b24ca512378c810055a61232d39fa7419
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\Partition.mo
executable
MD5: d3f2f6bfc18d1151b3ea9b1fd61f2807
SHA256: 244a68a4b7aee896edf8dd88ff870d2b14a78234fc6c9d87ed8f6057ed9279bd
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Boot.dll
executable
MD5: 4198bbd34bc19544de68c1eb31bbeef6
SHA256: 7b04135b27b7a5a7b8a4ba34c23d86c6e2a34889f092247c4961e4e226b281c7
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuDownload.dll
executable
MD5: c53fe9e537ccd83c4369f52a49161bf9
SHA256: 34706c2bbb3f3ce7878547d419050111f4d801ff6f7e18345298c6cdb53770da
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\PETools.dll
executable
MD5: 491d8f7eb699becb02a34f279ae91e80
SHA256: 8cd895c374005db28b2e29edd593feb2f7d756814331b96315d14634981f041d
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\PartitionRecovery.mo
executable
MD5: f0f1be9b0e19ee6648d541448fe97014
SHA256: dda7bbdc0902e851d4abbbd45fc35b72950626563005906fcfcee53b0dfeaeaf
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\BootDriver.dll
executable
MD5: ae758f4e0af7490e4835fd6fe764146d
SHA256: ed69fe8f105e74d306307cb292dd4119bf2544dd5e052117c6d9bb7bab6a3ddd
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EuActiveOnline.dll
executable
MD5: 0e0b9780e2649b3356667eb67fc67ab1
SHA256: effbb14484d9e2485f7e1935a2322b1a16ffa3c56bf76c1c6fccc952e5fb86d0
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\msvcr90.dll
executable
MD5: e7d91d008fe76423962b91c43c88e4eb
SHA256: ed0170d3de86da33e02bfa1605eec8ff6010583481b1c530843867c1939d2185
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\RegLib.mo
executable
MD5: 4e46faf3dcf9eae1dfd3b5879f4bcf8e
SHA256: 0910ee9039fe3cbd0e72888ca1fffad367eea85fa05fecdae4f1d616af7bb395
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\bootsect.exe
executable
MD5: 9594bc046765df20f4ac8ded4d1dd5d8
SHA256: 4c457232dd4b8e3589f2f38f705089baf568b1e9ec1554a0a3022b39f4286e76
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EaseUSToolDll.dll
executable
MD5: 564b4ed4bddcd2670667ac019b00ce65
SHA256: f00acbe725e4c4fb281716bbde2a76a737f28a22daaf209c8396a57e70339f51
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\PeMaker.dll
executable
MD5: e02bdc685f70cb15217bd45a2accd5c3
SHA256: 6929de38f31de1b5f42a077a4fd37ff728fc4e48ad72a2a8f5768f1e7a5435f8
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\SectorCopy.mo
executable
MD5: f9c79d92fb922202739f98ab8c41c106
SHA256: 763b52db930395edb6455d1a47655409af643fd6ffae8367d414aa8f2c6082fc
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\Burn.dll
executable
MD5: 76dd60117efccd873689476406e0eef8
SHA256: c357027c8dbe35398988adf8061f13d3bbb383312e4a6bf18e9be38318029ef3
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\AppCenter.dll
executable
MD5: 8f89bc99ccd63bc785100d95498b260f
SHA256: 5352db7bd89ad7a592418798786890d8464d2a5ae1069605dc1954d6cd2d7a01
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libxml2.dll
executable
MD5: e75d9887e0a9a6fbb812b629f8ea0916
SHA256: 82e916ef03117f214bc3e870fefddd4fc422854c27bda75ab272bb0aac6b7a12
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\spawn.exe
executable
MD5: 3ed364d1ef855a1b63d61fa2d4615c48
SHA256: a6c95d24c1c131be217a4d3c6e4b2fb4aef470b53c3a7b363d5a1fccd693d038
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\DataMana.dll
executable
MD5: 2dc27034c8fdf782c245c0b6cd27778c
SHA256: 90a9ecc1f37c526c952bb86b47b0df50d85175c7bb3a0ea59b90fe58fdab2eb6
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\unins000.exe
executable
MD5: 83c8c94f0cdfc47e6ca94788a5ffd45e
SHA256: d789fd6b030bcbdb64a477031fa07272133a28a558910b932d607eca6cb7cb86
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libssh2.dll
executable
MD5: 4eaf889abfe682e5618bd3728a8bfb0a
SHA256: a5e6658f7b39910886f62c6f6f3c0a8028373a25862926c16bb6176f35117a3f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\ResizeNTFS.mo
executable
MD5: 4977a14dd4117ad02a5bfe5cb03d2d0f
SHA256: 0cd4956a89fa85803bf13d56dda76d456d68c749300fb3971f7a4566cd7624eb
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\DevCtrl.dll
executable
MD5: 585353e5ea55a84dbe56c4cfc5829c30
SHA256: c3f7890ca7c30c3279b3d7c145ca3f87bfb3621ca2ea027df7e4be96405c0da0
128
SETUP.tmp
C:\Users\admin\AppData\Local\Temp\is-R7N71.tmp\EuActiveOnline.dll
executable
MD5: 0e0b9780e2649b3356667eb67fc67ab1
SHA256: effbb14484d9e2485f7e1935a2322b1a16ffa3c56bf76c1c6fccc952e5fb86d0
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\EFIBoot.dll
executable
MD5: 92384ec5af8b9168470fba65325310f4
SHA256: 79f10c9387d38ccaa92ac4604944554e499382635665642b77d13378b8ff8164
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\Thread.mo
executable
MD5: 756cb2adb5dd15b58784ba515a335b93
SHA256: 76046005276d061978ac7d58b616c9afa64864208623d4ccd50af74999a709b6
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\ExportISO.exe
executable
MD5: e219970673ad367f6f0beabaad769492
SHA256: a443c2bdc5957d2569ebdf963e60bf5dee81b9e8e241513f3e283ec414dc8344
128
SETUP.tmp
C:\Users\admin\AppData\Local\Temp\is-R7N71.tmp\_isetup\_shfoldr.dll
executable
MD5: 92dc6ef532fbb4a5c3201469a5b5eb63
SHA256: 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\FatLib.dll
executable
MD5: 4d8a19b4875a93d9739ffa8e0427b6b7
SHA256: 633b600e0cda93b81efe7c4a2cd74b23b3bb5cf92577e963129dae106b754a6e
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\WinChkdsk.exe
executable
MD5: 12fd330e15499a3ba2b6b8ae1f2f65ae
SHA256: 4253b4793a30c102740323e74731c8aa18f5fc18fb8271cd418761e5465d6f64
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\GetDriverInfo.dll
executable
MD5: 897ae5e5382e05c876621e17e97129fd
SHA256: 5463b191c4ee68c48452fcc201c8146065f4599382fdab27743972092d1b38bd
2316
SETUP.exe
C:\Users\admin\AppData\Local\Temp\is-5L9S3.tmp\SETUP.tmp
executable
MD5: 83c8c94f0cdfc47e6ca94788a5ffd45e
SHA256: d789fd6b030bcbdb64a477031fa07272133a28a558910b932d607eca6cb7cb86
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libeay32.dll
executable
MD5: e13552a2ec5bb4ac6401bd432ce6fcad
SHA256: 717c600bfeeca9e9cdff711d2f3be2bdb3dc7f5171908d3ac24fe36ceab01f27
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\WinFormat.mo
executable
MD5: 21dd6614025fe2e05bab4ca06f4d23c9
SHA256: 2b191bf20fbcac534b39a18ea5d0c60452463e8aa694a0ecf42b216fcb855693
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\intl.dll
executable
MD5: 9f95ece3d2b3909de4d9147c4d93f976
SHA256: 52ffcd48615d9de3fdb6b5892149263070de4b349871269fc6e8539f81dff61c
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\grubinst.exe
executable
MD5: 4731bd4bc581d7dd13fb0b9dab9ec21b
SHA256: 7ae61b88d70606de8bf94c3dc55f869a235d6a872fbc2eff8df5cd6a08a6390a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\iconv.dll
executable
MD5: d7cbbedfad7ad68e12bf6ffcc01c3080
SHA256: aa9ec502e20b927d236e19036b40a5da5ddd4ae030553a6608f821becd646efb
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\bin\libcurl.dll
executable
MD5: dc9c7080bb8a7fb642cdb22714d03eec
SHA256: 78e711faf68c0ae73923807821622efc7bd4b218122ce88effc80a7a9f9471a2
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\mfcm80.dll
executable
MD5: 4ff468c640debc678d6e57617d523806
SHA256: 8e23719b6790c27e69bcdbf6f9809fd8a1d0d03a1a9d5c08bcbb21f15baf0d36
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\bin\is-B0RL9.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-3RGN5.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\winpe.ico
image
MD5: 599916ba18da7d02afa613601e91ff46
SHA256: 8048b657923e6d49c330ffd3e42ee39e752b766db2dde02b46c6a2d306d2b7bd
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\UnconnectServer.png
image
MD5: 3e41ebc93aa375b88760a5eed11f7d4a
SHA256: fa1ae9607cc4015bd55ecc9d0d845ff846c69007ca01032e53a1e13b7e9e5e33
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\warnIcon.png
image
MD5: df5b43cda7d28a57cf69ea1eb637d4bd
SHA256: e4903376aa27fd5e73a30e8fcd95bd8ec7ac9b26484502cea22a4e0b245b59cc
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-GCPUP.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-JQL92.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-41O1M.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\tab_btn_right.png
image
MD5: 5a9925473d85c2a6a41ff2ae24180c35
SHA256: cbfe3efd771f8309f80333dc936587a2b25034eefd32d92f7c6accf02d8a9dcd
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\tab_btn_mid.png
image
MD5: 3e8f738a7ca7988ce97420454a2a9513
SHA256: 767fe4fde5492780320d8b4079846fb4edbba73ed6f3d3c18880e2b368bcac8a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-NGL75.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\tab_btn_hover_mid.png
image
MD5: 0d876a3ebb5a1427dfef6db419a21720
SHA256: 2c11628ccc48dc56ea887c962bb265bb182d7d422a826b5b748e52231f67de03
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\tab_btn_hover_right.png
image
MD5: a46daefa73692268fc6228afc97ca52c
SHA256: 72ea8d6e4c57593e15f572742cd23fe4d3afa558876c4ce2dc4f22df9a4b9101
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\tab_btn_left.png
image
MD5: 2dfd04cd6e6f619d55bf05eedc004990
SHA256: e2fc0261b79ae7321dfc26065b4d34d0b2b69c61e3b33ee5ecc84789ccfe23f5
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-5ETJL.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-BNRVU.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-HCCDG.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-NKGED.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\tab_btn_cur_right.png
image
MD5: 38e33a9236dcf981976c28803dc3517a
SHA256: 440037d597daa618e779f934ff4477fe85b8d0f83e641f8991c36a89002afbbf
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\success_b.png
image
MD5: e58f50299da95d59e10be0483e8cd10c
SHA256: c2dcacf94d814f182021d74c4d5561fbffe560a9c2299011be70c2b35cf3c745
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\tab_btn_hover_left.png
image
MD5: 19fe656941ca9aa1d04e78a5c1877280
SHA256: 0d1cf1df6ad80a6359451389a662093e1906121b2ad199aa9aa8a80aab2d8978
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\tab_btn_cur_mid.png
image
MD5: e53488e927361233c5983d973f33654c
SHA256: ea8fa80378e81066b9e40e47a332113d2e7ae6d99d201e415773180d3f1cbd5d
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\tab_btn_cur_left.png
image
MD5: 321419c9bbd9e134dbbafce0efcc259f
SHA256: 6ccbf50e4f701676c990cb4676fd0759159633a5217cafe4e7cde3e75f1b301c
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\info.png
image
MD5: cf56eaabefecb13a88ae44cd74021351
SHA256: b34b7f65038eb92ba0e0a77bf50c95ba3e9591acd1e86c629581ea314f798f74
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-7RFL7.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-SJJ3J.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-M7M7N.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-64IVI.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-2UNU8.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-40NB5.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\48_48_8.ico
image
MD5: fb85222f1cdb34f86a1d8d102fb0bf6e
SHA256: da5fb593a7e461e9632f1a2b81e2a74194764a0d58894b54419686a16eb2b643
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\errorIcon.png
image
MD5: be8a54c465dfe66b7fda5d9540e1c7a8
SHA256: f962995ee41b70d6f599494b67c5e612dc6d52881349943d013dc1d0b9c95917
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\CleanUp.png
image
MD5: 20c2bd445101d21b57a05ac4d1e68982
SHA256: e3cd104fc129705a3ae28dee1091c06bafcc444e24d0bcb2bf37e08108416971
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\easeus.png
image
MD5: f6705918d6c5342097f2deea1c42160d
SHA256: feb7acb4a5780970d5032e742207b30ccdee905c087da6f3ccf3ec7298f3b5f2
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-2G11S.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-BQA7K.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-Q8PFR.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-HJT8P.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\16_16_32.ico
image
MD5: 1c265654e0ce00477fb42729a1f88e16
SHA256: 349a0c4642bc8c039c541961e9eac0e94e8ff18298e0ae0fc422e87fcb0df839
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\32_32_8.ico
image
MD5: 637a063ce0f2f1200845fda601219816
SHA256: ebe359211a26c1d19c7b3dfd0bc9ea2c3215b5c0d3660df532e924583be2b426
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\48_48_32.ico
image
MD5: 70fb74874b3de05965d8bffab69c0198
SHA256: 119c61e307a2800b39ca721d2a010f66c7129f4343d3b9b63be73ad447d67e0b
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\192_192_32.ico
image
MD5: 99c9d716b32cf7f453080c701103d339
SHA256: 1e38acd45234d9d84ecb78029d266c0804e74568143378087584cae1cac13208
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\32_32_32.ico
image
MD5: 7f16f8ba1b8f1066061d86b0ce2a6042
SHA256: 6ad46a1c03090abfac6e202d89bab969ebde097416bd542f162b04c7415fea26
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\16_16_8.ico
image
MD5: 9e5006bcfb81558720d67b3d96808938
SHA256: 296a8c04445ae9c6bbf701bcdf0d864d895c0a50a01edb6dcf286d874668f1a4
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-RSGLN.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-DM7QD.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-E2G48.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-4L9UN.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-AG4HB.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\version_bg.png
image
MD5: b7d210386088d0a7fd437a18b530a7fd
SHA256: 76acac9656f00c3eb0063accd2fcbac01ca15224ef48f9018499c381038e5ecd
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\560x350-epm-main-flash-win32.bmp
image
MD5: ba29491961e480b42e5b7137fe9949d3
SHA256: e2eec1a3cff36a3a107fcc51902cb75e77fffce41783a189e0dcd97bfd4d981f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-ILD92.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS-x64\epm\res\is-N3BJM.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-EJ6NQ.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\500x140-epm-update-info.bmp
image
MD5: 4f8ef808b09e597a653deb50881bbdba
SHA256: ea82e6db4792180aa4a9ef283f6fe909463b109b34fb53ffe2613206cf6a9055
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\Yiwo.png
image
MD5: 8c91bebfb76e779b532f7a0b3ac90b5f
SHA256: dd8d04cce7857a2a761022feffd04af278e23a99084fe99c3ff0ba85364ae83b
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\warnIcon.png
image
MD5: df5b43cda7d28a57cf69ea1eb637d4bd
SHA256: e4903376aa27fd5e73a30e8fcd95bd8ec7ac9b26484502cea22a4e0b245b59cc
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\winpe.ico
image
MD5: 599916ba18da7d02afa613601e91ff46
SHA256: 8048b657923e6d49c330ffd3e42ee39e752b766db2dde02b46c6a2d306d2b7bd
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\560x350-epm-main-flash-linux.bmp
image
MD5: ba29491961e480b42e5b7137fe9949d3
SHA256: e2eec1a3cff36a3a107fcc51902cb75e77fffce41783a189e0dcd97bfd4d981f
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-862V6.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-LSG62.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-9UO42.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-BSF79.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-EUQEH.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\tab_btn_left.png
image
MD5: 2dfd04cd6e6f619d55bf05eedc004990
SHA256: e2fc0261b79ae7321dfc26065b4d34d0b2b69c61e3b33ee5ecc84789ccfe23f5
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\tab_btn_hover_mid.png
image
MD5: 0d876a3ebb5a1427dfef6db419a21720
SHA256: 2c11628ccc48dc56ea887c962bb265bb182d7d422a826b5b748e52231f67de03
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\UnconnectServer.png
image
MD5: 3e41ebc93aa375b88760a5eed11f7d4a
SHA256: fa1ae9607cc4015bd55ecc9d0d845ff846c69007ca01032e53a1e13b7e9e5e33
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\tab_btn_right.png
image
MD5: 5a9925473d85c2a6a41ff2ae24180c35
SHA256: cbfe3efd771f8309f80333dc936587a2b25034eefd32d92f7c6accf02d8a9dcd
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\tab_btn_hover_right.png
image
MD5: a46daefa73692268fc6228afc97ca52c
SHA256: 72ea8d6e4c57593e15f572742cd23fe4d3afa558876c4ce2dc4f22df9a4b9101
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\tab_btn_mid.png
image
MD5: 3e8f738a7ca7988ce97420454a2a9513
SHA256: 767fe4fde5492780320d8b4079846fb4edbba73ed6f3d3c18880e2b368bcac8a
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-6I49U.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-NO02L.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-KQV8P.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-26B7Q.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-34GV7.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-APM8S.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\tab_btn_hover_left.png
image
MD5: 19fe656941ca9aa1d04e78a5c1877280
SHA256: 0d1cf1df6ad80a6359451389a662093e1906121b2ad199aa9aa8a80aab2d8978
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\tab_btn_cur_mid.png
image
MD5: e53488e927361233c5983d973f33654c
SHA256: ea8fa80378e81066b9e40e47a332113d2e7ae6d99d201e415773180d3f1cbd5d
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\tab_btn_cur_right.png
image
MD5: 38e33a9236dcf981976c28803dc3517a
SHA256: 440037d597daa618e779f934ff4477fe85b8d0f83e641f8991c36a89002afbbf
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\success_b.png
image
MD5: e58f50299da95d59e10be0483e8cd10c
SHA256: c2dcacf94d814f182021d74c4d5561fbffe560a9c2299011be70c2b35cf3c745
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\tab_btn_cur_left.png
image
MD5: 321419c9bbd9e134dbbafce0efcc259f
SHA256: 6ccbf50e4f701676c990cb4676fd0759159633a5217cafe4e7cde3e75f1b301c
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-ETUIE.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-VFVKJ.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-U3LNM.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-1BA17.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-JBMGB.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\errorIcon.png
image
MD5: be8a54c465dfe66b7fda5d9540e1c7a8
SHA256: f962995ee41b70d6f599494b67c5e612dc6d52881349943d013dc1d0b9c95917
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\info.png
image
MD5: cf56eaabefecb13a88ae44cd74021351
SHA256: b34b7f65038eb92ba0e0a77bf50c95ba3e9591acd1e86c629581ea314f798f74
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\CleanUp.png
image
MD5: 20c2bd445101d21b57a05ac4d1e68982
SHA256: e3cd104fc129705a3ae28dee1091c06bafcc444e24d0bcb2bf37e08108416971
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\48_48_8.ico
image
MD5: fb85222f1cdb34f86a1d8d102fb0bf6e
SHA256: da5fb593a7e461e9632f1a2b81e2a74194764a0d58894b54419686a16eb2b643
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\easeus.png
image
MD5: f6705918d6c5342097f2deea1c42160d
SHA256: feb7acb4a5780970d5032e742207b30ccdee905c087da6f3ccf3ec7298f3b5f2
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-7L5A6.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-DFP00.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-HEQRO.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-FG9OK.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-9075T.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\32_32_32.ico
image
MD5: 7f16f8ba1b8f1066061d86b0ce2a6042
SHA256: 6ad46a1c03090abfac6e202d89bab969ebde097416bd542f162b04c7415fea26
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\32_32_8.ico
image
MD5: 637a063ce0f2f1200845fda601219816
SHA256: ebe359211a26c1d19c7b3dfd0bc9ea2c3215b5c0d3660df532e924583be2b426
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\192_192_32.ico
image
MD5: 99c9d716b32cf7f453080c701103d339
SHA256: 1e38acd45234d9d84ecb78029d266c0804e74568143378087584cae1cac13208
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\48_48_32.ico
image
MD5: 70fb74874b3de05965d8bffab69c0198
SHA256: 119c61e307a2800b39ca721d2a010f66c7129f4343d3b9b63be73ad447d67e0b
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-UNDL7.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-7KG45.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-QQ9KP.tmp
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\EaseUS\epm\res\is-L5FBD.tmp
––
MD5:  ––
SHA256:  ––
2404
EuDownload.exe
C:\Users\admin\AppData\Local\Temp\euphtupdate.ini.eud
––
MD5:  ––
SHA256:  ––
128
SETUP.tmp
C:\Program Files\EaseUS\EaseUS Partition Master 12.10\BUILDPE\x86\Windows\System32\winpeshl.ini
text
MD5: cd86d2fd974c7678d89980eb6efbf3c0
SHA256: 6f6