home

apr.exe

Jiang Xiaoxia

This is a setup program which is used to install the application. The file has been seen being downloaded from asoftech-photo-recovery.softonic.com and multiple other hosts.
Publisher:
Asoftech Photo Recovery   (signed by Jiang Xiaoxia)

Product:
Asoftech Photo Recovery

Version:
3.16

MD5:
c713c13e9c55bdd8c8f4c9dfedce7f14

SHA-1:
65a3ba0cb0a223e4fd4a6124e202efaa1144f281

SHA-256:
212d5a5c4f1a07cce587cc4a56434199d0bb9aacaf0ebe35965995ec91f7bcea

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/24/2024 9:01:28 PM UTC  (today)

File size:
4.1 MB (4,311,560 bytes)

Product version:
3.16

Original file name:
stub32i.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\apr.exe

Digital Signature
Signed by:
Jiang Xiaoxia

Authority:
The USERTRUST Network

Valid from:
4/14/2009 7:00:00 PM

Valid to:
4/15/2011 6:59:59 PM

Subject:
CN=Jiang Xiaoxia, O=Jiang Xiaoxia, STREET="#12-05, 252 compassvale street", L=Singapore, S=Singapore, PostalCode=540252, C=SG

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
00B33ABCB5BED88B131CB14F3A10CD5710

File PE Metadata
Compilation timestamp:
8/2/2002 2:01:18 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:Eq6Z87pV3kjikyD2YFzeAB5EY8fiT3aEtHRl0tCzPJB4WU:V6u7p+ll+zBEYsie4xM4vbU

Entry address:
0x8AF7

Entry point:
55, 8B, EC, 6A, FF, 68, 20, 43, 41, 00, 68, F0, C3, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 58, 53, 56, 57, 89, 65, E8, FF, 15, F0, 41, 41, 00, 33, D2, 8A, D4, 89, 15, 7C, 93, 41, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 78, 93, 41, 00, C1, E1, 08, 03, CA, 89, 0D, 74, 93, 41, 00, C1, E8, 10, A3, 70, 93, 41, 00, 33, F6, 56, E8, 70, 02, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, B0, 00, 00, 00, 59, 89, 75, FC, E8, D1, 36, 00, 00, FF, 15, F4, 41, 41, 00, A3, 4C, BA, 41, 00, E8...
 
[+]

Entropy:
7.9877

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
76 KB (77,824 bytes)

The file apr.exe has been seen being distributed by the following 22 URLs.

https://asoftech-photo-recovery.softonic.com/download-tracker?th=8yS3 KGEYLiw7GKMHzA/trmsvRChbxdrflJq3ZIylWuZz/z9rjSQWPa0r2xNa1vsmtkimeFSd2uE4HIw355sU1uk13S cQkUb1Y0RpYeF7l/.../O6omySOGx3nQvf Aqd6Bpki8iVnMZIA5k=

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1454387480&Signature=MN~Rplw1gZm74SGeIE1lx1~SbZSpTjDKdYS1B6gIpvu-1fNXVoGYro~h4d3RbeH~GwpVcgH2DouEask7ffsX3NeWVZUZT3N2D-xb8FOqzsCFWBpoZ1yliqfMbvvPzgNdg70U~UYRdmlzcspo48jXxV9uYbGT-wT2wpKprEwaS2k_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=apr.exe

http://asoftech-photo-recovery.software.informer.com/.../

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1476454405&Signature=fncPjDWYl4dYj5BW7Su-eT-yQh4vflu2~meUZJ5Nmd658ZGGh4wPHFVGzWBr3JSsM1g09IWMOJmCLN8JF0TutT736ApF2C0lxIXWRLITGyc3I-U3t380Rata-O14T0gT5fp2EuHGB~-nc8KJzbadTQX8iqjwnRpU1H6CLwX9YIQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=apr.exe

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1433610687&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=cqifjspk89Y3U013HSbnONQycl4t439vtYTTURirEHeV3Kex~JjptFhyjTcTyFz7wZlsZjzQK1wvdRhVvcuZa6iONX~sak1bLHFCpVQzgo5R62MlRqQG5cw0WMtBfdZVpxDGiv15UhQJ9EnfkbWVxc1gMFU7D59M7GGGk1w4Agg_&filename=apr.exe

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1477645012&Signature=Rj-jnaYHxAxOvhDfJi86BwFL8Dst4-qzcJjwXkg~SQZv2lWFs3wLkEcwnec5XnKuLN5o3aLJnZ2lPX821PcmOYE6uelJD4uU3YAh~DMkwshZCR3hrNM4kI9LGO6KbtEESlaEgU5DN-tY43Jvzq8dryJhGZ8gCluUEqCvbU9VVBA_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=apr.exe

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1435723973&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=LTZ9AHzW37BLvLebZu5UzgqSWp0DPv2q-tae7d5Hji2ftMnyhLAOxhGyZpta3mXCffdzealZPo0er3SW6qQWrGjSErDkfeHNwRfCytn-TtsASo7MQxG-eA43~g2jKCgDFEL2kSSbAD~Fc8MkGS4V89wnt65uXNmfxpPQ7e1yajI_&filename=apr.exe

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1434768020&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=fpFplXknnZ~Gikt6zHhhqFteJKFdY1TuQ66qtandUEw~6Awofd-~D5UAq5xRM7eOTwsSN9-Yor28iMHpX6N95Dhj4yhBNImv5RNRyl97f8BztN9nA01w~NP0pFOIGyMkkpX6~0tyqZ4RlHs5YFLb-XBpOE9TRET6eVWRUoCWNTQ_&filename=apr.exe

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1470811857&Signature=XfFvDG4Fi1dbdAbt5zuTTdyVSL9WQA6AI2BAt~IvrMoDkjjk0VDTFZGdhNd5Cg7iHA-vRyRqe7sZWU5cZ8BjLaUnmecamHW-B9arXWjyK~nyYN8uN4819Jz3VnYDDxmzxG3SltvUbsi0pWtrKzSelfH1kKNKFKqLzy86ievXJK8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=apr.exe

temp:apr.exe

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1424266764&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=ZzTEAYMYQFoUt9Exi-WhJUXKwbCqT7AgR71QXoKglSaCtZyMWf63s8W6sJLxgSIRKF0nKsWpAblVIHNMeBsTbilBybfdVy7Ur3MX7dv-jbr7PT8UrGygKPj3DPtvP8PgCWsYDyi070HlsS5t-REElW44ezSZ9m8cf5WCw7ikW4I_&filename=apr.exe

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1466349073&Signature=eTAyhtGdbk4RHj~QV85YTqlDTwgbbSd71XwecWW4zpcB5feXFC1pfrEfwFZ8Magwumgx7V~X-Y23cxjY9dOwQVo5VVnAXVyUrvl~B11i8YBVvy2dwOwo0acfS5LJ2lRFi1yphLKL88w7d5mp~Ilzi1~TwEFBpDXWjW0INbk~KM4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=apr.exe

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1465901983&Signature=FwQQ07ONZl6TE-o76a07VCFlOss66VfI0fe~5rHqatxd-jL5fdv2DhOjf0M8YLeNpcK6UHZRP5FGDK4s389fVXc96bGvBwMvYLJyS765jWmYfDidCHDvJ7wR9Fi4QdtCXIyU5cK80qf2sI62BmW81UtYjcgQspxYmwfYO3OkZhI_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=apr.exe

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1461832844&Signature=dBoLK-610yoIGMNIDrbht-ZMJlEkvXvqddotvVGytntEaIiEl-FltQbVzC7lqDsIVMpwxCZpf1MxefLyDivyjBCiPZgRcdB-qutHi27Ij5HNR1LIZhTnWZP~8lzTwyfMkVnP5yA-8lZdIhKu1yV6gOVpPzeULNX8SMnsg~bxFeg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=apr.exe

http://asoftech-photo-recovery.softonic.com/download-tracker?th=8yS3 KGEYLiw7GKMHzA/trmsvRChbxdrflJq3ZIylWuZz/z9rjSQWPa0r2xNa1vsmtkimeFSd2uE4HIw355sU1uk13S cQkUb1Y0RpYeF7l/.../O6omySOGx3nQvf Aqd6Bpki8iVnMZIA5k=

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1441667420&Signature=W1jUqpVi0D2alzsUfzTryy~vSGO~5MIDZVjGsiGa0BjdCo3xf~CtczifiP1q2RAGy1SS5bv7IISpeIyAXgMIrQZr~80YfEv4Jtkx~JnqY1pHAwhqValh5RJWD5B3AfcrmoDf-6pwnyaEdHY4S4tnE6Vh6wPIg3CTbOJtggxtBFQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=apr.exe

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1441346695&Signature=XBNHQ9a7-G2IkAYgzhoSWn0sf4MPNfiGp20aRTj1lmcm4TeONFvAUNdF31ld-j1uqoAi7aWVY7ySts0nhmCl4PfA8M-RjBxElEQTUef5tEr5UDplH~Jj-hSlyRZLWAuEO436SQ2KDD5h6ab6YSdlReLJNYYT5Dpkhgxyagseu38_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=apr.exe

http://www.download3k.es/DownloadLink1-Asoftech-Photo-Recovery.html

http://gsf-cf.softonic.com/65a/3ba/.../file?SD_used=0&channel=WEB&fdh=no&id_file=102669&instance=softonic_es&type=PROGRAM&Expires=1446958289&Signature=Q7OVh5NvoB4ITmMLyZHE5BMZOE-VPgGnmQKYOZmPfMt5zVOOm4cj1uA0~EzZM1FiiKzHR8a4JQqAc-wMmziVxfmwdzGNKEylL9E4CNPSW2XxMHSEFnZtq7eJxfPc4sUkdredBH47d3DcyPC~a-1LQbBxMIub2R0EO4hVLMgXViY_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=apr.exe

http://files.downloadnow.com/s/software/12/83/89/.../apr.exe

http://software-files-a.cnet.com/s/software/12/83/89/.../apr.exe

http://www.asoftech.com/.../apr.exe

Scan apr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.