Analysis

  • max time kernel
    94s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    15-08-2023 04:40

General

  • Target

    Setup.exe

  • Size

    27.3MB

  • MD5

    21919d244fa0ed925bb1496300a7d33f

  • SHA1

    29da71b6dce7bd5d6ccfce809d0130342e7d4556

  • SHA256

    9777e954f9c28380af366aec16baf3c1ba1078c7365e3f508dddb9aa70da4773

  • SHA512

    6d0a090f03eeec977191ae948e451c761acf2e39db962d15a9a93334539591be17cba120f9c185e1d7abdfaa8bcef544c463e1fc9487ee4aff75ecedcacd84b0

  • SSDEEP

    786432:BCsQnMs9rX1IMbNz/JH1gfkcnD/+XV6TuulyukTp3v13:CphzV1gfdm6Tm113

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 5 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 45 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Users\Admin\AppData\Local\Temp\is-LI8BE.tmp\Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-LI8BE.tmp\Setup.tmp" /SL5="$4021A,28078196,488960,C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Program Files\MiniTool Partition Wizard 12\experience.exe
        "C:\Program Files\MiniTool Partition Wizard 12\experience.exe" http://tracking.minitool.com/pw/installation.php?from=full-12.7
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:1168
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1168 -s 2184
          4⤵
          • Program crash
          PID:2956
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 444 -p 1168 -ip 1168
    1⤵
      PID:5028
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3996
      • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe
        "C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe"
        1⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:4424
      • C:\Windows\System32\vdsldr.exe
        C:\Windows\System32\vdsldr.exe -Embedding
        1⤵
          PID:4724
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
            PID:4232
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x300 0x2cc
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2956

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\MiniTool Partition Wizard 12\LIBEAY32.dll

            Filesize

            1.6MB

            MD5

            aaae8fe70e4c9da4acf5b6445fe7d9a3

            SHA1

            9916fdcbca4584cfd2e5fb86d187df1bdfae40ef

            SHA256

            e0297bc3b64d0f39fa0fbf751216dc150ecd1cf403440d5b533d132c9b185cae

            SHA512

            dc8ddcf3fbf71b85ccdab0d2c20fc002033ceb96370e0f034f4c35ec8588b2a52de63678461b8fe9c516e76420a4a3f39881b1fcd46e2b9563b1928f6cf21f66

          • C:\Program Files\MiniTool Partition Wizard 12\MSVCP120.dll

            Filesize

            644KB

            MD5

            edef53778eaafe476ee523be5c2ab67f

            SHA1

            58c416508913045f99cdf559f31e71f88626f6de

            SHA256

            92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f

            SHA512

            7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8

          • C:\Program Files\MiniTool Partition Wizard 12\MSVCR120.dll

            Filesize

            940KB

            MD5

            aeb29ccc27e16c4fd223a00189b44524

            SHA1

            45a6671c64f353c79c0060bdafea0ceb5ad889be

            SHA256

            d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa

            SHA512

            2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006

          • C:\Program Files\MiniTool Partition Wizard 12\PowerDataRecoveryCore.dll

            Filesize

            1.3MB

            MD5

            4c04eadacd29a6bea5ee15d3a694c05c

            SHA1

            67dd10855aab97b37f018a99fa1d67cd819ea443

            SHA256

            b56e3a15fc895a874735e30511d652f8759df832cd444fa45f79db5ca4aafb2a

            SHA512

            ed757299701495f739aacdc6c78df31a30407ed8793f3dcf8caf72317f9eb2c4f3973880f8b7f47864145055f08c1595464a46c00849bc1b70c48897a8baaad3

          • C:\Program Files\MiniTool Partition Wizard 12\PowerDataRecoveryUI.dll

            Filesize

            6.2MB

            MD5

            8735623b74b43a2c24ff5cd0925206d7

            SHA1

            45d54f23ed7903390aaec67eb2953cb65daf7bb7

            SHA256

            fd12d1eaab6162760eebd363a18fd88a95d26b7ec4035fcd9a6e066398a687c3

            SHA512

            8c1dec78f516d89994b78a4ec40dcb03aea957190c8a0b0de2d05bec0df7d05edc3721258fa93b74dbc31993c3a5d4d9633b9b5f3732a7cf2224d5acf037b5f1

          • C:\Program Files\MiniTool Partition Wizard 12\PowerDataRecoveryUI.dll

            Filesize

            6.2MB

            MD5

            8735623b74b43a2c24ff5cd0925206d7

            SHA1

            45d54f23ed7903390aaec67eb2953cb65daf7bb7

            SHA256

            fd12d1eaab6162760eebd363a18fd88a95d26b7ec4035fcd9a6e066398a687c3

            SHA512

            8c1dec78f516d89994b78a4ec40dcb03aea957190c8a0b0de2d05bec0df7d05edc3721258fa93b74dbc31993c3a5d4d9633b9b5f3732a7cf2224d5acf037b5f1

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Charts.dll

            Filesize

            1.3MB

            MD5

            07e4bd7c3a018d39206e9a30c35d9320

            SHA1

            f1cf5dd2e45bf2d9020855d469c60fcee7f22046

            SHA256

            f22551ef3c8628430749a04189d5ae15ebcd74779ad2157a2ef2b7fc12249cec

            SHA512

            00c5d0a0fd623d1657ff91b8b6ab118a01eca837227a234af34aeccab678feac2cb0cb76ff768eae68bbf150432ef7bd549c57d0665f62f80a71866df67d875a

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Charts.dll

            Filesize

            1.3MB

            MD5

            07e4bd7c3a018d39206e9a30c35d9320

            SHA1

            f1cf5dd2e45bf2d9020855d469c60fcee7f22046

            SHA256

            f22551ef3c8628430749a04189d5ae15ebcd74779ad2157a2ef2b7fc12249cec

            SHA512

            00c5d0a0fd623d1657ff91b8b6ab118a01eca837227a234af34aeccab678feac2cb0cb76ff768eae68bbf150432ef7bd549c57d0665f62f80a71866df67d875a

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Core.dll

            Filesize

            5.3MB

            MD5

            a7e479e3fb8c45b4b572a301588c0de0

            SHA1

            a254d7e90a27196a6e40b9daacc1f72748ccc155

            SHA256

            a71c5a226fbb4334353cc1d0f4abacba8a509f8544f286d352e1ec29c86c0742

            SHA512

            92c4303df4967d48a957d258dc2502eedd50a39c7d5d2120f69233f53d67dde13be7112309dd71c0ba9b005951e59a416c5139861522c73cfba3bd49e6b370ae

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Core.dll

            Filesize

            5.3MB

            MD5

            a7e479e3fb8c45b4b572a301588c0de0

            SHA1

            a254d7e90a27196a6e40b9daacc1f72748ccc155

            SHA256

            a71c5a226fbb4334353cc1d0f4abacba8a509f8544f286d352e1ec29c86c0742

            SHA512

            92c4303df4967d48a957d258dc2502eedd50a39c7d5d2120f69233f53d67dde13be7112309dd71c0ba9b005951e59a416c5139861522c73cfba3bd49e6b370ae

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Core.dll

            Filesize

            5.3MB

            MD5

            a7e479e3fb8c45b4b572a301588c0de0

            SHA1

            a254d7e90a27196a6e40b9daacc1f72748ccc155

            SHA256

            a71c5a226fbb4334353cc1d0f4abacba8a509f8544f286d352e1ec29c86c0742

            SHA512

            92c4303df4967d48a957d258dc2502eedd50a39c7d5d2120f69233f53d67dde13be7112309dd71c0ba9b005951e59a416c5139861522c73cfba3bd49e6b370ae

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Core.dll

            Filesize

            5.3MB

            MD5

            a7e479e3fb8c45b4b572a301588c0de0

            SHA1

            a254d7e90a27196a6e40b9daacc1f72748ccc155

            SHA256

            a71c5a226fbb4334353cc1d0f4abacba8a509f8544f286d352e1ec29c86c0742

            SHA512

            92c4303df4967d48a957d258dc2502eedd50a39c7d5d2120f69233f53d67dde13be7112309dd71c0ba9b005951e59a416c5139861522c73cfba3bd49e6b370ae

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Gui.dll

            Filesize

            5.7MB

            MD5

            89c68c9d29d7c527097eb4a1317f71ad

            SHA1

            58add7d0d991931ac92eb144e007894412ae570a

            SHA256

            be00d70e40813e1a8ae4715b8e3cdbfb6470dbffc7d591459bb4afc30e77f715

            SHA512

            bfe224dec896857ebe32e75e52823f821b3791312d9629d63b565e2cd12e1854aff5e66cc416555dfbe08887a6171dfb6393e9084a0adaa2ee3528aaf0e2617f

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Gui.dll

            Filesize

            5.7MB

            MD5

            89c68c9d29d7c527097eb4a1317f71ad

            SHA1

            58add7d0d991931ac92eb144e007894412ae570a

            SHA256

            be00d70e40813e1a8ae4715b8e3cdbfb6470dbffc7d591459bb4afc30e77f715

            SHA512

            bfe224dec896857ebe32e75e52823f821b3791312d9629d63b565e2cd12e1854aff5e66cc416555dfbe08887a6171dfb6393e9084a0adaa2ee3528aaf0e2617f

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Gui.dll

            Filesize

            5.7MB

            MD5

            89c68c9d29d7c527097eb4a1317f71ad

            SHA1

            58add7d0d991931ac92eb144e007894412ae570a

            SHA256

            be00d70e40813e1a8ae4715b8e3cdbfb6470dbffc7d591459bb4afc30e77f715

            SHA512

            bfe224dec896857ebe32e75e52823f821b3791312d9629d63b565e2cd12e1854aff5e66cc416555dfbe08887a6171dfb6393e9084a0adaa2ee3528aaf0e2617f

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Gui.dll

            Filesize

            5.7MB

            MD5

            89c68c9d29d7c527097eb4a1317f71ad

            SHA1

            58add7d0d991931ac92eb144e007894412ae570a

            SHA256

            be00d70e40813e1a8ae4715b8e3cdbfb6470dbffc7d591459bb4afc30e77f715

            SHA512

            bfe224dec896857ebe32e75e52823f821b3791312d9629d63b565e2cd12e1854aff5e66cc416555dfbe08887a6171dfb6393e9084a0adaa2ee3528aaf0e2617f

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Network.dll

            Filesize

            1.0MB

            MD5

            68ec8a5f852fe3eca746393e01124ad3

            SHA1

            8d750ef88248e20316056e5f7a09a7973cb7145a

            SHA256

            1e971e5e8996b350622f447c88dd6d020cb4c32c259550aef29b9fdac8df9645

            SHA512

            efa0294bc337d039b49a806e542d8cdf948054594dea02f8ccf09ade4942a49c566d6804b5d9e5f439ff5a78dd74c67143fcd54e778201fab57174faec259084

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Network.dll

            Filesize

            1.0MB

            MD5

            68ec8a5f852fe3eca746393e01124ad3

            SHA1

            8d750ef88248e20316056e5f7a09a7973cb7145a

            SHA256

            1e971e5e8996b350622f447c88dd6d020cb4c32c259550aef29b9fdac8df9645

            SHA512

            efa0294bc337d039b49a806e542d8cdf948054594dea02f8ccf09ade4942a49c566d6804b5d9e5f439ff5a78dd74c67143fcd54e778201fab57174faec259084

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Widgets.dll

            Filesize

            5.3MB

            MD5

            d654ed44099c61cf7ddc07dabeca28d3

            SHA1

            1acf0f22f3cb15585fe8ec97dad00eda8ac30d51

            SHA256

            3bc64a69dc06e7a12442c04225630ba57c779d6e9e4e1aff9f986c3e68883f27

            SHA512

            9012f71a8dd27c56b46b341c97a8ac964bdf399f1f9d8740763be34bc4d179db5bb4fbee153e715990a37c2b1391b2622bcacffe32756abfaceb45183bf7f0ea

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Widgets.dll

            Filesize

            5.3MB

            MD5

            d654ed44099c61cf7ddc07dabeca28d3

            SHA1

            1acf0f22f3cb15585fe8ec97dad00eda8ac30d51

            SHA256

            3bc64a69dc06e7a12442c04225630ba57c779d6e9e4e1aff9f986c3e68883f27

            SHA512

            9012f71a8dd27c56b46b341c97a8ac964bdf399f1f9d8740763be34bc4d179db5bb4fbee153e715990a37c2b1391b2622bcacffe32756abfaceb45183bf7f0ea

          • C:\Program Files\MiniTool Partition Wizard 12\Qt5Widgets.dll

            Filesize

            5.3MB

            MD5

            d654ed44099c61cf7ddc07dabeca28d3

            SHA1

            1acf0f22f3cb15585fe8ec97dad00eda8ac30d51

            SHA256

            3bc64a69dc06e7a12442c04225630ba57c779d6e9e4e1aff9f986c3e68883f27

            SHA512

            9012f71a8dd27c56b46b341c97a8ac964bdf399f1f9d8740763be34bc4d179db5bb4fbee153e715990a37c2b1391b2622bcacffe32756abfaceb45183bf7f0ea

          • C:\Program Files\MiniTool Partition Wizard 12\experience.exe

            Filesize

            253KB

            MD5

            b498d90133473c0c3d48a8ce91ea4914

            SHA1

            8fb4efa883d654ff512fcea44a609a55c70d0080

            SHA256

            bf390ec25796bb2d7ad4cfcbb2ccbf4465ad88d7eb820ce0eb5826bcd3e57ba5

            SHA512

            3442d6cfad8c9473b1d34da5f760576165f26c2f4a73d56ab0c37830ffa7ff3956fd9b255c4407c835348cf3e5d683793ef83690e3a2ee1ff9648d3f4611d5e3

          • C:\Program Files\MiniTool Partition Wizard 12\experience.exe

            Filesize

            253KB

            MD5

            b498d90133473c0c3d48a8ce91ea4914

            SHA1

            8fb4efa883d654ff512fcea44a609a55c70d0080

            SHA256

            bf390ec25796bb2d7ad4cfcbb2ccbf4465ad88d7eb820ce0eb5826bcd3e57ba5

            SHA512

            3442d6cfad8c9473b1d34da5f760576165f26c2f4a73d56ab0c37830ffa7ff3956fd9b255c4407c835348cf3e5d683793ef83690e3a2ee1ff9648d3f4611d5e3

          • C:\Program Files\MiniTool Partition Wizard 12\iconengines\qsvgicon.dll

            Filesize

            44KB

            MD5

            4b5ed33b6917ce9f315f7f240930b630

            SHA1

            c95b0c76577dc264100e7368dfe6e345c511a652

            SHA256

            3332cbeaef97669d24e69b21df4918b139883968b090deeb8fb83dee7e814f4a

            SHA512

            a82e3b7c838733439062229a53a12a67bb4d3ee1559c41778d305117c4df9999c8bb82e8387ed122c67e7bfb2cff634286bd51c530b487d64ae8f7c2fcf20c8b

          • C:\Program Files\MiniTool Partition Wizard 12\idriver.dll

            Filesize

            24KB

            MD5

            1d73159759b98050d2e0a4f33cbf6e6c

            SHA1

            998e8f560d48f2214cf9898b4e712871f67e71b4

            SHA256

            3c59b280aee2c8b733436b604fa89d7083dc4cf9ba0ecdc8f20d87347cb2197d

            SHA512

            a270a8db522d765c5af18c01cd75d4bbe47938fcc6c59e670c34a794193c50673a5adc59dce87de07805245ec5369aee54dcbef97dce67f5349ee10b9244912e

          • C:\Program Files\MiniTool Partition Wizard 12\idriver.dll

            Filesize

            24KB

            MD5

            1d73159759b98050d2e0a4f33cbf6e6c

            SHA1

            998e8f560d48f2214cf9898b4e712871f67e71b4

            SHA256

            3c59b280aee2c8b733436b604fa89d7083dc4cf9ba0ecdc8f20d87347cb2197d

            SHA512

            a270a8db522d765c5af18c01cd75d4bbe47938fcc6c59e670c34a794193c50673a5adc59dce87de07805245ec5369aee54dcbef97dce67f5349ee10b9244912e

          • C:\Program Files\MiniTool Partition Wizard 12\ikernel.dll

            Filesize

            3.1MB

            MD5

            2e77f83f90815bc85fa35175604cde51

            SHA1

            da668a696086b43b315c725e2d364396f3a62013

            SHA256

            6a3958dce7b4fe1eee80ab6b1890ade6dd551e0979385da9dd00e2a0291a14a1

            SHA512

            c8c167939a5dd0b37b9db87ae96f80ebf6b2ca1a0a69c77a64d363de75bea1c4879f0b445a921908fe4fbed122f7ea275dfc424cc31ab5b1657b0fe74383b3bc

          • C:\Program Files\MiniTool Partition Wizard 12\ikernel.dll

            Filesize

            3.1MB

            MD5

            2e77f83f90815bc85fa35175604cde51

            SHA1

            da668a696086b43b315c725e2d364396f3a62013

            SHA256

            6a3958dce7b4fe1eee80ab6b1890ade6dd551e0979385da9dd00e2a0291a14a1

            SHA512

            c8c167939a5dd0b37b9db87ae96f80ebf6b2ca1a0a69c77a64d363de75bea1c4879f0b445a921908fe4fbed122f7ea275dfc424cc31ab5b1657b0fe74383b3bc

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qdds.dll

            Filesize

            56KB

            MD5

            cd58de80b21c0da2b242c15dfd825196

            SHA1

            4f0fc112d823c2360a1a0577e1aa845355b722ef

            SHA256

            181ed94d3ad037ddf8ab60bb552ab852afcfa1a759c3adea06bda9f07692be79

            SHA512

            8039269c51e93c9f97fbde1e4aa6f61e84afdf9b07f26da590f009820c6df4a5fdbcbf76d24ff42442f754189d6cbadc8384c079283fe3b4e4fa958033b3623b

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qdds.dll

            Filesize

            56KB

            MD5

            cd58de80b21c0da2b242c15dfd825196

            SHA1

            4f0fc112d823c2360a1a0577e1aa845355b722ef

            SHA256

            181ed94d3ad037ddf8ab60bb552ab852afcfa1a759c3adea06bda9f07692be79

            SHA512

            8039269c51e93c9f97fbde1e4aa6f61e84afdf9b07f26da590f009820c6df4a5fdbcbf76d24ff42442f754189d6cbadc8384c079283fe3b4e4fa958033b3623b

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qgif.dll

            Filesize

            37KB

            MD5

            83a8a84a578656713d9cb48dc2df9a92

            SHA1

            0105569de76fabe34bacdebf2d4cf045b4ebb1ec

            SHA256

            503c306efd3394eb0f9617c481b0fa5964ee690badea992a592b6241db2aaf3a

            SHA512

            d9706e49b63b56769e427af9f3b11ed5e19028254f950adf23c3d0d0d6279627e0983bad715e88ff3bf6aa72550ba5ccdc25e688a1b89ced71bd728fbcd379ee

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qgif.dll

            Filesize

            37KB

            MD5

            83a8a84a578656713d9cb48dc2df9a92

            SHA1

            0105569de76fabe34bacdebf2d4cf045b4ebb1ec

            SHA256

            503c306efd3394eb0f9617c481b0fa5964ee690badea992a592b6241db2aaf3a

            SHA512

            d9706e49b63b56769e427af9f3b11ed5e19028254f950adf23c3d0d0d6279627e0983bad715e88ff3bf6aa72550ba5ccdc25e688a1b89ced71bd728fbcd379ee

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qicns.dll

            Filesize

            44KB

            MD5

            48dad7bb1b009d171dbf7abb4a48a979

            SHA1

            ed4e972de80c9dd8987e1a6f26a2175e3618cdce

            SHA256

            a1a7fc64e928a3bee12295ff613be9a13d1d2fd3e934e7726c0cfa33d24bf6fb

            SHA512

            41e6bedfe1cc3dd0e798c8701220e545128b09112fc5c9243df18f6c1aec371cc5aa592fc92d9b0bef3bbcc376d23f120078a91088ba6bdfd8bf7d3553ad1f78

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qicns.dll

            Filesize

            44KB

            MD5

            48dad7bb1b009d171dbf7abb4a48a979

            SHA1

            ed4e972de80c9dd8987e1a6f26a2175e3618cdce

            SHA256

            a1a7fc64e928a3bee12295ff613be9a13d1d2fd3e934e7726c0cfa33d24bf6fb

            SHA512

            41e6bedfe1cc3dd0e798c8701220e545128b09112fc5c9243df18f6c1aec371cc5aa592fc92d9b0bef3bbcc376d23f120078a91088ba6bdfd8bf7d3553ad1f78

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qico.dll

            Filesize

            38KB

            MD5

            d3f182546f058a7e4f62d258420f2aa5

            SHA1

            80664c4508ce02448713cc6f34d0a8b13dcd4cd0

            SHA256

            fd738fdaacc34c9a01a547bd18d3ca1ac620096cdb3e1f94895ac08b371d40d0

            SHA512

            c2e28c0530e54e0e4455a5da082e3420833cbf48d9a267e97b3cd1e63b32fe93e03f211d0a5401f11013d6061b6a49b76d009dea6ff367327dea2f562b4b75bf

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qico.dll

            Filesize

            38KB

            MD5

            d3f182546f058a7e4f62d258420f2aa5

            SHA1

            80664c4508ce02448713cc6f34d0a8b13dcd4cd0

            SHA256

            fd738fdaacc34c9a01a547bd18d3ca1ac620096cdb3e1f94895ac08b371d40d0

            SHA512

            c2e28c0530e54e0e4455a5da082e3420833cbf48d9a267e97b3cd1e63b32fe93e03f211d0a5401f11013d6061b6a49b76d009dea6ff367327dea2f562b4b75bf

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qjpeg.dll

            Filesize

            239KB

            MD5

            0b682ba9c08df63e406546dc2b4349b5

            SHA1

            c0485e7e1fcd5e7d5324cc8c0f3a66652a855a1e

            SHA256

            5cda55e959ff3d8ed56710b077be98373986fc698d0eb2c29526904f7355a3ec

            SHA512

            77dae7de8dadb6df9d51222b3ac5091fc25b8dd642edf7dfa77ba98649effbff316f22af6340ae851793a29cd54bd5bfeb884eabc6bea49f96e0ec58ad598887

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qjpeg.dll

            Filesize

            239KB

            MD5

            0b682ba9c08df63e406546dc2b4349b5

            SHA1

            c0485e7e1fcd5e7d5324cc8c0f3a66652a855a1e

            SHA256

            5cda55e959ff3d8ed56710b077be98373986fc698d0eb2c29526904f7355a3ec

            SHA512

            77dae7de8dadb6df9d51222b3ac5091fc25b8dd642edf7dfa77ba98649effbff316f22af6340ae851793a29cd54bd5bfeb884eabc6bea49f96e0ec58ad598887

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qsvg.dll

            Filesize

            31KB

            MD5

            1014f8919ff8a28b5f834b8d0c462b28

            SHA1

            1d1fe59e497996f1688e993d8917cf6ab1bb3be0

            SHA256

            2aae1e9a9e910ead378889e5f9db669ec497d164d997e81612afac60ccb02c46

            SHA512

            ca09812e5a0630459dad76f9c06bb62f3a99be340bd619f4db149905ba45a39313891bfda7af362d44540de6a6d7d4db7aa263ab74e79fc24a32f59d8ba4be3b

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qsvg.dll

            Filesize

            31KB

            MD5

            1014f8919ff8a28b5f834b8d0c462b28

            SHA1

            1d1fe59e497996f1688e993d8917cf6ab1bb3be0

            SHA256

            2aae1e9a9e910ead378889e5f9db669ec497d164d997e81612afac60ccb02c46

            SHA512

            ca09812e5a0630459dad76f9c06bb62f3a99be340bd619f4db149905ba45a39313891bfda7af362d44540de6a6d7d4db7aa263ab74e79fc24a32f59d8ba4be3b

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qtga.dll

            Filesize

            30KB

            MD5

            3c5ca5a8c9ac8f6ef7d90e5d77f10bc8

            SHA1

            f2a21ae75e05a91d11ba64fa8afbec04d06c0473

            SHA256

            18e17b0ef4813d3b4571b9b03b28bd689693b1dcb84d5f689a833393165d5e54

            SHA512

            4d61ac4e29c58c58e03d5531050ed25f256c8fed34ace46811d912ddeab68176ad710af70c02d39e83c9f3829e941cb8cb20d9ac339235c205ea3208768bbc09

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qtga.dll

            Filesize

            30KB

            MD5

            3c5ca5a8c9ac8f6ef7d90e5d77f10bc8

            SHA1

            f2a21ae75e05a91d11ba64fa8afbec04d06c0473

            SHA256

            18e17b0ef4813d3b4571b9b03b28bd689693b1dcb84d5f689a833393165d5e54

            SHA512

            4d61ac4e29c58c58e03d5531050ed25f256c8fed34ace46811d912ddeab68176ad710af70c02d39e83c9f3829e941cb8cb20d9ac339235c205ea3208768bbc09

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qtiff.dll

            Filesize

            353KB

            MD5

            e2be460aa6ec66884db28140e2037312

            SHA1

            b0042775e540943ba160415bd060ee1d340a404b

            SHA256

            ed02f3a1070d1696e663e03b43da0350fab36160f1f486a5d7448994ae1046f9

            SHA512

            b28f9eeda258fb7579f8d1bc465303d1231771088587eea1a3829b1b90b6f2610338be79a6b5108285438782ac520981bdec430d395e80d38710202b89e8c509

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qtiff.dll

            Filesize

            353KB

            MD5

            e2be460aa6ec66884db28140e2037312

            SHA1

            b0042775e540943ba160415bd060ee1d340a404b

            SHA256

            ed02f3a1070d1696e663e03b43da0350fab36160f1f486a5d7448994ae1046f9

            SHA512

            b28f9eeda258fb7579f8d1bc465303d1231771088587eea1a3829b1b90b6f2610338be79a6b5108285438782ac520981bdec430d395e80d38710202b89e8c509

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qwbmp.dll

            Filesize

            29KB

            MD5

            aa0d9d5eae818c84384b614d7f376b35

            SHA1

            cc8e100d70b46ffc180dd75a245306cf8167ad02

            SHA256

            c9146916d2415cf514abe2d337e94e29231215f0d01b748741d5ba8f09faa239

            SHA512

            110fc91670d082bee645563722575e420ceee647f435470839836aba418af754a39efe10992dc16e9f995782c5de7d6bffd7dfbc2400b9d548aa9cc8fb5982eb

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qwbmp.dll

            Filesize

            29KB

            MD5

            aa0d9d5eae818c84384b614d7f376b35

            SHA1

            cc8e100d70b46ffc180dd75a245306cf8167ad02

            SHA256

            c9146916d2415cf514abe2d337e94e29231215f0d01b748741d5ba8f09faa239

            SHA512

            110fc91670d082bee645563722575e420ceee647f435470839836aba418af754a39efe10992dc16e9f995782c5de7d6bffd7dfbc2400b9d548aa9cc8fb5982eb

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qwebp.dll

            Filesize

            374KB

            MD5

            87982296888e36f944acb3e2cbcfa8f6

            SHA1

            312a03b7e7e2799b1e5a3ef2b0db9ec7b56b2c84

            SHA256

            58ccdf8d4e361b6d0d8847abbc959e6a42be03d8b5415e29773ffa2422e4f7d2

            SHA512

            23b52a2aa8c99979a719582ee5e62c34c93e2e362121c0968ac4a17b02ea5bb5ea534d153e7e2230c43025693281cb88ae4c56bddb66bae5220ef85d0d9b2c80

          • C:\Program Files\MiniTool Partition Wizard 12\imageformats\qwebp.dll

            Filesize

            374KB

            MD5

            87982296888e36f944acb3e2cbcfa8f6

            SHA1

            312a03b7e7e2799b1e5a3ef2b0db9ec7b56b2c84

            SHA256

            58ccdf8d4e361b6d0d8847abbc959e6a42be03d8b5415e29773ffa2422e4f7d2

            SHA512

            23b52a2aa8c99979a719582ee5e62c34c93e2e362121c0968ac4a17b02ea5bb5ea534d153e7e2230c43025693281cb88ae4c56bddb66bae5220ef85d0d9b2c80

          • C:\Program Files\MiniTool Partition Wizard 12\libcurl.dll

            Filesize

            359KB

            MD5

            4edcb47ff216a3d465534620f2e26a1a

            SHA1

            245920aa97fc1299e6416665f26147acb54f9090

            SHA256

            753c458e48291eb08cb42cd9a03484f7c4a9dd8c209cdd070c4be8b7f32c248e

            SHA512

            2df293d15d0a157752542586a5f4dec7c4b334378936d22d8ed8f80b3b58b75f9642df0e9295c124056ca1383af587acfbbf7ac5ac965454d67b0db5fdd83af3

          • C:\Program Files\MiniTool Partition Wizard 12\libcurl.dll

            Filesize

            359KB

            MD5

            4edcb47ff216a3d465534620f2e26a1a

            SHA1

            245920aa97fc1299e6416665f26147acb54f9090

            SHA256

            753c458e48291eb08cb42cd9a03484f7c4a9dd8c209cdd070c4be8b7f32c248e

            SHA512

            2df293d15d0a157752542586a5f4dec7c4b334378936d22d8ed8f80b3b58b75f9642df0e9295c124056ca1383af587acfbbf7ac5ac965454d67b0db5fdd83af3

          • C:\Program Files\MiniTool Partition Wizard 12\libeay32.dll

            Filesize

            1.6MB

            MD5

            aaae8fe70e4c9da4acf5b6445fe7d9a3

            SHA1

            9916fdcbca4584cfd2e5fb86d187df1bdfae40ef

            SHA256

            e0297bc3b64d0f39fa0fbf751216dc150ecd1cf403440d5b533d132c9b185cae

            SHA512

            dc8ddcf3fbf71b85ccdab0d2c20fc002033ceb96370e0f034f4c35ec8588b2a52de63678461b8fe9c516e76420a4a3f39881b1fcd46e2b9563b1928f6cf21f66

          • C:\Program Files\MiniTool Partition Wizard 12\msvcp120.dll

            Filesize

            644KB

            MD5

            edef53778eaafe476ee523be5c2ab67f

            SHA1

            58c416508913045f99cdf559f31e71f88626f6de

            SHA256

            92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f

            SHA512

            7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8

          • C:\Program Files\MiniTool Partition Wizard 12\msvcp120.dll

            Filesize

            644KB

            MD5

            edef53778eaafe476ee523be5c2ab67f

            SHA1

            58c416508913045f99cdf559f31e71f88626f6de

            SHA256

            92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f

            SHA512

            7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8

          • C:\Program Files\MiniTool Partition Wizard 12\msvcr120.dll

            Filesize

            940KB

            MD5

            aeb29ccc27e16c4fd223a00189b44524

            SHA1

            45a6671c64f353c79c0060bdafea0ceb5ad889be

            SHA256

            d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa

            SHA512

            2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006

          • C:\Program Files\MiniTool Partition Wizard 12\msvcr120.dll

            Filesize

            940KB

            MD5

            aeb29ccc27e16c4fd223a00189b44524

            SHA1

            45a6671c64f353c79c0060bdafea0ceb5ad889be

            SHA256

            d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa

            SHA512

            2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006

          • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.dll

            Filesize

            4.8MB

            MD5

            f2ad332e7f68f04dc72f5a63a8f533a1

            SHA1

            19914126407c778fb75bdaefa6374fbda304038f

            SHA256

            4e05db731aa49f5f5354512972cffd7475a04f4f54e49742e1347d6282c7106c

            SHA512

            3a6101edc1fa5d64152548410c31e2371b40cca524d6ee1adbc139b956261cc0be887772ec9cfc2e75096b44d697874310d346596a9b9b4fa8a901d62125a863

          • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.dll

            Filesize

            4.8MB

            MD5

            f2ad332e7f68f04dc72f5a63a8f533a1

            SHA1

            19914126407c778fb75bdaefa6374fbda304038f

            SHA256

            4e05db731aa49f5f5354512972cffd7475a04f4f54e49742e1347d6282c7106c

            SHA512

            3a6101edc1fa5d64152548410c31e2371b40cca524d6ee1adbc139b956261cc0be887772ec9cfc2e75096b44d697874310d346596a9b9b4fa8a901d62125a863

          • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe

            Filesize

            437KB

            MD5

            53ddcc914627ec1fe46d43bd55f932b8

            SHA1

            d95f1eca2f21f62b654f1071995718cee83528ff

            SHA256

            55071c9be166f08168f8afd019953c5d3302c4a4a77e63e85dc084d4333b0f0b

            SHA512

            f123d4e9eb620396e6f70355876c94bca2021bba09f10383a171b56387920a0b9ed6df91563c7ee416f02bec62eb414000c61ad476a5e8500b17258460a528c2

          • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe

            Filesize

            437KB

            MD5

            53ddcc914627ec1fe46d43bd55f932b8

            SHA1

            d95f1eca2f21f62b654f1071995718cee83528ff

            SHA256

            55071c9be166f08168f8afd019953c5d3302c4a4a77e63e85dc084d4333b0f0b

            SHA512

            f123d4e9eb620396e6f70355876c94bca2021bba09f10383a171b56387920a0b9ed6df91563c7ee416f02bec62eb414000c61ad476a5e8500b17258460a528c2

          • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe

            Filesize

            437KB

            MD5

            53ddcc914627ec1fe46d43bd55f932b8

            SHA1

            d95f1eca2f21f62b654f1071995718cee83528ff

            SHA256

            55071c9be166f08168f8afd019953c5d3302c4a4a77e63e85dc084d4333b0f0b

            SHA512

            f123d4e9eb620396e6f70355876c94bca2021bba09f10383a171b56387920a0b9ed6df91563c7ee416f02bec62eb414000c61ad476a5e8500b17258460a528c2

          • C:\Program Files\MiniTool Partition Wizard 12\platforms\qwindows.dll

            Filesize

            1.2MB

            MD5

            9608d1a7416a2534dee37613fb8bcb35

            SHA1

            c6dac2916d5740a406e784d035f7dee3e6ddb971

            SHA256

            d3f3f1eea7662a928cea0d9029d83e8b6a23a24d641056c3575e4b2d33b05bd1

            SHA512

            11fbd7751abd89354383645666a70a6ceb37ec005eb064b5307101823d900073f82631f95201cbc81b4a965f1ca2f5c180b9779778ac09bd5fc6a851ae405e0c

          • C:\Program Files\MiniTool Partition Wizard 12\platforms\qwindows.dll

            Filesize

            1.2MB

            MD5

            9608d1a7416a2534dee37613fb8bcb35

            SHA1

            c6dac2916d5740a406e784d035f7dee3e6ddb971

            SHA256

            d3f3f1eea7662a928cea0d9029d83e8b6a23a24d641056c3575e4b2d33b05bd1

            SHA512

            11fbd7751abd89354383645666a70a6ceb37ec005eb064b5307101823d900073f82631f95201cbc81b4a965f1ca2f5c180b9779778ac09bd5fc6a851ae405e0c

          • C:\Program Files\MiniTool Partition Wizard 12\qt.conf

            Filesize

            46B

            MD5

            ed54ff3a93486892b6a41c877df944d8

            SHA1

            c9a359103ff7bd26b4a74daeef24476e3fb95232

            SHA256

            3e25ea931f3228cae2b0138b66aeddb90cf73e93c108621e431c89c87f3fd594

            SHA512

            5821dfaf8a09fb2783b9b670fd984d07af8bbbc5e219aa73b8187b052b947475cda2cc59cdfd2556ad1805ee5081323749a3f196a397ffbf641846a302be98d9

          • C:\Program Files\MiniTool Partition Wizard 12\unins000.exe

            Filesize

            1.5MB

            MD5

            2d1fcb8ed6c2802681065463148b35b9

            SHA1

            a5352ab6775af37a1ed17de8e18637ab4a32f30b

            SHA256

            2c97eb10074c6572fa3a0ded012ac6466b1e7af51c257c21e8cb157a7f0bad2e

            SHA512

            892d332f15dd619b5ec45479d5b892762a57ff8e0b7a43e739cb0d808119e0dedb35d03be4b7e9412a8a231a49b17da559b01fe3800b0e3c899289fcd24ce542

          • C:\Users\Admin\AppData\Local\Temp\is-LI8BE.tmp\Setup.tmp

            Filesize

            1.5MB

            MD5

            2d1fcb8ed6c2802681065463148b35b9

            SHA1

            a5352ab6775af37a1ed17de8e18637ab4a32f30b

            SHA256

            2c97eb10074c6572fa3a0ded012ac6466b1e7af51c257c21e8cb157a7f0bad2e

            SHA512

            892d332f15dd619b5ec45479d5b892762a57ff8e0b7a43e739cb0d808119e0dedb35d03be4b7e9412a8a231a49b17da559b01fe3800b0e3c899289fcd24ce542

          • C:\Users\Admin\AppData\Local\Temp\is-LI8BE.tmp\Setup.tmp

            Filesize

            1.5MB

            MD5

            2d1fcb8ed6c2802681065463148b35b9

            SHA1

            a5352ab6775af37a1ed17de8e18637ab4a32f30b

            SHA256

            2c97eb10074c6572fa3a0ded012ac6466b1e7af51c257c21e8cb157a7f0bad2e

            SHA512

            892d332f15dd619b5ec45479d5b892762a57ff8e0b7a43e739cb0d808119e0dedb35d03be4b7e9412a8a231a49b17da559b01fe3800b0e3c899289fcd24ce542

          • memory/1120-516-0x0000000000400000-0x0000000000587000-memory.dmp

            Filesize

            1.5MB

          • memory/1120-188-0x0000000000400000-0x0000000000587000-memory.dmp

            Filesize

            1.5MB

          • memory/1120-139-0x00000000008B0000-0x00000000008B1000-memory.dmp

            Filesize

            4KB

          • memory/1120-142-0x0000000000400000-0x0000000000587000-memory.dmp

            Filesize

            1.5MB

          • memory/1120-497-0x0000000000400000-0x0000000000587000-memory.dmp

            Filesize

            1.5MB

          • memory/1120-519-0x0000000000400000-0x0000000000587000-memory.dmp

            Filesize

            1.5MB

          • memory/1120-143-0x00000000008B0000-0x00000000008B1000-memory.dmp

            Filesize

            4KB

          • memory/1168-482-0x000000006F7F0000-0x000000006FD3A000-memory.dmp

            Filesize

            5.3MB

          • memory/1476-520-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1476-134-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1476-141-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/4424-548-0x000000006F160000-0x000000006F6AA000-memory.dmp

            Filesize

            5.3MB

          • memory/4424-545-0x00007FFB15200000-0x00007FFB1583E000-memory.dmp

            Filesize

            6.2MB

          • memory/4424-546-0x00007FFB15840000-0x00007FFB162BB000-memory.dmp

            Filesize

            10.5MB

          • memory/4424-549-0x00007FFB15200000-0x00007FFB1583E000-memory.dmp

            Filesize

            6.2MB

          • memory/4424-550-0x00007FFB15840000-0x00007FFB162BB000-memory.dmp

            Filesize

            10.5MB

          • memory/4424-547-0x000000006F160000-0x000000006F6AA000-memory.dmp

            Filesize

            5.3MB

          • memory/4424-551-0x00007FFB15840000-0x00007FFB162BB000-memory.dmp

            Filesize

            10.5MB