Overview

overview

7

Static

static

1

pw-free-online.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    339s
  • max time network
    338s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 16:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    pw-free-online.exe

  • Size

    3.1MB

  • MD5

    b00f4ef87125599ae72def4555e48175

  • SHA1

    8b1073b0cec1d85a6ca39842e43c8a9f49526953

  • SHA256

    bc917c4424c078290c3cbbb13e5f2f9c2939222d058d70056688718ae33e13a9

  • SHA512

    d4f8f6d52a25f4977d7d812696f92dc6d72410b0675658b3c143f255f2b7313ffe904752778a9e17992477f5e9102cc81f6d68858be3f1db96ae4d109ebf80a0

  • SSDEEP

    98304:UkL2991YngbfnLTccGEE7kc7EF2DKlVcu/xI9Gu1:j2991OgDtQIc7E4Wcu/xI911

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\pw-free-online.exe
    "C:\Users\Admin\AppData\Local\Temp\pw-free-online.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Users\Admin\AppData\Local\Temp\is-8GVJK.tmp\pw-free-online.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8GVJK.tmp\pw-free-online.tmp" /SL5="$501CC,2294223,1148928,C:\Users\Admin\AppData\Local\Temp\pw-free-online.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /f /im "updatechecker.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4072
      • C:\Users\Admin\AppData\Local\Temp\is-PU0KS.tmp\SmDownloader.exe
        "C:\Users\Admin\AppData\Local\Temp\is-PU0KS.tmp\SmDownloader.exe" /HWND:721184 /PATH:"C:\Program Files\MiniTool Partition Wizard 12" /URL:https://www.partitionwizard.com/download/online-setup-config/pwfree-v12.ini /VERYSILENT /USERMSG:1450 /LANG:english
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3680
        • C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe
          C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12" /LANG=english
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3616
          • C:\Users\Admin\AppData\Local\Temp\is-FKNE4.tmp\pwfree-64bit-online.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-FKNE4.tmp\pwfree-64bit-online.tmp" /SL5="$F006E,20098929,488960,C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe" /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12" /LANG=english
            5⤵
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4048
            • C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe
              "C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe" /createtask
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              PID:4888
      • C:\Users\Admin\AppData\Local\Temp\is-PU0KS.tmp\SmDownloader.exe
        "C:\Users\Admin\AppData\Local\Temp\is-PU0KS.tmp\SmDownloader.exe" /HWND:721184 /PATH:"C:\Program Files\MiniTool Partition Wizard 12\..\MiniTool ShadowMaker" /URL:https://www.partitionwizard.com/download/online-setup-config/pwfree-v12-bundle-sm.ini /VERYSILENT /USERMSG:1439 /LANG:english
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4764
        • C:\Users\Admin\AppData\Local\Temp\pw_sm_setup_x64.exe
          C:\Users\Admin\AppData\Local\Temp\pw_sm_setup_x64.exe /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12\..\MiniTool ShadowMaker" /LANG=english
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1448
          • C:\Users\Admin\AppData\Local\Temp\is-3LSMI.tmp\pw_sm_setup_x64.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-3LSMI.tmp\pw_sm_setup_x64.tmp" /SL5="$20256,208624469,268800,C:\Users\Admin\AppData\Local\Temp\pw_sm_setup_x64.exe" /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12\..\MiniTool ShadowMaker" /LANG=english
            5⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3644
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "SchedulerService.exe"
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2112
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "AgentService.exe"
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1944
            • C:\Program Files\MiniTool ShadowMaker\testOpenGL.exe
              "C:\Program Files\MiniTool ShadowMaker\testOpenGL.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:3936
            • C:\Program Files\MiniTool ShadowMaker\initsrv.exe
              "C:\Program Files\MiniTool ShadowMaker\initsrv.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2232
            • C:\Program Files\MiniTool ShadowMaker\BootTrigger.exe
              "C:\Program Files\MiniTool ShadowMaker\BootTrigger.exe" "C:\Program Files\MiniTool ShadowMaker\SMMonitor.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:3220
            • C:\Program Files\MiniTool ShadowMaker\experience.exe
              "C:\Program Files\MiniTool ShadowMaker\experience.exe" http://tracking.minitool.com/backup/installation.html?mt_lang=en&mt_edition=pw-trial&mt_ver=4.4.0
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              PID:3612
            • C:\Program Files\MiniTool ShadowMaker\AgentService.exe
              "C:\Program Files\MiniTool ShadowMaker\AgentService.exe" -i
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:3308
            • C:\Program Files\MiniTool ShadowMaker\AgentService.exe
              "C:\Program Files\MiniTool ShadowMaker\AgentService.exe" -s
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3956
            • C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
              "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe" -i
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3420
            • C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
              "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe" -s
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2776
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.partitionwizard.com/feedback/install-partition-wizard.html?from-free-v1208
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa32646f8,0x7ffaa3264708,0x7ffaa3264718
          4⤵
            PID:5060
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,10312815261873100217,12264004204636964237,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
            4⤵
              PID:1084
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,10312815261873100217,12264004204636964237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2108
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,10312815261873100217,12264004204636964237,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
              4⤵
                PID:1428
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,10312815261873100217,12264004204636964237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                4⤵
                  PID:1404
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,10312815261873100217,12264004204636964237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                  4⤵
                    PID:4764
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,10312815261873100217,12264004204636964237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:8
                    4⤵
                      PID:1496
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,10312815261873100217,12264004204636964237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:8
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4676
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,10312815261873100217,12264004204636964237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
                      4⤵
                        PID:1972
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,10312815261873100217,12264004204636964237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
                        4⤵
                          PID:4528
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,10312815261873100217,12264004204636964237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
                          4⤵
                            PID:4976
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,10312815261873100217,12264004204636964237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
                            4⤵
                              PID:3600
                          • C:\Program Files\MiniTool Partition Wizard 12\experience.exe
                            "C:\Program Files\MiniTool Partition Wizard 12\experience.exe" http://tracking.minitool.com/pw/installation.php?from=pwfree12
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:4036
                          • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe
                            "C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe"
                            3⤵
                            • Checks BIOS information in registry
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            • Checks processor information in registry
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:1220
                      • C:\Program Files\MiniTool ShadowMaker\AgentService.exe
                        "C:\Program Files\MiniTool ShadowMaker\AgentService.exe"
                        1⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:3672
                      • C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
                        "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe"
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:3288
                      • C:\Windows\System32\vdsldr.exe
                        C:\Windows\System32\vdsldr.exe -Embedding
                        1⤵
                          PID:1652
                        • C:\Windows\System32\vds.exe
                          C:\Windows\System32\vds.exe
                          1⤵
                          • Checks SCSI registry key(s)
                          PID:4124
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3320
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4652
                            • C:\Windows\system32\AUDIODG.EXE
                              C:\Windows\system32\AUDIODG.EXE 0x4c8 0x2ec
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4712

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Program Files\MiniTool Partition Wizard 12\Qt5Core.dll
                              Filesize

                              5.3MB

                              MD5

                              a7e479e3fb8c45b4b572a301588c0de0

                              SHA1

                              a254d7e90a27196a6e40b9daacc1f72748ccc155

                              SHA256

                              a71c5a226fbb4334353cc1d0f4abacba8a509f8544f286d352e1ec29c86c0742

                              SHA512

                              92c4303df4967d48a957d258dc2502eedd50a39c7d5d2120f69233f53d67dde13be7112309dd71c0ba9b005951e59a416c5139861522c73cfba3bd49e6b370ae

                              Download Submit

                            • C:\Program Files\MiniTool Partition Wizard 12\Qt5Gui.dll
                              Filesize

                              5.7MB

                              MD5

                              89c68c9d29d7c527097eb4a1317f71ad

                              SHA1

                              58add7d0d991931ac92eb144e007894412ae570a

                              SHA256

                              be00d70e40813e1a8ae4715b8e3cdbfb6470dbffc7d591459bb4afc30e77f715

                              SHA512

                              bfe224dec896857ebe32e75e52823f821b3791312d9629d63b565e2cd12e1854aff5e66cc416555dfbe08887a6171dfb6393e9084a0adaa2ee3528aaf0e2617f

                              Download Submit

                            • C:\Program Files\MiniTool Partition Wizard 12\Qt5Widgets.dll
                              Filesize

                              5.3MB

                              MD5

                              d654ed44099c61cf7ddc07dabeca28d3

                              SHA1

                              1acf0f22f3cb15585fe8ec97dad00eda8ac30d51

                              SHA256

                              3bc64a69dc06e7a12442c04225630ba57c779d6e9e4e1aff9f986c3e68883f27

                              SHA512

                              9012f71a8dd27c56b46b341c97a8ac964bdf399f1f9d8740763be34bc4d179db5bb4fbee153e715990a37c2b1391b2622bcacffe32756abfaceb45183bf7f0ea

                              Download Submit

                            • C:\Program Files\MiniTool Partition Wizard 12\msvcp120.dll
                              Filesize

                              644KB

                              MD5

                              edef53778eaafe476ee523be5c2ab67f

                              SHA1

                              58c416508913045f99cdf559f31e71f88626f6de

                              SHA256

                              92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f

                              SHA512

                              7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8

                              Download Submit

                            • C:\Program Files\MiniTool Partition Wizard 12\msvcr120.dll
                              Filesize

                              940KB

                              MD5

                              aeb29ccc27e16c4fd223a00189b44524

                              SHA1

                              45a6671c64f353c79c0060bdafea0ceb5ad889be

                              SHA256

                              d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa

                              SHA512

                              2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006

                              Download Submit

                            • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe
                              Filesize

                              437KB

                              MD5

                              91090465ee5404063b278d495b2f946c

                              SHA1

                              94bc1b122af8b6578093fb927279c4c9f81c7abd

                              SHA256

                              c84ed7b59adc67d09b623a2243915bc89a18e929646ce6eae892992cb7cf5baf

                              SHA512

                              181ef507964bd5a8f07bdfb43a15c0d708f22947337881e3245e0233c63899acf1ec631e878440624f71887f0be1c7d49b06008d6daa4c81978d8d37106ac7ec

                              Download Submit

                            • C:\Program Files\MiniTool Partition Wizard 12\platforms\qwindows.dll
                              Filesize

                              1.2MB

                              MD5

                              9608d1a7416a2534dee37613fb8bcb35

                              SHA1

                              c6dac2916d5740a406e784d035f7dee3e6ddb971

                              SHA256

                              d3f3f1eea7662a928cea0d9029d83e8b6a23a24d641056c3575e4b2d33b05bd1

                              SHA512

                              11fbd7751abd89354383645666a70a6ceb37ec005eb064b5307101823d900073f82631f95201cbc81b4a965f1ca2f5c180b9779778ac09bd5fc6a851ae405e0c

                              Download Submit

                            • C:\Program Files\MiniTool Partition Wizard 12\qt.conf
                              Filesize

                              46B

                              MD5

                              ed54ff3a93486892b6a41c877df944d8

                              SHA1

                              c9a359103ff7bd26b4a74daeef24476e3fb95232

                              SHA256

                              3e25ea931f3228cae2b0138b66aeddb90cf73e93c108621e431c89c87f3fd594

                              SHA512

                              5821dfaf8a09fb2783b9b670fd984d07af8bbbc5e219aa73b8187b052b947475cda2cc59cdfd2556ad1805ee5081323749a3f196a397ffbf641846a302be98d9

                              Download Submit

                            • C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe
                              Filesize

                              214KB

                              MD5

                              5f150ea19c59d9604f7d4e77b0b24d7a

                              SHA1

                              d60dfb51a34272321559b74944e9a217215f56db

                              SHA256

                              bf3fab722c2bb8ff3f8bc7cbe00c107098ae371999e4269abf97a13e200a5bf3

                              SHA512

                              5fcd8c73c5cb6eee8091a7298e2041f1277dfb49ae8010e5981e04677097c85ea8d3d85299df152db37c34061e246ea36dc33885490eebaa9b9d13edebac36a4

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\BootTrigger.exe
                              Filesize

                              182KB

                              MD5

                              adf3eee2895895d350cc128b15938e8b

                              SHA1

                              5fadd780fba0913379b07e6878a82939b5035735

                              SHA256

                              858ced75aa403ef5738a8f10eddfef142c57ebc547b8347b4fa29dadb3720cbe

                              SHA512

                              77ce3753888879dc9b5ec69089a0133e47c522d2b0603bb3d2549439fa780ab3ad563b9471f7b7b97e8535a61a3b8092b79e42df302ceb74c0cfa26168d88bd4

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\PETools\amd64\boot\is-S99UT.tmp
                              Filesize

                              4KB

                              MD5

                              d4befebf3cef129ac087422b9e912788

                              SHA1

                              62313ec73f381c052f2513ca6279cfb5107e98c0

                              SHA256

                              f425e135aac26b55e2bac655e62e2ce0b16255226c583d9ab43b2e93e8a6d932

                              SHA512

                              3814e4682cad2ef40061d3d5e8142c964cc73a6c6dfc72ba59cbab0922dd0c7e279703450e3a1f4fcfde3498565bf6ef28a30e7de53a0eda75b3fea76d03929b

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\PETools\amd64\boot\is-T4BQU.tmp
                              Filesize

                              1024B

                              MD5

                              eb145d5f87ddf43c8bd6f27e97db8bf2

                              SHA1

                              2021c98f81b177d17543ebd34004891183fa3dd4

                              SHA256

                              a7a0edaf85f70e833fac02d0a416ae56ae2a3593e787f39c25dbb12830ca737c

                              SHA512

                              b85ff5a038173898b7f96890cb3998034bbcc50301cb31db112eeb04c3a1ed3c6b6d7905e48fc8cfe1fbb058b32e61349653b345bfe25fbfaa2ccffffda031ab

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\PETools\amd64\is-3GD7P.tmp
                              Filesize

                              388KB

                              MD5

                              21bf183c15afe62a8d1137bb9007b2a3

                              SHA1

                              d656dd1e85d7e8acffdefa9ced5d74bf0b978e39

                              SHA256

                              2fc3d311969b63a258446488ec75c275d736ded13d74624e1c541f43a72ab483

                              SHA512

                              8a67833d502edaba077c783dab69a7d8c9155971c409f78cb87948bd4415b7a58410517aced73d6ed7d13a6b975af769aa0623b9dffd9537f5a1ce0248308291

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\PETools\x86\boot\is-U55OP.tmp
                              Filesize

                              3.0MB

                              MD5

                              22d9945b4aae36dd59620a918f2e65f4

                              SHA1

                              bb025cedca07887916c4b7e5fa7a641ed3e30c14

                              SHA256

                              cd2c00ce027687ce4a8bdc967f26a8ab82f651c9becd703658ba282ec49702bd

                              SHA512

                              dd2d0ea7d5cf98064838ce0b74711f77534e1a2a14c7f74d44ed4b83acdb6f413d74671d2c6a8574aee88afb456b53a6b8452419a3bdddf2f7e9095c9d1d272e

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\Qt5Core.dll
                              Filesize

                              5.8MB

                              MD5

                              484cc5d10aafd02f2b5b46edf32f7303

                              SHA1

                              4101d7111ff77d36e55eb9fc5bbd63b3dcf27bd2

                              SHA256

                              6b5338cf3fd3f1d4c060c3f6fca84ef7ce5cc19449a48332b6da9f3c0158694f

                              SHA512

                              85a3c5e74bb5ee6c909df5ef6610938da0e9c56355596650943947e65aceb261f0f2310016cac9e0e25a518902fbc3bb3983ee084b10e8b44f483e00878204e8

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\Qt5Widgets.dll
                              Filesize

                              5.3MB

                              MD5

                              d431c5e845feb90af239cf1c6cc7cd9a

                              SHA1

                              018823fa5a94b456d877fa30372559966f438fd9

                              SHA256

                              b1ea8460ed2a37159bd2580c24fdb3a891f9e0bfe17ad129b6204cfbce72a11f

                              SHA512

                              46c463e686f03c009d6fc3b2c1a7416f7a232e19a93e6bb27b936f4c6249c647dd8adc9e4a5b549616634263081106508bbb7b8174630f3c2578d668fc25de01

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\QtQuick3D\Materials\maps\is-298IQ.tmp
                              Filesize

                              334B

                              MD5

                              882310febbcd112f6416015145fd8c6d

                              SHA1

                              e142d0ba597a2c773e6354673bbc4a760f8d963f

                              SHA256

                              03003aa01026e944b75447078f5758d0ffab854d03e9ce80780a174411073f7f

                              SHA512

                              b21d8a189123c3019b5c99c1927d9eb10293cbe9321cb54d1fe183bf57efd22f778a61e47be27afb8f54d731ce17f96a6c6452dc76c3a8596b1bf1fdd532d4c4

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-4BJKB.tmp
                              Filesize

                              27KB

                              MD5

                              d5d3a570934ebb25bf6076c4347b6e8e

                              SHA1

                              e7c4c16670fd26f98c70832936b6279e4c42b170

                              SHA256

                              12b663de499ac95f43283b93e93d814ff529ea14da3313ab0345685829d01eb2

                              SHA512

                              42f94cee044eb5a0f5e53c461f411edfc723957cf374ad82cdaefe4bd9e7993db51545e9d21d5169f9862280d2d5b93b420937f8b4b448f777e1120e785852fa

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-CR93T.tmp
                              Filesize

                              8KB

                              MD5

                              e9065bfa9f88f01266914355016d91c3

                              SHA1

                              11e8e296c46037b5dc47e05be04fef703a9664df

                              SHA256

                              3b2f5365e919d3512106c334e32def5b7984c67f353a51fd8b5f1aa659302129

                              SHA512

                              8fc6e5de9a90a819336667598106ceb944219d55170db92982aa409193d525787eb2f41234ffab25663beac58254fb13b8fce12d1daf052963ecdd4f4c3b4d4f

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-GFIO0.tmp
                              Filesize

                              608KB

                              MD5

                              b4a4eed72dda932bf19020d1af6ebe16

                              SHA1

                              f83ae8045654e9fc23909ceab60e6638d43a5d46

                              SHA256

                              fb0dc7d25e596ee14d0bfef1933e204f07db9bbd2ce284b9df824d4c3aa56818

                              SHA512

                              ff27c35a7e1626033d8f52ef5514868b548adbef7015df99ebe4b786057345b6e15cbd59aed5bac952415e3a58e58e289551a0110114a27889a137278f648a37

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-H9QTD.tmp
                              Filesize

                              8KB

                              MD5

                              729c3403f7fa48350383c17fee0ab05e

                              SHA1

                              4835887831dcb4996297f4276acb376b431b8e85

                              SHA256

                              171f983572a751a861298aef3ab3b0d82ad0f3cc087a8987c308e008479af7bd

                              SHA512

                              397a93eb25ab7b66b74bab38773cf1fb030b611b53bc024e9e2778436868bad212f6c8a842a6c54e58d15066730384443e7c1ce059c70051ab47f5c99bdf83e4

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-SNANP.tmp
                              Filesize

                              11KB

                              MD5

                              a7652c278fc0f1d99653bbf1b5ef0796

                              SHA1

                              8bbe33d7f5eb8619fd3dc464ec522a0c97be69b2

                              SHA256

                              d5a0e0f60d23369f2dbe7929c79db4d2b0c4f76da1f039229918577647e51309

                              SHA512

                              f18bc23113eb9d208c87f8770ac39bac5329cc251a2b0fa34ba34b3c93f94934e95f5033e4f0c46995eebc3140a1235e7832976de4ddd651a2f958bf65983b5e

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-V29HF.tmp
                              Filesize

                              12KB

                              MD5

                              524aed2e8bf6db6dafcba00123c5f62b

                              SHA1

                              749852a2a94d9fbea4f6cfaa269b932d790e4b7c

                              SHA256

                              91ba645003fe189ca0c2fbd98dfa8ad0ee8fc69140c5a69a52b1a5adf4223200

                              SHA512

                              2a9196aaa125e7178289647ea7abcbce407965d1e7b109cc25fb2fea9f5076d4fe2c3fb590b7ec7fd4e79a67e872eba4c5f890931880f479fbbe8f1b836364bb

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\amd64\boot\is-1SP7H.tmp
                              Filesize

                              256KB

                              MD5

                              4e6397849461b037c91e6914fdc4976f

                              SHA1

                              4bc15aed32c60ab7722abd7ccb7404b15bc8a98f

                              SHA256

                              3be6f02df7395ee9df212e7b421feb38cf98ff301335df82a0ccab322c51cc05

                              SHA512

                              d6e3b3c86ff18e35197a812df1005f82c36068c52a2a1a3d8d8e808ea7bd80e21e9f0de19b3b33226d8aff97fcf52a54017be98fd9ab28b1e22f7c49a18e48d1

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\amd64\boot\is-AF11F.tmp
                              Filesize

                              1.4MB

                              MD5

                              8d6bdcc0269dfe01c4c0296dd62b585d

                              SHA1

                              90e9d250461385af451c14bf3fdd2c6bdc288b13

                              SHA256

                              f083e7d85d1389d0700478a7a109a404bbb1c6a8cea4c7fa49dd6d03f11c35c4

                              SHA512

                              f9c31f90987010aaabeffc386550bb43eb214f2d8269af3111da61d707a667f6948a98d02f7663c294a2036c0c5c95a3211374b93dd1fce64117710ea2157fae

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\amd64\efi\boot\is-PHHGE.tmp
                              Filesize

                              1.3MB

                              MD5

                              ff6d345785671fbcea9561a3cbc47702

                              SHA1

                              0963edbc8d3486017c7a65168ffd515ab5bed968

                              SHA256

                              bea5931767dca4c46ef7d6ad73e6913a592860138d3fc82056289b8dff337940

                              SHA512

                              80925852082dc97e8986291374138eef10b1f56dcde7b3a456165226c6e38966d5e0d73b6c7ef6d67419f66637a7e8a1cb2352008be883b0ff862d18c0469b5b

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\amd64\efi\microsoft\boot\is-MJOTM.tmp
                              Filesize

                              256KB

                              MD5

                              a29ba030a801aa62c25fd028166c8ee7

                              SHA1

                              ab8c61f76874a29095297767d6e49697ef079bc6

                              SHA256

                              a0ab68982229efade615050c93903e125446d3efe1dc08d26a864dc7431991d1

                              SHA512

                              606ab1c88ae77db387368340679886659ed22484a47317982ca6e3dce631df8c09ff561db61e77341df0cdb916c5d2580384cfe37890274c8415869011ba92a9

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\amd64\is-7P9PL.tmp
                              Filesize

                              1.3MB

                              MD5

                              75d0032ae18e04a1254448f3fef14a6a

                              SHA1

                              67bf3587febf3c60fc2db86cfd5cc3abf510b8bd

                              SHA256

                              708a5e2b9f37c099d223ff297450a697c5e0002c969a6e5ffd92349f28fdf1cc

                              SHA512

                              5464cd62a08cb9e8f8fe0243416de1926adabbfa695fdfbbbe9c666dfa509d334ab941c5e1ace6feccc266d139fea40b02e8983e34fe49e40403673c4297ff7b

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\x86\boot\is-D8NQ8.tmp
                              Filesize

                              256KB

                              MD5

                              d4774c3254be80d729cec1c70d737ff0

                              SHA1

                              6d8ebc1ddd27703689770b68131d5b3ea3f2b717

                              SHA256

                              18bbceb1150adea8ca3958e409821b3ae155c82fab2098ef79eb3f6bc9ecf3fa

                              SHA512

                              44000cd6ab7b0fd15e4edf22fa23ce350dfcde382752e8f70052ee78978d8dc9068d5eee784a7e4843fe4b4a03327e0d90f61b7486f83a810c6f83e6f827057d

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\x86\boot\is-Q2PCT.tmp
                              Filesize

                              1.4MB

                              MD5

                              247f53d01ca3024505e86e8e266d4e46

                              SHA1

                              416331400a46addfd7952be6ffc5af391f2921e0

                              SHA256

                              68050e999473b9587535e3c03cd8ed25e62547b85b088645ec8c59e962a697e9

                              SHA512

                              03b13889f6f631250e1b8ba1a20d1d8a6b9c3bc115c14855c5a7b5f3b66c29b58dbbc58a616b3b3ee6b70a675345f4aad40c3024cb03936ef29a451b45456891

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\x86\efi\Microsoft\Boot\is-LTK7T.tmp
                              Filesize

                              256KB

                              MD5

                              10647fde0b2a53d88230682d6b66fc4e

                              SHA1

                              08b5704d282305d50618e0e748ce7ae1d66353a3

                              SHA256

                              050aff6c0ed8015ec81fbf54ec47625e2d436db7d1495c53ea943f3f11b8e950

                              SHA512

                              bf59b1f005d075661b33e18a1ec869d8b04975be69aaa7f7a0393615ea5259eac5eec0a20e27605e2d32433d6cd29c9c90df6a354821a8b98a1a36538439c064

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\x86\efi\boot\is-02SCR.tmp
                              Filesize

                              1.1MB

                              MD5

                              32643b08ef8162247c4f02d28b91aea7

                              SHA1

                              b55f48a499b53a8e5b535505b49be437d4de677f

                              SHA256

                              91c628e8059b35f450e5ba27a9fe1cee44b52df2a2d10a037fb0a8c04d176028

                              SHA512

                              925616abbb7526c2dff8ecabd638d298489142b007c9854a4ee31a04c2e1e37e92915dc91e3413f705fcc302ce01adf0cab8202a337ea78fa70719878f90d9b2

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\x86\is-1MPVD.tmp
                              Filesize

                              1.1MB

                              MD5

                              639234efee7d49adb5e9429c3f23dbd8

                              SHA1

                              f98687c887bb70233e28df4b93cb174514663f90

                              SHA256

                              30f0570e65a79f60128d99bf7d65ac4be571c77b744358dfd71341eb1b82f98f

                              SHA512

                              9f2ad6a44eac5bdc786d63291100246f74305a4776c9db25275afd01b66c203c01fd02af0ff31ff0d69274e07fce4196a571e31b1ae559565fb07082b5e1889d

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x64\is-2H9IF.tmp
                              Filesize

                              2KB

                              MD5

                              0a0aa027d5f35d900444d66c5fb5043b

                              SHA1

                              2182e346edc3d894edc912deddd8bbe129c10418

                              SHA256

                              c3090f85c627aa7849afe5622e8dc211cb873e86cde41d2d2ba7b73a475108e1

                              SHA512

                              273137ad3be5ecd2a738b6d66576adff4c732bab05461fea6cd954b4b624f85314e508e8f33e7fdd24a82718169c6a49073b5d57fd074ef59bef39b467f312a9

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x64\is-A2T2Q.tmp
                              Filesize

                              16KB

                              MD5

                              5efdc1c1b1187efe3021121275d46852

                              SHA1

                              8b83a5d6f8511e759d20a152f720ab5f584945ca

                              SHA256

                              de26e6f1093ae186615d9dbbe73e872e7bf97981ca216281afff86c77a73cdb7

                              SHA512

                              d2c356f61fcfb425d3623a94f586419a8d18ffc1196a84a1b612b01804d46d1eac24231a8800ee563dd6c5d629ed582ba26ff85c9a5eb0d3257385b7b1fa89b3

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x64\is-DNFUL.tmp
                              Filesize

                              45KB

                              MD5

                              9291d6a107b7f2cf676ec2394ea5829a

                              SHA1

                              59329d5b141af32f7a7dec2d33547291a728b2e1

                              SHA256

                              7415e90f75702e79ab64620a5143ca09c47166e9cf9de497bbbb9ca911aea930

                              SHA512

                              1f51cfdd4c929d1903e5889a82378bb7443a679cbaec94667ba2aa38450a05c3616482a7d4f422e0301287dc1cdc4eb1ef5468ee57cef969d40968758f653b5b

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x86\is-237MO.tmp
                              Filesize

                              46KB

                              MD5

                              7b771326d0973ff2c92d1375c1e7ba23

                              SHA1

                              23f1072409f29f81b68f44a7a7b00ab6eb78c8c2

                              SHA256

                              29b09d71d1512aee316e47255ab07c09097e7ea9b9b7418833114555047f20d9

                              SHA512

                              7078d4d1acb1c6e722c0ead3bee1b3cb5dd0a11afb012e1c31d21b3faf3671952dabbeb92ede587d23e203b446d3017e449f6ce5ea80c4d6ade405699c593e25

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x86\is-4OI5N.tmp
                              Filesize

                              2KB

                              MD5

                              3a27fe065699a6acf2e42a64411c3a5c

                              SHA1

                              42666174100eb307c5d36a2e612654a798f0eaa9

                              SHA256

                              943d73cd5983797f8b71a9b05b1a4c71fc6f89a319f619b0e4f5063ea60cb04d

                              SHA512

                              038a1aa8c8f98fa6853e6d9594bce07fb64cd536421ab1ddfa4fc72603d8df26f3293d61ba33a57d89dd2bc25edd92b24417d73e32b438874560a65d2cb43a1a

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x86\is-ROP8N.tmp
                              Filesize

                              16KB

                              MD5

                              443d4a687a8fcea51aea02c2bf3e7583

                              SHA1

                              08b6ef2e35608ed571b9c6f44c789e7d21572789

                              SHA256

                              0882fa66c7a4fd317c2474352adae7f09badacefed38fa1900ecc7fc5e2e4afe

                              SHA512

                              866175fc28c64f21f90a2672e0b8941f502c8b1473c32dd5ff95445dfb651cad41e75754b406257532af7ad076d362032e65532dcc0d9b021e0feb590b523594

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x64\is-D6MNR.tmp
                              Filesize

                              16KB

                              MD5

                              f49c0e3cbe4b20fba47bfcf09398a033

                              SHA1

                              f2a4da1854913f2eac1d1679cc64b13533a361a9

                              SHA256

                              dc601b9937956c7e47993293bcbf1bac5b2f60654e0b06eb203f389eac168f7a

                              SHA512

                              6906983db78d14bcd769e5ead47bc60ce6bf913c3ebb207e4a8161cb3fe98ea652cf6f8ebee5f0e125b82b38228d94db25ca00d63f297d5b3210355ecd15e89e

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x64\is-E62H2.tmp
                              Filesize

                              46KB

                              MD5

                              22d39a881eac214bb7a523bcc627c084

                              SHA1

                              a8c39858c9e71e89fa40d9b791e7f11a32b610cd

                              SHA256

                              491b11dbea8d2c2433db01eab51ed4b87c87ff4692f8d1c074c322ccb64274fa

                              SHA512

                              bf6a91357ec7a27c41575fe6711f6cdb0bbda33ec2b48f9955d93920f1015fda11af28be04c2f2c4673d1d0bd9481f2e8424008b6a29a6195296a3c74cf20d26

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x64\is-Q6LOV.tmp
                              Filesize

                              2KB

                              MD5

                              2984c2c7102f412d159f0b9221fd574f

                              SHA1

                              9dc24e331812088cbca5c52f1d31988137115887

                              SHA256

                              9edbfb670e0fc5e4d23967678a02aa729f78bf0ecf03317f4d497b621eab914c

                              SHA512

                              c2147f1366379f35f58da3b6f52f7afe09502e5ede78d3c0ba2ed2afbbcb6aa40400f0bf5ea8de53d9fbd17d536d49896924850ca1684ec297a738bfc5bf0dc7

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x86\is-AN76C.tmp
                              Filesize

                              46KB

                              MD5

                              fd88596392f3e4fd8a8965273597accd

                              SHA1

                              b3e448a40fc0f2b2267f3bdf4046be6dc91a9b96

                              SHA256

                              3aa7ebdb1134afeb28aedf41b3584808ab81c7ba82ac2f54e198f75b6213384b

                              SHA512

                              d21761283ea026367c2f8ee65bfdd10882c46f84e0831ca867c59beee047fee016bbcf0ad68fda3cee8a580f8570b3a548dce0ee25fdf38cdcd2253d24406078

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x86\is-KEKJV.tmp
                              Filesize

                              16KB

                              MD5

                              2d58f98ad022e2afe56c0f3a452610ec

                              SHA1

                              476533d30698ae918a19933e590a856761f4738c

                              SHA256

                              d13064abca4361f9ca54a675f361f6c4d1c723beb9eff1301b5061d5abc3ede5

                              SHA512

                              1e0f785659bf3fbe46c29ebd8679d7fdc4661c81fe966b917db470370cfe2ad207a27ca1a07c5d02d887f2791a1d1d91dc6f83a0f0c9818c39af960530f1d9d1

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x86\is-QNRK8.tmp
                              Filesize

                              2KB

                              MD5

                              91ac2fc716e62b20df481ae4703b4c9e

                              SHA1

                              1a2f0b8b42e9d58d7a73043b08b6719dc30a71d7

                              SHA256

                              7ee191a9594f014847325a1b8614457c6ff071019d1ed5a72d3cc1fb496696e7

                              SHA512

                              6864b3662bbfe7267f790dc02279969a15d5792850de7ee59fe8902e1959c48618102abe3b14dcce1b66b87150b4be7046518cbe46ca792344e97e25c5e4d6ec

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\is-093CH.tmp
                              Filesize

                              103B

                              MD5

                              d0e5f187217e796e9d33107e12db9bf8

                              SHA1

                              b6ff6f997c8221121f8980f894e27167570694ea

                              SHA256

                              f93c41584626e0c4f4abf54572d25d3e01e96cf99802049b8d9706743e283d61

                              SHA512

                              d379f6ca31dde8bcfe5894ce689ce16ab5f043cdf00111547c64b276cc4b231c6c6ab9ade3b9359020493008fb847a05a7c509205a4f16d0489cc694199965d0

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\is-1U192.tmp
                              Filesize

                              168KB

                              MD5

                              91899280efb4496c8ac0a004cd1469e2

                              SHA1

                              aa9a223cedc82f3ce8e9080bd6273062a9b56958

                              SHA256

                              cd711e09012f37003af75e982e2e40df14445aca2800a3702a18612074ad660b

                              SHA512

                              5fd1c76157a0abc7e477c26a52d3e6a037a36b31a91e0958163a3b2337214a4d018b8880ea6f763c3812a37bc08917f0d9ea947f988dfec88720146e5783f251

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\is-DLHAQ.tmp
                              Filesize

                              100KB

                              MD5

                              7bdff6235a8c7a9e3f9c3915f4d95197

                              SHA1

                              af38ce3946b37c84eda3d8f9f278f84336004384

                              SHA256

                              330995487dcac57ea57a53cb0f447e32099e6f63d190effaf6c28dba23c38b7d

                              SHA512

                              c555a1950a0ef6ef4df852ded8f983dd72d04c927bda770212335d0d7fd9ac668bff05f8e9ed81347e43520a92d764cf55b4c9a5d31ac3851950f1da08ff5318

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\is-DRPMA.tmp
                              Filesize

                              497KB

                              MD5

                              6bb403f6c388f87ace8a7450393a2c51

                              SHA1

                              790f67879ff62932801da287b81078be3ac59076

                              SHA256

                              e2faaaab8c7254bc281757a19c6c0fed1da171a9f6c8f408cf1687e662a723c6

                              SHA512

                              ad364c1bc08002c587a20e9373f036665782b01d7fe6126024edfb0f67101526456370a4c76e346e974afb5047338b7f6ed87d508f687873daaecc891ded1ac5

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\is-KN7GA.tmp
                              Filesize

                              165B

                              MD5

                              ff2308e976215e0bb4d82a6a28ccdaad

                              SHA1

                              d438b2711f4e90d92f9ef183438a20ea87d78c69

                              SHA256

                              c8ac2d7e987ee422dc2743826882ee52285296681e58a5ae8232acef0866c64a

                              SHA512

                              7f912293df38067fd06b1ba73698b274a7110a0e20dfb7131d08fd5638f1c7bfce1d7984c4b70a28599b0208a055c53ad63eb4d6628dd7640acaca585bd5a95e

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\is-OG6L8.tmp
                              Filesize

                              172B

                              MD5

                              9db4e733cb93ba9ff2e8f72f042fcda8

                              SHA1

                              2810dcdd7e56bf498ae3c1ec5ce8b23838c33413

                              SHA256

                              55bbd5c1b2a56a2e6ce92d3b59b460c30c56798ccd7804ec2790a5869f2b850b

                              SHA512

                              7b08f399d342b65ea13d5ebb19de1f4fe1dcdaaec4fdfe29e17cb365c7a9b47718fb5ad189df854397f691a492e451dad4ad7460f69150161b4cb7bd73c6e0e4

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\is-OUGIR.tmp
                              Filesize

                              203KB

                              MD5

                              c1a2bd41b8d539c92b2bc34f1b6bd2a9

                              SHA1

                              9d03499e707a351f5fa8163c7cb00a593d2fa70b

                              SHA256

                              712fe9cd3cd3abecf2f3ee2dcf848ec06b62bc27c83a993667d095989c9ce873

                              SHA512

                              dbf772879aee19959f1c72134f7299239e20453368f507dd57a9e97df2c4b959ebdbb24a133d35d486ae2814a69a77c843ce102bebc2693a898b32ec0a919cc5

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\is-PCB2B.tmp
                              Filesize

                              406B

                              MD5

                              7cb71b006fcdcf8ade80e31fd5ab8060

                              SHA1

                              655380fb2cca01b0ca707f748fc7dcf006732518

                              SHA256

                              be8918559280a2e74748bf8f6238b568ed7cbf75183b2180a6a8a979a1ebf243

                              SHA512

                              ce095bb84dbf2e72304471f97e80799185fab42b843f95bd84df4b97764786687807f057dc4434287c8982937329e664f7de476445ff6e2cbf298d7a44b48d55

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\is-Q85NT.tmp
                              Filesize

                              549B

                              MD5

                              a864f7143f9dd47906454977b9f4edbc

                              SHA1

                              72d4d5359678d9062ca14a0cb85d381cc7cc589c

                              SHA256

                              64cccb16f7eb203d7d3858e51f62e3beb8c3d7811935cb06a5db53614515d582

                              SHA512

                              289a8f9ce0eaf3c1626fca16263470e16ede13224d90cf40dd50dc1cc326e5ce2bc7595f37ed772c8b07605652a652ed1e3457b66bacd67c66ffac79d98f78c0

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\is-QM3A7.tmp
                              Filesize

                              121KB

                              MD5

                              37f0bc9593d1f3aa4a0f45a841784f8c

                              SHA1

                              c8bf7ddc8be8b868ac47d91be0ebd10a8f162099

                              SHA256

                              1ad6f2ad63f3846fb07fb991df21c5e7587b438bfb1e15bc43acfdaa7e6bfc1e

                              SHA512

                              5c170bb6fe263a819256f0760ec702a5ac50c4ac0790ec1edbebe21b14d9c43a07374384b4c1b2cef482446807bdfbfe51f6abfec6d4951c9966e6d3fca4d254

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\is-TJHRE.tmp
                              Filesize

                              126KB

                              MD5

                              1c0ab06b3388e79a2206cbfd28e374a2

                              SHA1

                              fb94c71ee606c6cf5181840b4a6122eefd93770b

                              SHA256

                              f0ee03c9936b459cc9bdf184df9b7efad98d40ab7b99e89166a42e019a0ec0ea

                              SHA512

                              1e90991d22b0c34e7947edbc5864f662ad01b2da7888fbe3a6e814607ea5abb6fc0b34a7ee0accede471d7442755f00fe99c4a8b029244bf034189cd00d74d07

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\pxeBoot\is-0CO6F.tmp
                              Filesize

                              256KB

                              MD5

                              3ff0e1c7e264d70358f21db2198cb524

                              SHA1

                              f9a11da016f506881e2b46151d1842b75433f16c

                              SHA256

                              caef57205444357498da40ea4cc9efaffc9e4ae8eeb6c070ebf803bf304ba8d6

                              SHA512

                              fcfe38cffbba8ebffc91af54bf4b04ebf9598fa7e545c5ecd2c082ee26e65dda80803ee6e76a7199faabc1380e62512cf46f8efcf4f48712ab16255894535932

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\translations\is-354NQ.tmp
                              Filesize

                              68KB

                              MD5

                              712c274cdc4e39651e8b518f66dc7dec

                              SHA1

                              7ff61f4b8da29b686e3d3b3274da0a03b8cc95c8

                              SHA256

                              c847943855a39bb6539c34e4a23ec6a4888c79f687d08020df5b73eec877993a

                              SHA512

                              dcde669cc4681dfdcd48cf1610e842a0abb879fc40d039478a151985f7413b419ee0c6aa3e31e632971b999f552a2fcf887c6eb34ea34a641d0ab6398f2b5f63

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\translations\is-560FV.tmp
                              Filesize

                              16B

                              MD5

                              bcebcf42735c6849bdecbb77451021dd

                              SHA1

                              4884fd9af6890647b7af1aefa57f38cca49ad899

                              SHA256

                              9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85

                              SHA512

                              f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\WinPE\x64\is-IQES7.tmp
                              Filesize

                              2KB

                              MD5

                              39b7adfd0f84457da41fe73b807cc780

                              SHA1

                              4984249e447f6cf697be2b980ca9d8f155c4a407

                              SHA256

                              04f7aaa54815fb794e2cde30e0b63b8da9a984f2ff635fa63c5f693a89f08eb8

                              SHA512

                              cab93d6c21cc1f8d2f0b2feb395cfa0a2276f3c9f5bb6a913b63bab3fdc33680974a7c1520b38993b4ad992cb8e66c417c56c485f9fba4938b12a9c65a2e4531

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\experience.exe
                              Filesize

                              242KB

                              MD5

                              f039d42fdfdea5d3588e1a8d7df96070

                              SHA1

                              2fafe603528685606515bce3be4033c0ced5cde6

                              SHA256

                              f581f317d6fd9fe03fd13fd2a6717ef6293693d1d44aee8c88e64f956e763777

                              SHA512

                              ecc823de49c26e0a0549c055b6eab4010f10e7d5731c5abfb7673ba0dd3d4f6cc99014b4099a46654f9b5aafc2a503cbf235f0696fa844e69d2bd24b7b4e06ce

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\glfw3.dll
                              Filesize

                              220KB

                              MD5

                              2b3dc38265d8e97e1cd2855e538c81d0

                              SHA1

                              0cb11718f0d2cfe7f9648a61a1f730cabf12978d

                              SHA256

                              14054faa371c6070baa6753a48930a9175171b78fa1a3a114ccec6d9dcca520b

                              SHA512

                              c5158d80d8e3492bcfe0a128964f0e464e4632e8754aa1d3a832e5fb69de97f731ec59d68bdd9f599b3614eb58911a3361268e15397feb33ccd80e8ff0dded66

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\help.chm
                              Filesize

                              6.1MB

                              MD5

                              cbaf08243eb6c7ce4183a1e35afb049d

                              SHA1

                              9e3dacf61ffb9dd7ebf9fca694698baed14f5e9a

                              SHA256

                              ad1d641b22b8629c4515cbe1eac136040f290631b23fc72627f03002caaa0301

                              SHA512

                              c7a97e356da16b4a26c33ffea9ff0b0e0f07bea7a4d09a001b5396c4ab8a1b8d144b01ffbcd7d7526adac2ab5086e7c5729aa61fca14593073ffebae86e6cec3

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\initsrv.exe
                              Filesize

                              59KB

                              MD5

                              23c126c9d9ccfafa983a645313a2769f

                              SHA1

                              3e060df3c23e72d3211fa7a76cb2940779755865

                              SHA256

                              bd136fffdfa9f4047b3ce86e493d9bf4c65b97fe42c6d1fe5b79c555f6b0f4ec

                              SHA512

                              6ca4edeb6842639967eecf74273b84e8eb4e91e10f438ce67612586a112bbc95bd5bc71378d53333cbd6fd43c9472aae5752b33761beaeb814e3aeb328b6b537

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\is-7AOGF.tmp
                              Filesize

                              2.3MB

                              MD5

                              a932841a7be9c114828b26b322979bb8

                              SHA1

                              e29afb43c3a5e629cf9202a9750b1bb16d1f2d9f

                              SHA256

                              2a7efe3b2cd9fe6b99d03a98881e702915c0ca5a7be40d0d6239359d50208d08

                              SHA512

                              eef46e2e2f4caa73fe341f2c6e736f921e7866692368f50d8ce24c9d325f81a781e14156f74903a2b71f3cc790b1dd0071912e8f6254d5f29621d5a459e2a04f

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\is-H4OHB.tmp
                              Filesize

                              169KB

                              MD5

                              dbdbaa2ba083a61d79840461cd267c89

                              SHA1

                              62de8be6046c8ceea52a8be62fbee2d540782dc5

                              SHA256

                              cea2e299584f3cabd374492b3430d622662e658289fcc25cc0392ef1854cdadd

                              SHA512

                              8cdaab99640e52506f089d6130d2cf9bd8dabe63d39792e27fad7a51c1e045a4a3e611b447404db7b3a4a73827db7ef303d5aa5271c51b167bf11077fb19a172

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\lang.ini
                              Filesize

                              24B

                              MD5

                              5a84ea18562126a5738abfd2ee4f618f

                              SHA1

                              e21662bd256fa3b9edd6eef876d3e68bd12a6903

                              SHA256

                              209c59557c8be210b3c32d283c9df8654dcaa09fb9c5677ba071da1634735643

                              SHA512

                              eefecf1a91123e231a4e0d82e0a5318c497e809d9767961ed439f86a867a81f3e7d7bca2894eed8f4d05cb112c1835c4f2da4170fc3aea96662dc556a0067824

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\msvcp140.dll
                              Filesize

                              552KB

                              MD5

                              cb75d6437418afe1a7b52acf75730ff1

                              SHA1

                              54c2da9552671b161cc87eb50fbdb86319b00f56

                              SHA256

                              7c4ce9d6bfcd6d9db4eef4e75ecdcf5a8e5320106e80f1eca617439fa43f33e8

                              SHA512

                              f58abb740a30467e2d8aedd7eed357da020fdc7d966e245890d102a52e96fea296e122c1d2bc112423fc64b6f5e70b7df3f3eb7de1bf5c2f5f0eb3644f1e06d6

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\msvcp140_1.dll
                              Filesize

                              23KB

                              MD5

                              c1bbf607cd0d540adab62d63a118c0c6

                              SHA1

                              0e9d84f5bbe1ed34c10f3666116b5016e1ae2c4a

                              SHA256

                              5c27f359ba7f801f283e1c49d4cc668b6c1505d424b15dfa42d879f57a1f5fdb

                              SHA512

                              1ece3e9766bd9a978424cd6ba59adf90df41015accffbb3755bebc663e8e5c813546fd4f0b76d1d18d8b5838be0b391eea239ec9cc6be5fdf28a4fcbfeb82327

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\system_backup_gui.exe
                              Filesize

                              3.1MB

                              MD5

                              8b51a2207def8a5649d6b3aa08179336

                              SHA1

                              e3710954949afb9ed8bcb7d9a9a76d12d830963a

                              SHA256

                              766b0adeee8b6c879ae3b7695e98835265eff0ad64ece1ccfc474ba0b703c369

                              SHA512

                              e23352531ef9f6e050f3d99134141a813c4fe84b6f64c333132940d574df9e7f466afe67eb0ae76c319c4432e8fabeeaeda7946483f8e1dfacd31ad77a0368fd

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\testOpenGL.exe
                              Filesize

                              390KB

                              MD5

                              4f5b85c12251ccdd54e00d93e9063124

                              SHA1

                              520a30f5133afcbd1232d7598427a1436093dd32

                              SHA256

                              56aa9d4eb0d87fd0ee254b17765f7474b45165c3503f5c3ab3fead2171d9da48

                              SHA512

                              3f14bf0878731b6094d59524f5e1390e94eac1d3b7b00666ff0e1dd65cc05489780f011f34b28c9a5284e79ce51e2328e92bec363f8ef4fdd592d0df5797f66a

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\vcruntime140.dll
                              Filesize

                              94KB

                              MD5

                              a87575e7cf8967e481241f13940ee4f7

                              SHA1

                              879098b8a353a39e16c79e6479195d43ce98629e

                              SHA256

                              ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

                              SHA512

                              e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\vcruntime140_1.dll
                              Filesize

                              36KB

                              MD5

                              37c372da4b1adb96dc995ecb7e68e465

                              SHA1

                              6c1b6cb92ff76c40c77f86ea9a917a5f854397e2

                              SHA256

                              1554b5802968fdb2705a67cbb61585e9560b9e429d043a5aa742ef3c9bbfb6bf

                              SHA512

                              926f081b1678c15dc649d7e53bfbe98e4983c9ad6ccdf11c9383ca1d85f2a7353d5c52bebf867d6e155ff897f4702fc4da36a8f4cf76b00cb842152935e319a6

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\x64\is-JI1L6.tmp
                              Filesize

                              21KB

                              MD5

                              17291a612431d3e8b731a932dd88e8db

                              SHA1

                              98994cc4da47e298d6d1e2baf2bd702c09242ae2

                              SHA256

                              4ab325db9871344c23f523c5fe10d351df4cef61e450180c34b95141f038a4a0

                              SHA512

                              a4b5ed6c53008c3f8a8ec8589588b54214fcc33c6bc825d7dada99899f0d1208510e94bc58dc6a8519d918628559b5a80361d9859868e93998bbfbc5a2e8cfb6

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\x64\is-M5S4I.tmp
                              Filesize

                              400KB

                              MD5

                              1ed06edc10b4333f66ba61ea97075831

                              SHA1

                              c0eb3e5204b4ca27fee60ae707151fc1b85baf8f

                              SHA256

                              89ea54b4f5b6ccb9b0d5083ef8acc6855d1915d41c0d6902834f6970ee2c2736

                              SHA512

                              7270be77363755e1846c155f6c5c555ad84741e13d917d7090b4dad0cae51ce669bc1a4e5f0b061da7b2b2296f4ca4f2cf0f63159731ec6fc1935dbfae9bb90b

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\x86\is-3GACS.tmp
                              Filesize

                              325KB

                              MD5

                              7bc0c0c439b4ffc39e27180dbad146bc

                              SHA1

                              b6f63718453a325b5563fe83937d0d42b4adefd6

                              SHA256

                              9b64c14ecc89594cb89c6a76da6fbcc94ee9a52506969b238403bfbf17f49712

                              SHA512

                              92adb6e8477716c1e792f87a0a3c67db43d62f8a725ac10cd55b0aa989acc07ae0ee5b6ca04a60e4c356c6537055d345b6eb79edc5ea50afe1f4e957a9de68ca

                              Download Submit

                            • C:\Program Files\MiniTool ShadowMaker\x86\is-72U5S.tmp
                              Filesize

                              18KB

                              MD5

                              05fb36a51e04a6c6b3a5f125fa692e6b

                              SHA1

                              1d5c8a6766e54a81b75f1df4a397100c9b42b149

                              SHA256

                              2ec85cea38c19cb8ff369565074a6a261804aae016337ab193943162ae270d2d

                              SHA512

                              4ba03b2addb6c870baf4671239461d329e126d829006aa27483dbf91291687c69afb86cad148965b8fa199081fdf65afad14108b4192840c1825d1c604c722a5

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              439b5e04ca18c7fb02cf406e6eb24167

                              SHA1

                              e0c5bb6216903934726e3570b7d63295b9d28987

                              SHA256

                              247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

                              SHA512

                              d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              a8e767fd33edd97d306efb6905f93252

                              SHA1

                              a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

                              SHA256

                              c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

                              SHA512

                              07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              5KB

                              MD5

                              de5a6b0804eacdccb841852548d71b36

                              SHA1

                              eb7c6c82ea151cdc86f101ea9a03593d1a23c947

                              SHA256

                              19b53580b88d39b7998f360e9647749666abedda3ae9243fd3d16bf7b743e25d

                              SHA512

                              6df2b41ae0f34b85dbcf1948b18f28ae5dbdc1c9f034ce6a668257085121a69b03492a2c3a0a48e2ccc0087dedcd0ebc28039df145abfb71d3b332873d4963e6

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              7KB

                              MD5

                              2003263bd05ca67cb9d033a562d8b606

                              SHA1

                              1e3e6e171ecdf8f3a212635a06a0e28e65a48ac3

                              SHA256

                              f41af6b399e0674b95f8489d116793ef63f6c71055538abfc02e2d0e029d7749

                              SHA512

                              697ba2e4324365ce9d81f420c9f1101fb469c5b263957ad4647a9ea03da529e48dc57fd3032753ed9df023c8c1bffcc4c2010deb1c40f130f756985a9c8cdbf6

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              11KB

                              MD5

                              c6264c62c278b9496e7723f641c966cd

                              SHA1

                              df895f236b048cb08c9f3e91686a97537334222e

                              SHA256

                              0bf1e51f17f3cc2eb9063f67843da1245511b61fea10f23c305fd90a7e790819

                              SHA512

                              24bda88fe8844befb4d7dc76d13a2b39055cd3a3d39df2adce17d941fb20a8058dfec9cffb2f9f03ecefdfaa882cb7c5094a3d4f0d97887f72a445732ec1f415

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\is-3LSMI.tmp\pw_sm_setup_x64.tmp
                              Filesize

                              1.3MB

                              MD5

                              5c4a0a1e17be1814f183575cfe43550c

                              SHA1

                              67fb9168558bf5f5ce288fc744f13f66a14fdff4

                              SHA256

                              4a7bdc30b49496db767a5ac413664ce33765a060dca0af59536d884a5473a3df

                              SHA512

                              d294cf9404555aa960c93988187d98157217b7422b62643d9297fd1b9af883d89a89cc030706f89c597afba4f8edf4b2350807c3852856cc3c8ab4aac45582ea

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\is-8GVJK.tmp\pw-free-online.tmp
                              Filesize

                              3.3MB

                              MD5

                              38088568f4393edc27739e4e3b3b157a

                              SHA1

                              5c37c271965fd43472c7c1fd48c3b490388923d8

                              SHA256

                              398b1fe38a434790f6d5e82d72bbaef3b3dfba13740bde388fb7749312c1b917

                              SHA512

                              032b02eea7fe8d0c2607f26d2ebab00d5a4fa075af34b7e7a145a815982fc6a457d84b5329033341b87f5b28fb95347ba2f22618fefc48331cc1f313c1dc4edb

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\is-FKNE4.tmp\pwfree-64bit-online.tmp
                              Filesize

                              1.5MB

                              MD5

                              0ffb244cd63f44b50ba573ae841a2d01

                              SHA1

                              e1b88b0a95ea7e0eb3da8d94b1297d4b88a96196

                              SHA256

                              6948125034370d9ef171880bb6ab29fba176b200902c453530505f7b5013db5c

                              SHA512

                              98978a59b27c535fb731718bd21dc6f14143dca7d5dc633530f5c64d708fa47f4839268304061bd9aa84121b62138d2c13b80a0a594beee6c7ed64a8bc09b1bd

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\is-PU0KS.tmp\MSVCR120.dll
                              Filesize

                              948KB

                              MD5

                              2fb20c782c237f8b23df112326048479

                              SHA1

                              b2d5a8b5c0fd735038267914b5080aab57b78243

                              SHA256

                              e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa

                              SHA512

                              4c1a67da2a56bc910436f9e339203d939f0bf854b589e26d3f4086277f2bec3dfce8b1f60193418c2544ef0c55713c90f6997df2bfb43f1429f3d00ba46b39b0

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\is-PU0KS.tmp\SmDownloader.exe
                              Filesize

                              66KB

                              MD5

                              0bb1be1cee6bc878acbb41b1af7cfc88

                              SHA1

                              e8769d43088d5800bc169455077329bb8cf973b7

                              SHA256

                              166960f92a85a33207dad124fea1938740a82809c05dd449fd19f39c2c029038

                              SHA512

                              91a7c4f634ff2becf934fa04fcaf8e0f27173394428dd08b90050cc0685f1fc403234c09cf3b20308a91e952f2023875ff2fd9d6386c783eb966ec5a71931056

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\is-PU0KS.tmp\libcurl.dll
                              Filesize

                              317KB

                              MD5

                              56f4c7d613927081e8311bc46ee0ec92

                              SHA1

                              b6aed1f136b7ebc94f5246d7d1518a5747998ed4

                              SHA256

                              f959786d18020a9ded99dc668e1f576cac8dd364e22d773d40e4fc693264555c

                              SHA512

                              5b4f1aa6db8bde8eb4b76ac036520fba09fe31958b0b74d3c17e0064cecc0f3995dc8b1a479b690c28831173328a0821f62cdc72ab26d3be575c6afc98544243

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\is-PU0KS.tmp\line.bmp
                              Filesize

                              6KB

                              MD5

                              9dc5bf6e4b2cad053d12ad24260d9327

                              SHA1

                              84b7d911b8d8002ff95edb523d108038b6ea3bf0

                              SHA256

                              efb22f0b990c4ed4a8d36868c7d9d3793b61f0728343306caeae0ae5f0751447

                              SHA512

                              25c3b183d96ee5ef9f5fe35ce898e718baf894dcb0a82049dde59b0779a7ede88907f1d1f44ff155cb1ea178c296aaf36975341679f7289920e615d4c01844f9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\is-PU0KS.tmp\msvcp120.dll
                              Filesize

                              444KB

                              MD5

                              a883c95684eff25e71c3b644912c73a5

                              SHA1

                              3f541023690680d002a22f64153ea4e000e5561b

                              SHA256

                              d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb

                              SHA512

                              5a47c138d50690828303b1a01b28e6ef67cfe48215d16ed8a70f2bc8dbb4a73a42c37d02ccae416dc5bd12b7ed14ff692369bc294259b46dbf02dc1073f0cb52

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\is-PU0KS.tmp\support.bmp
                              Filesize

                              822B

                              MD5

                              12ca16a9c8707b7f0a257e6cabbbea3a

                              SHA1

                              a0b81eb518de7eb4ee4f3ded01fdf781151ff874

                              SHA256

                              624677996b347cd36593d4a1107b265c903268086f2f548b50c0f329fd649a33

                              SHA512

                              70c595f65be3bd9d9d2f44b5240b3bf8f9e7b923c59fdf8f07dd3f89bd8731a9cb9abab2fe899b5aac1e402ec33c782974c9554584c088de9e051f99b21c9c78

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\is-PU0KS.tmp\unsupport.bmp
                              Filesize

                              822B

                              MD5

                              4ac29de505cfb25bbb88d190ad379d82

                              SHA1

                              582b2a54ce52a950614ee7dc444e5d1b4c532e54

                              SHA256

                              93a93ec1f9af7118b2fb05a1abc420781130e5663b92536a23ec6a4b172a0843

                              SHA512

                              fbfd193b678c5c2fc8a1a1d17dddf832d6aee35ab3f01ddb9f44eb48ce8125cd4efde9f7816161133ec13d477a3aaae842d8ea8ffbd97653eb5bfc96fbe204b6

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe
                              Filesize

                              19.7MB

                              MD5

                              7e96c8c3e1b65128192b4f51b196304e

                              SHA1

                              837d473933c8001ed80355828e57c006e5cc3064

                              SHA256

                              42df723a33b6475544a5c522d88d48a992163d9e83bff27791fcc4da09ef8be5

                              SHA512

                              af4a06046d722b4a243fa19f089590b571d2e9af2946659c72be8ca4063df71030b28b8d139feefa38d1b03c95e83395c8806f4a19c36e1fcf1480208f8e27e7

                              Download Submit

                            • memory/1448-443-0x0000000000400000-0x000000000044C000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/1448-3097-0x0000000000400000-0x000000000044C000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/1448-3803-0x0000000000400000-0x000000000044C000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/3308-3788-0x00007FFA94760000-0x00007FFA94CA6000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3452-41-0x0000000000400000-0x0000000000526000-memory.dmp

                              Filesize

                              1.1MB

                              Download

                            • memory/3452-0-0x0000000000400000-0x0000000000526000-memory.dmp

                              Filesize

                              1.1MB

                              Download

                            • memory/3452-2-0x0000000000401000-0x00000000004B7000-memory.dmp

                              Filesize

                              728KB

                              Download

                            • memory/3612-3787-0x00007FFA94760000-0x00007FFA94CA6000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3616-435-0x0000000000400000-0x0000000000481000-memory.dmp

                              Filesize

                              516KB

                              Download

                            • memory/3616-82-0x0000000000400000-0x0000000000481000-memory.dmp

                              Filesize

                              516KB

                              Download

                            • memory/3644-3098-0x0000000000400000-0x0000000000552000-memory.dmp

                              Filesize

                              1.3MB

                              Download

                            • memory/3644-3802-0x0000000000400000-0x0000000000552000-memory.dmp

                              Filesize

                              1.3MB

                              Download

                            • memory/3672-3790-0x00007FFA94760000-0x00007FFA94CA6000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3956-3789-0x00007FFA94760000-0x00007FFA94CA6000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4048-434-0x0000000000400000-0x0000000000587000-memory.dmp

                              Filesize

                              1.5MB

                              Download

                            • memory/4264-6-0x0000000000400000-0x0000000000760000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/4264-42-0x0000000000400000-0x0000000000760000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/4264-44-0x0000000000400000-0x0000000000760000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/4264-3811-0x0000000000400000-0x0000000000760000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/4264-47-0x0000000000400000-0x0000000000760000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/4264-77-0x0000000000400000-0x0000000000760000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/4264-302-0x0000000000400000-0x0000000000760000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/4264-3894-0x0000000000400000-0x0000000000760000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/4264-437-0x0000000000400000-0x0000000000760000-memory.dmp

                              Filesize

                              3.4MB

                              Download

                            • memory/4888-430-0x0000000071C40000-0x000000007218A000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4888-429-0x0000000071C40000-0x000000007218A000-memory.dmp

                              Filesize

                              5.3MB

                              Download