Overview

overview

7

Static

static

1

pw-free-online.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    92s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 15:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    pw-free-online.exe

  • Size

    3.1MB

  • MD5

    b00f4ef87125599ae72def4555e48175

  • SHA1

    8b1073b0cec1d85a6ca39842e43c8a9f49526953

  • SHA256

    bc917c4424c078290c3cbbb13e5f2f9c2939222d058d70056688718ae33e13a9

  • SHA512

    d4f8f6d52a25f4977d7d812696f92dc6d72410b0675658b3c143f255f2b7313ffe904752778a9e17992477f5e9102cc81f6d68858be3f1db96ae4d109ebf80a0

  • SSDEEP

    98304:UkL2991YngbfnLTccGEE7kc7EF2DKlVcu/xI9Gu1:j2991OgDtQIc7E4Wcu/xI911

Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\pw-free-online.exe
    "C:\Users\Admin\AppData\Local\Temp\pw-free-online.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Users\Admin\AppData\Local\Temp\is-M8R30.tmp\pw-free-online.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-M8R30.tmp\pw-free-online.tmp" /SL5="$80054,2294223,1148928,C:\Users\Admin\AppData\Local\Temp\pw-free-online.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:872
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /f /im "updatechecker.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4412
      • C:\Users\Admin\AppData\Local\Temp\is-ISGU0.tmp\SmDownloader.exe
        "C:\Users\Admin\AppData\Local\Temp\is-ISGU0.tmp\SmDownloader.exe" /HWND:917786 /PATH:"C:\Program Files\MiniTool Partition Wizard 12" /URL:https://www.partitionwizard.com/download/online-setup-config/pwfree-v12.ini /VERYSILENT /USERMSG:1450 /LANG:english
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3048
        • C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe
          C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12" /LANG=english
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4408
          • C:\Users\Admin\AppData\Local\Temp\is-6EM3S.tmp\pwfree-64bit-online.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-6EM3S.tmp\pwfree-64bit-online.tmp" /SL5="$C00DE,20098929,488960,C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe" /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12" /LANG=english
            5⤵
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3368
            • C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe
              "C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe" /createtask
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              PID:372
      • C:\Users\Admin\AppData\Local\Temp\is-ISGU0.tmp\SmDownloader.exe
        "C:\Users\Admin\AppData\Local\Temp\is-ISGU0.tmp\SmDownloader.exe" /HWND:917786 /PATH:"C:\Program Files\MiniTool Partition Wizard 12\..\MiniTool ShadowMaker" /URL:https://www.partitionwizard.com/download/online-setup-config/pwfree-v12-bundle-sm.ini /VERYSILENT /USERMSG:1439 /LANG:english
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\Users\Admin\AppData\Local\Temp\pw_sm_setup_x64.exe
          C:\Users\Admin\AppData\Local\Temp\pw_sm_setup_x64.exe /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12\..\MiniTool ShadowMaker" /LANG=english
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3132
          • C:\Users\Admin\AppData\Local\Temp\is-TAURK.tmp\pw_sm_setup_x64.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-TAURK.tmp\pw_sm_setup_x64.tmp" /SL5="$2025C,208624469,268800,C:\Users\Admin\AppData\Local\Temp\pw_sm_setup_x64.exe" /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12\..\MiniTool ShadowMaker" /LANG=english
            5⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3100
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "SchedulerService.exe"
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1124
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "AgentService.exe"
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4968
            • C:\Program Files\MiniTool ShadowMaker\testOpenGL.exe
              "C:\Program Files\MiniTool ShadowMaker\testOpenGL.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1076
            • C:\Program Files\MiniTool ShadowMaker\initsrv.exe
              "C:\Program Files\MiniTool ShadowMaker\initsrv.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2644
            • C:\Program Files\MiniTool ShadowMaker\BootTrigger.exe
              "C:\Program Files\MiniTool ShadowMaker\BootTrigger.exe" "C:\Program Files\MiniTool ShadowMaker\SMMonitor.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1332
            • C:\Program Files\MiniTool ShadowMaker\experience.exe
              "C:\Program Files\MiniTool ShadowMaker\experience.exe" http://tracking.minitool.com/backup/installation.html?mt_lang=en&mt_edition=pw-trial&mt_ver=4.4.0
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              PID:2804
            • C:\Program Files\MiniTool ShadowMaker\AgentService.exe
              "C:\Program Files\MiniTool ShadowMaker\AgentService.exe" -i
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1732
            • C:\Program Files\MiniTool ShadowMaker\AgentService.exe
              "C:\Program Files\MiniTool ShadowMaker\AgentService.exe" -s
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:428
            • C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
              "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe" -i
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2268
            • C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
              "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe" -s
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3156
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.partitionwizard.com/feedback/install-partition-wizard.html?from-free-v1208
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4764
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83ff846f8,0x7ff83ff84708,0x7ff83ff84718
          4⤵
            PID:4060
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,15027718928047466651,7227906241111626247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
            4⤵
              PID:540
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,15027718928047466651,7227906241111626247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3168
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,15027718928047466651,7227906241111626247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
              4⤵
                PID:3156
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,15027718928047466651,7227906241111626247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                4⤵
                  PID:4212
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,15027718928047466651,7227906241111626247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                  4⤵
                    PID:3048
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,15027718928047466651,7227906241111626247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
                    4⤵
                      PID:5536
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,15027718928047466651,7227906241111626247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5648
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,15027718928047466651,7227906241111626247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
                      4⤵
                        PID:5732
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,15027718928047466651,7227906241111626247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                        4⤵
                          PID:5740
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,15027718928047466651,7227906241111626247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
                          4⤵
                            PID:6016
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,15027718928047466651,7227906241111626247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:1
                            4⤵
                              PID:6024
                          • C:\Program Files\MiniTool Partition Wizard 12\experience.exe
                            "C:\Program Files\MiniTool Partition Wizard 12\experience.exe" http://tracking.minitool.com/pw/installation.php?from=pwfree12
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:4840
                          • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe
                            "C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe"
                            3⤵
                            • Checks BIOS information in registry
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            • Checks processor information in registry
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:2956
                      • C:\Program Files\MiniTool ShadowMaker\AgentService.exe
                        "C:\Program Files\MiniTool ShadowMaker\AgentService.exe"
                        1⤵
                        • Drops file in Program Files directory
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:1008
                      • C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
                        "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe"
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:4676
                      • C:\Windows\System32\vdsldr.exe
                        C:\Windows\System32\vdsldr.exe -Embedding
                        1⤵
                          PID:4572
                        • C:\Windows\System32\vds.exe
                          C:\Windows\System32\vds.exe
                          1⤵
                          • Checks SCSI registry key(s)
                          PID:1988
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4612
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2032
                            • C:\Windows\system32\AUDIODG.EXE
                              C:\Windows\system32\AUDIODG.EXE 0x4c8 0x3c8
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5332
                            • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe
                              "C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe"
                              1⤵
                              • Checks BIOS information in registry
                              • Drops file in System32 directory
                              • Executes dropped EXE
                              • Checks processor information in registry
                              • Suspicious behavior: AddClipboardFormatListener
                              • Suspicious use of SetWindowsHookEx
                              PID:4768
                            • C:\Windows\System32\vdsldr.exe
                              C:\Windows\System32\vdsldr.exe -Embedding
                              1⤵
                                PID:3520
                              • C:\Windows\System32\vds.exe
                                C:\Windows\System32\vds.exe
                                1⤵
                                • Checks SCSI registry key(s)
                                PID:4704
                              • C:\Program Files\MiniTool ShadowMaker\system_backup_gui.exe
                                "C:\Program Files\MiniTool ShadowMaker\system_backup_gui.exe"
                                1⤵
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Checks processor information in registry
                                • Suspicious behavior: AddClipboardFormatListener
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of SetWindowsHookEx
                                PID:5796
                                • C:\Program Files\MiniTool ShadowMaker\QtWebEngineProcess.exe
                                  "C:\Program Files\MiniTool ShadowMaker\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --application-name=system_backup_gui --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=3424 /prefetch:8
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:372
                                • C:\Program Files\MiniTool ShadowMaker\QtWebEngineProcess.exe
                                  "C:\Program Files\MiniTool ShadowMaker\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=2 --mojo-platform-channel-handle=3440 /prefetch:1
                                  2⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3828

                              Network

                              MITRE ATT&CK Matrix ATT&CK v13

                              Initial Access

                              Execution

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Defense Evasion

                              Modify Registry

                              2
                              T1112

                              Credential Access

                              Unsecured Credentials

                              1
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Discovery

                              Query Registry

                              7
                              T1012

                              System Information Discovery

                              6
                              T1082

                              Peripheral Device Discovery

                              1
                              T1120

                              Lateral Movement

                              Collection

                              Data from Local System

                              1
                              T1005

                              Exfiltration

                              Command and Control

                              Impact

                              Resource Development

                              Reconnaissance

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Program Files\MiniTool Partition Wizard 12\Qt5Core.dll
                                Filesize

                                5.3MB

                                MD5

                                a7e479e3fb8c45b4b572a301588c0de0

                                SHA1

                                a254d7e90a27196a6e40b9daacc1f72748ccc155

                                SHA256

                                a71c5a226fbb4334353cc1d0f4abacba8a509f8544f286d352e1ec29c86c0742

                                SHA512

                                92c4303df4967d48a957d258dc2502eedd50a39c7d5d2120f69233f53d67dde13be7112309dd71c0ba9b005951e59a416c5139861522c73cfba3bd49e6b370ae

                                Download Submit
                              • C:\Program Files\MiniTool Partition Wizard 12\Qt5Gui.dll
                                Filesize

                                5.7MB

                                MD5

                                89c68c9d29d7c527097eb4a1317f71ad

                                SHA1

                                58add7d0d991931ac92eb144e007894412ae570a

                                SHA256

                                be00d70e40813e1a8ae4715b8e3cdbfb6470dbffc7d591459bb4afc30e77f715

                                SHA512

                                bfe224dec896857ebe32e75e52823f821b3791312d9629d63b565e2cd12e1854aff5e66cc416555dfbe08887a6171dfb6393e9084a0adaa2ee3528aaf0e2617f

                                Download Submit
                              • C:\Program Files\MiniTool Partition Wizard 12\Qt5Widgets.dll
                                Filesize

                                5.3MB

                                MD5

                                d654ed44099c61cf7ddc07dabeca28d3

                                SHA1

                                1acf0f22f3cb15585fe8ec97dad00eda8ac30d51

                                SHA256

                                3bc64a69dc06e7a12442c04225630ba57c779d6e9e4e1aff9f986c3e68883f27

                                SHA512

                                9012f71a8dd27c56b46b341c97a8ac964bdf399f1f9d8740763be34bc4d179db5bb4fbee153e715990a37c2b1391b2622bcacffe32756abfaceb45183bf7f0ea

                                Download Submit
                              • C:\Program Files\MiniTool Partition Wizard 12\msvcp120.dll
                                Filesize

                                644KB

                                MD5

                                edef53778eaafe476ee523be5c2ab67f

                                SHA1

                                58c416508913045f99cdf559f31e71f88626f6de

                                SHA256

                                92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f

                                SHA512

                                7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8

                                Download Submit
                              • C:\Program Files\MiniTool Partition Wizard 12\msvcr120.dll
                                Filesize

                                940KB

                                MD5

                                aeb29ccc27e16c4fd223a00189b44524

                                SHA1

                                45a6671c64f353c79c0060bdafea0ceb5ad889be

                                SHA256

                                d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa

                                SHA512

                                2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006

                                Download Submit
                              • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe
                                Filesize

                                437KB

                                MD5

                                91090465ee5404063b278d495b2f946c

                                SHA1

                                94bc1b122af8b6578093fb927279c4c9f81c7abd

                                SHA256

                                c84ed7b59adc67d09b623a2243915bc89a18e929646ce6eae892992cb7cf5baf

                                SHA512

                                181ef507964bd5a8f07bdfb43a15c0d708f22947337881e3245e0233c63899acf1ec631e878440624f71887f0be1c7d49b06008d6daa4c81978d8d37106ac7ec

                                Download Submit
                              • C:\Program Files\MiniTool Partition Wizard 12\platforms\qwindows.dll
                                Filesize

                                1.2MB

                                MD5

                                9608d1a7416a2534dee37613fb8bcb35

                                SHA1

                                c6dac2916d5740a406e784d035f7dee3e6ddb971

                                SHA256

                                d3f3f1eea7662a928cea0d9029d83e8b6a23a24d641056c3575e4b2d33b05bd1

                                SHA512

                                11fbd7751abd89354383645666a70a6ceb37ec005eb064b5307101823d900073f82631f95201cbc81b4a965f1ca2f5c180b9779778ac09bd5fc6a851ae405e0c

                                Download Submit
                              • C:\Program Files\MiniTool Partition Wizard 12\qt.conf
                                Filesize

                                46B

                                MD5

                                ed54ff3a93486892b6a41c877df944d8

                                SHA1

                                c9a359103ff7bd26b4a74daeef24476e3fb95232

                                SHA256

                                3e25ea931f3228cae2b0138b66aeddb90cf73e93c108621e431c89c87f3fd594

                                SHA512

                                5821dfaf8a09fb2783b9b670fd984d07af8bbbc5e219aa73b8187b052b947475cda2cc59cdfd2556ad1805ee5081323749a3f196a397ffbf641846a302be98d9

                                Download Submit
                              • C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe
                                Filesize

                                214KB

                                MD5

                                5f150ea19c59d9604f7d4e77b0b24d7a

                                SHA1

                                d60dfb51a34272321559b74944e9a217215f56db

                                SHA256

                                bf3fab722c2bb8ff3f8bc7cbe00c107098ae371999e4269abf97a13e200a5bf3

                                SHA512

                                5fcd8c73c5cb6eee8091a7298e2041f1277dfb49ae8010e5981e04677097c85ea8d3d85299df152db37c34061e246ea36dc33885490eebaa9b9d13edebac36a4

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\BootTrigger.exe
                                Filesize

                                182KB

                                MD5

                                adf3eee2895895d350cc128b15938e8b

                                SHA1

                                5fadd780fba0913379b07e6878a82939b5035735

                                SHA256

                                858ced75aa403ef5738a8f10eddfef142c57ebc547b8347b4fa29dadb3720cbe

                                SHA512

                                77ce3753888879dc9b5ec69089a0133e47c522d2b0603bb3d2549439fa780ab3ad563b9471f7b7b97e8535a61a3b8092b79e42df302ceb74c0cfa26168d88bd4

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\PETools\amd64\boot\is-I1GB3.tmp
                                Filesize

                                4KB

                                MD5

                                d4befebf3cef129ac087422b9e912788

                                SHA1

                                62313ec73f381c052f2513ca6279cfb5107e98c0

                                SHA256

                                f425e135aac26b55e2bac655e62e2ce0b16255226c583d9ab43b2e93e8a6d932

                                SHA512

                                3814e4682cad2ef40061d3d5e8142c964cc73a6c6dfc72ba59cbab0922dd0c7e279703450e3a1f4fcfde3498565bf6ef28a30e7de53a0eda75b3fea76d03929b

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\PETools\amd64\boot\is-L39C9.tmp
                                Filesize

                                1024B

                                MD5

                                eb145d5f87ddf43c8bd6f27e97db8bf2

                                SHA1

                                2021c98f81b177d17543ebd34004891183fa3dd4

                                SHA256

                                a7a0edaf85f70e833fac02d0a416ae56ae2a3593e787f39c25dbb12830ca737c

                                SHA512

                                b85ff5a038173898b7f96890cb3998034bbcc50301cb31db112eeb04c3a1ed3c6b6d7905e48fc8cfe1fbb058b32e61349653b345bfe25fbfaa2ccffffda031ab

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\PETools\amd64\is-53BT3.tmp
                                Filesize

                                388KB

                                MD5

                                21bf183c15afe62a8d1137bb9007b2a3

                                SHA1

                                d656dd1e85d7e8acffdefa9ced5d74bf0b978e39

                                SHA256

                                2fc3d311969b63a258446488ec75c275d736ded13d74624e1c541f43a72ab483

                                SHA512

                                8a67833d502edaba077c783dab69a7d8c9155971c409f78cb87948bd4415b7a58410517aced73d6ed7d13a6b975af769aa0623b9dffd9537f5a1ce0248308291

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\PETools\x86\boot\is-LSC4S.tmp
                                Filesize

                                3.0MB

                                MD5

                                22d9945b4aae36dd59620a918f2e65f4

                                SHA1

                                bb025cedca07887916c4b7e5fa7a641ed3e30c14

                                SHA256

                                cd2c00ce027687ce4a8bdc967f26a8ab82f651c9becd703658ba282ec49702bd

                                SHA512

                                dd2d0ea7d5cf98064838ce0b74711f77534e1a2a14c7f74d44ed4b83acdb6f413d74671d2c6a8574aee88afb456b53a6b8452419a3bdddf2f7e9095c9d1d272e

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\Qt5Core.dll
                                Filesize

                                5.8MB

                                MD5

                                484cc5d10aafd02f2b5b46edf32f7303

                                SHA1

                                4101d7111ff77d36e55eb9fc5bbd63b3dcf27bd2

                                SHA256

                                6b5338cf3fd3f1d4c060c3f6fca84ef7ce5cc19449a48332b6da9f3c0158694f

                                SHA512

                                85a3c5e74bb5ee6c909df5ef6610938da0e9c56355596650943947e65aceb261f0f2310016cac9e0e25a518902fbc3bb3983ee084b10e8b44f483e00878204e8

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\QtQuick3D\Materials\maps\is-2G3GF.tmp
                                Filesize

                                334B

                                MD5

                                882310febbcd112f6416015145fd8c6d

                                SHA1

                                e142d0ba597a2c773e6354673bbc4a760f8d963f

                                SHA256

                                03003aa01026e944b75447078f5758d0ffab854d03e9ce80780a174411073f7f

                                SHA512

                                b21d8a189123c3019b5c99c1927d9eb10293cbe9321cb54d1fe183bf57efd22f778a61e47be27afb8f54d731ce17f96a6c6452dc76c3a8596b1bf1fdd532d4c4

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-7PIQH.tmp
                                Filesize

                                8KB

                                MD5

                                729c3403f7fa48350383c17fee0ab05e

                                SHA1

                                4835887831dcb4996297f4276acb376b431b8e85

                                SHA256

                                171f983572a751a861298aef3ab3b0d82ad0f3cc087a8987c308e008479af7bd

                                SHA512

                                397a93eb25ab7b66b74bab38773cf1fb030b611b53bc024e9e2778436868bad212f6c8a842a6c54e58d15066730384443e7c1ce059c70051ab47f5c99bdf83e4

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-9C01Q.tmp
                                Filesize

                                11KB

                                MD5

                                a7652c278fc0f1d99653bbf1b5ef0796

                                SHA1

                                8bbe33d7f5eb8619fd3dc464ec522a0c97be69b2

                                SHA256

                                d5a0e0f60d23369f2dbe7929c79db4d2b0c4f76da1f039229918577647e51309

                                SHA512

                                f18bc23113eb9d208c87f8770ac39bac5329cc251a2b0fa34ba34b3c93f94934e95f5033e4f0c46995eebc3140a1235e7832976de4ddd651a2f958bf65983b5e

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-9J101.tmp
                                Filesize

                                27KB

                                MD5

                                d5d3a570934ebb25bf6076c4347b6e8e

                                SHA1

                                e7c4c16670fd26f98c70832936b6279e4c42b170

                                SHA256

                                12b663de499ac95f43283b93e93d814ff529ea14da3313ab0345685829d01eb2

                                SHA512

                                42f94cee044eb5a0f5e53c461f411edfc723957cf374ad82cdaefe4bd9e7993db51545e9d21d5169f9862280d2d5b93b420937f8b4b448f777e1120e785852fa

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-CDVV5.tmp
                                Filesize

                                608KB

                                MD5

                                b4a4eed72dda932bf19020d1af6ebe16

                                SHA1

                                f83ae8045654e9fc23909ceab60e6638d43a5d46

                                SHA256

                                fb0dc7d25e596ee14d0bfef1933e204f07db9bbd2ce284b9df824d4c3aa56818

                                SHA512

                                ff27c35a7e1626033d8f52ef5514868b548adbef7015df99ebe4b786057345b6e15cbd59aed5bac952415e3a58e58e289551a0110114a27889a137278f648a37

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-LIDT7.tmp
                                Filesize

                                8KB

                                MD5

                                e9065bfa9f88f01266914355016d91c3

                                SHA1

                                11e8e296c46037b5dc47e05be04fef703a9664df

                                SHA256

                                3b2f5365e919d3512106c334e32def5b7984c67f353a51fd8b5f1aa659302129

                                SHA512

                                8fc6e5de9a90a819336667598106ceb944219d55170db92982aa409193d525787eb2f41234ffab25663beac58254fb13b8fce12d1daf052963ecdd4f4c3b4d4f

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PEDrivers\x86\f6flpy-x86\is-SIUKJ.tmp
                                Filesize

                                12KB

                                MD5

                                524aed2e8bf6db6dafcba00123c5f62b

                                SHA1

                                749852a2a94d9fbea4f6cfaa269b932d790e4b7c

                                SHA256

                                91ba645003fe189ca0c2fbd98dfa8ad0ee8fc69140c5a69a52b1a5adf4223200

                                SHA512

                                2a9196aaa125e7178289647ea7abcbce407965d1e7b109cc25fb2fea9f5076d4fe2c3fb590b7ec7fd4e79a67e872eba4c5f890931880f479fbbe8f1b836364bb

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\amd64\boot\is-JNE1M.tmp
                                Filesize

                                1.4MB

                                MD5

                                8d6bdcc0269dfe01c4c0296dd62b585d

                                SHA1

                                90e9d250461385af451c14bf3fdd2c6bdc288b13

                                SHA256

                                f083e7d85d1389d0700478a7a109a404bbb1c6a8cea4c7fa49dd6d03f11c35c4

                                SHA512

                                f9c31f90987010aaabeffc386550bb43eb214f2d8269af3111da61d707a667f6948a98d02f7663c294a2036c0c5c95a3211374b93dd1fce64117710ea2157fae

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\amd64\boot\is-VDOOS.tmp
                                Filesize

                                256KB

                                MD5

                                4e6397849461b037c91e6914fdc4976f

                                SHA1

                                4bc15aed32c60ab7722abd7ccb7404b15bc8a98f

                                SHA256

                                3be6f02df7395ee9df212e7b421feb38cf98ff301335df82a0ccab322c51cc05

                                SHA512

                                d6e3b3c86ff18e35197a812df1005f82c36068c52a2a1a3d8d8e808ea7bd80e21e9f0de19b3b33226d8aff97fcf52a54017be98fd9ab28b1e22f7c49a18e48d1

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\amd64\efi\boot\is-QJQDE.tmp
                                Filesize

                                1.3MB

                                MD5

                                ff6d345785671fbcea9561a3cbc47702

                                SHA1

                                0963edbc8d3486017c7a65168ffd515ab5bed968

                                SHA256

                                bea5931767dca4c46ef7d6ad73e6913a592860138d3fc82056289b8dff337940

                                SHA512

                                80925852082dc97e8986291374138eef10b1f56dcde7b3a456165226c6e38966d5e0d73b6c7ef6d67419f66637a7e8a1cb2352008be883b0ff862d18c0469b5b

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\amd64\efi\microsoft\boot\is-NOMO5.tmp
                                Filesize

                                256KB

                                MD5

                                a29ba030a801aa62c25fd028166c8ee7

                                SHA1

                                ab8c61f76874a29095297767d6e49697ef079bc6

                                SHA256

                                a0ab68982229efade615050c93903e125446d3efe1dc08d26a864dc7431991d1

                                SHA512

                                606ab1c88ae77db387368340679886659ed22484a47317982ca6e3dce631df8c09ff561db61e77341df0cdb916c5d2580384cfe37890274c8415869011ba92a9

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\amd64\is-N5JP8.tmp
                                Filesize

                                1.3MB

                                MD5

                                75d0032ae18e04a1254448f3fef14a6a

                                SHA1

                                67bf3587febf3c60fc2db86cfd5cc3abf510b8bd

                                SHA256

                                708a5e2b9f37c099d223ff297450a697c5e0002c969a6e5ffd92349f28fdf1cc

                                SHA512

                                5464cd62a08cb9e8f8fe0243416de1926adabbfa695fdfbbbe9c666dfa509d334ab941c5e1ace6feccc266d139fea40b02e8983e34fe49e40403673c4297ff7b

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\x86\boot\is-00OCG.tmp
                                Filesize

                                1.4MB

                                MD5

                                247f53d01ca3024505e86e8e266d4e46

                                SHA1

                                416331400a46addfd7952be6ffc5af391f2921e0

                                SHA256

                                68050e999473b9587535e3c03cd8ed25e62547b85b088645ec8c59e962a697e9

                                SHA512

                                03b13889f6f631250e1b8ba1a20d1d8a6b9c3bc115c14855c5a7b5f3b66c29b58dbbc58a616b3b3ee6b70a675345f4aad40c3024cb03936ef29a451b45456891

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\x86\boot\is-PBUH9.tmp
                                Filesize

                                256KB

                                MD5

                                d4774c3254be80d729cec1c70d737ff0

                                SHA1

                                6d8ebc1ddd27703689770b68131d5b3ea3f2b717

                                SHA256

                                18bbceb1150adea8ca3958e409821b3ae155c82fab2098ef79eb3f6bc9ecf3fa

                                SHA512

                                44000cd6ab7b0fd15e4edf22fa23ce350dfcde382752e8f70052ee78978d8dc9068d5eee784a7e4843fe4b4a03327e0d90f61b7486f83a810c6f83e6f827057d

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\x86\efi\Microsoft\Boot\is-2B2J2.tmp
                                Filesize

                                256KB

                                MD5

                                10647fde0b2a53d88230682d6b66fc4e

                                SHA1

                                08b5704d282305d50618e0e748ce7ae1d66353a3

                                SHA256

                                050aff6c0ed8015ec81fbf54ec47625e2d436db7d1495c53ea943f3f11b8e950

                                SHA512

                                bf59b1f005d075661b33e18a1ec869d8b04975be69aaa7f7a0393615ea5259eac5eec0a20e27605e2d32433d6cd29c9c90df6a354821a8b98a1a36538439c064

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\x86\efi\boot\is-QDILI.tmp
                                Filesize

                                1.1MB

                                MD5

                                32643b08ef8162247c4f02d28b91aea7

                                SHA1

                                b55f48a499b53a8e5b535505b49be437d4de677f

                                SHA256

                                91c628e8059b35f450e5ba27a9fe1cee44b52df2a2d10a037fb0a8c04d176028

                                SHA512

                                925616abbb7526c2dff8ecabd638d298489142b007c9854a4ee31a04c2e1e37e92915dc91e3413f705fcc302ce01adf0cab8202a337ea78fa70719878f90d9b2

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\PETools\x86\is-MDKG4.tmp
                                Filesize

                                1.1MB

                                MD5

                                639234efee7d49adb5e9429c3f23dbd8

                                SHA1

                                f98687c887bb70233e28df4b93cb174514663f90

                                SHA256

                                30f0570e65a79f60128d99bf7d65ac4be571c77b744358dfd71341eb1b82f98f

                                SHA512

                                9f2ad6a44eac5bdc786d63291100246f74305a4776c9db25275afd01b66c203c01fd02af0ff31ff0d69274e07fce4196a571e31b1ae559565fb07082b5e1889d

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x64\is-2CCDP.tmp
                                Filesize

                                2KB

                                MD5

                                0a0aa027d5f35d900444d66c5fb5043b

                                SHA1

                                2182e346edc3d894edc912deddd8bbe129c10418

                                SHA256

                                c3090f85c627aa7849afe5622e8dc211cb873e86cde41d2d2ba7b73a475108e1

                                SHA512

                                273137ad3be5ecd2a738b6d66576adff4c732bab05461fea6cd954b4b624f85314e508e8f33e7fdd24a82718169c6a49073b5d57fd074ef59bef39b467f312a9

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x64\is-2GESS.tmp
                                Filesize

                                16KB

                                MD5

                                5efdc1c1b1187efe3021121275d46852

                                SHA1

                                8b83a5d6f8511e759d20a152f720ab5f584945ca

                                SHA256

                                de26e6f1093ae186615d9dbbe73e872e7bf97981ca216281afff86c77a73cdb7

                                SHA512

                                d2c356f61fcfb425d3623a94f586419a8d18ffc1196a84a1b612b01804d46d1eac24231a8800ee563dd6c5d629ed582ba26ff85c9a5eb0d3257385b7b1fa89b3

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x64\is-4FBT1.tmp
                                Filesize

                                45KB

                                MD5

                                9291d6a107b7f2cf676ec2394ea5829a

                                SHA1

                                59329d5b141af32f7a7dec2d33547291a728b2e1

                                SHA256

                                7415e90f75702e79ab64620a5143ca09c47166e9cf9de497bbbb9ca911aea930

                                SHA512

                                1f51cfdd4c929d1903e5889a82378bb7443a679cbaec94667ba2aa38450a05c3616482a7d4f422e0301287dc1cdc4eb1ef5468ee57cef969d40968758f653b5b

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x86\is-6JGSE.tmp
                                Filesize

                                2KB

                                MD5

                                3a27fe065699a6acf2e42a64411c3a5c

                                SHA1

                                42666174100eb307c5d36a2e612654a798f0eaa9

                                SHA256

                                943d73cd5983797f8b71a9b05b1a4c71fc6f89a319f619b0e4f5063ea60cb04d

                                SHA512

                                038a1aa8c8f98fa6853e6d9594bce07fb64cd536421ab1ddfa4fc72603d8df26f3293d61ba33a57d89dd2bc25edd92b24417d73e32b438874560a65d2cb43a1a

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x86\is-772GJ.tmp
                                Filesize

                                46KB

                                MD5

                                7b771326d0973ff2c92d1375c1e7ba23

                                SHA1

                                23f1072409f29f81b68f44a7a7b00ab6eb78c8c2

                                SHA256

                                29b09d71d1512aee316e47255ab07c09097e7ea9b9b7418833114555047f20d9

                                SHA512

                                7078d4d1acb1c6e722c0ead3bee1b3cb5dd0a11afb012e1c31d21b3faf3671952dabbeb92ede587d23e203b446d3017e449f6ce5ea80c4d6ade405699c593e25

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\win8_x86\is-KBU5U.tmp
                                Filesize

                                16KB

                                MD5

                                443d4a687a8fcea51aea02c2bf3e7583

                                SHA1

                                08b6ef2e35608ed571b9c6f44c789e7d21572789

                                SHA256

                                0882fa66c7a4fd317c2474352adae7f09badacefed38fa1900ecc7fc5e2e4afe

                                SHA512

                                866175fc28c64f21f90a2672e0b8941f502c8b1473c32dd5ff95445dfb651cad41e75754b406257532af7ad076d362032e65532dcc0d9b021e0feb590b523594

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x64\is-4V3SM.tmp
                                Filesize

                                46KB

                                MD5

                                22d39a881eac214bb7a523bcc627c084

                                SHA1

                                a8c39858c9e71e89fa40d9b791e7f11a32b610cd

                                SHA256

                                491b11dbea8d2c2433db01eab51ed4b87c87ff4692f8d1c074c322ccb64274fa

                                SHA512

                                bf6a91357ec7a27c41575fe6711f6cdb0bbda33ec2b48f9955d93920f1015fda11af28be04c2f2c4673d1d0bd9481f2e8424008b6a29a6195296a3c74cf20d26

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x64\is-EN0LR.tmp
                                Filesize

                                16KB

                                MD5

                                f49c0e3cbe4b20fba47bfcf09398a033

                                SHA1

                                f2a4da1854913f2eac1d1679cc64b13533a361a9

                                SHA256

                                dc601b9937956c7e47993293bcbf1bac5b2f60654e0b06eb203f389eac168f7a

                                SHA512

                                6906983db78d14bcd769e5ead47bc60ce6bf913c3ebb207e4a8161cb3fe98ea652cf6f8ebee5f0e125b82b38228d94db25ca00d63f297d5b3210355ecd15e89e

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x64\is-HBOIM.tmp
                                Filesize

                                2KB

                                MD5

                                2984c2c7102f412d159f0b9221fd574f

                                SHA1

                                9dc24e331812088cbca5c52f1d31988137115887

                                SHA256

                                9edbfb670e0fc5e4d23967678a02aa729f78bf0ecf03317f4d497b621eab914c

                                SHA512

                                c2147f1366379f35f58da3b6f52f7afe09502e5ede78d3c0ba2ed2afbbcb6aa40400f0bf5ea8de53d9fbd17d536d49896924850ca1684ec297a738bfc5bf0dc7

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x86\is-3HO5B.tmp
                                Filesize

                                2KB

                                MD5

                                91ac2fc716e62b20df481ae4703b4c9e

                                SHA1

                                1a2f0b8b42e9d58d7a73043b08b6719dc30a71d7

                                SHA256

                                7ee191a9594f014847325a1b8614457c6ff071019d1ed5a72d3cc1fb496696e7

                                SHA512

                                6864b3662bbfe7267f790dc02279969a15d5792850de7ee59fe8902e1959c48618102abe3b14dcce1b66b87150b4be7046518cbe46ca792344e97e25c5e4d6ec

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x86\is-88KFS.tmp
                                Filesize

                                46KB

                                MD5

                                fd88596392f3e4fd8a8965273597accd

                                SHA1

                                b3e448a40fc0f2b2267f3bdf4046be6dc91a9b96

                                SHA256

                                3aa7ebdb1134afeb28aedf41b3584808ab81c7ba82ac2f54e198f75b6213384b

                                SHA512

                                d21761283ea026367c2f8ee65bfdd10882c46f84e0831ca867c59beee047fee016bbcf0ad68fda3cee8a580f8570b3a548dce0ee25fdf38cdcd2253d24406078

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\en-us\x86\is-TFLGT.tmp
                                Filesize

                                16KB

                                MD5

                                2d58f98ad022e2afe56c0f3a452610ec

                                SHA1

                                476533d30698ae918a19933e590a856761f4738c

                                SHA256

                                d13064abca4361f9ca54a675f361f6c4d1c723beb9eff1301b5061d5abc3ede5

                                SHA512

                                1e0f785659bf3fbe46c29ebd8679d7fdc4661c81fe966b917db470370cfe2ad207a27ca1a07c5d02d887f2791a1d1d91dc6f83a0f0c9818c39af960530f1d9d1

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\is-013E7.tmp
                                Filesize

                                168KB

                                MD5

                                91899280efb4496c8ac0a004cd1469e2

                                SHA1

                                aa9a223cedc82f3ce8e9080bd6273062a9b56958

                                SHA256

                                cd711e09012f37003af75e982e2e40df14445aca2800a3702a18612074ad660b

                                SHA512

                                5fd1c76157a0abc7e477c26a52d3e6a037a36b31a91e0958163a3b2337214a4d018b8880ea6f763c3812a37bc08917f0d9ea947f988dfec88720146e5783f251

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\is-17PJ7.tmp
                                Filesize

                                549B

                                MD5

                                a864f7143f9dd47906454977b9f4edbc

                                SHA1

                                72d4d5359678d9062ca14a0cb85d381cc7cc589c

                                SHA256

                                64cccb16f7eb203d7d3858e51f62e3beb8c3d7811935cb06a5db53614515d582

                                SHA512

                                289a8f9ce0eaf3c1626fca16263470e16ede13224d90cf40dd50dc1cc326e5ce2bc7595f37ed772c8b07605652a652ed1e3457b66bacd67c66ffac79d98f78c0

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\is-4LMII.tmp
                                Filesize

                                203KB

                                MD5

                                c1a2bd41b8d539c92b2bc34f1b6bd2a9

                                SHA1

                                9d03499e707a351f5fa8163c7cb00a593d2fa70b

                                SHA256

                                712fe9cd3cd3abecf2f3ee2dcf848ec06b62bc27c83a993667d095989c9ce873

                                SHA512

                                dbf772879aee19959f1c72134f7299239e20453368f507dd57a9e97df2c4b959ebdbb24a133d35d486ae2814a69a77c843ce102bebc2693a898b32ec0a919cc5

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\is-7GLD2.tmp
                                Filesize

                                497KB

                                MD5

                                6bb403f6c388f87ace8a7450393a2c51

                                SHA1

                                790f67879ff62932801da287b81078be3ac59076

                                SHA256

                                e2faaaab8c7254bc281757a19c6c0fed1da171a9f6c8f408cf1687e662a723c6

                                SHA512

                                ad364c1bc08002c587a20e9373f036665782b01d7fe6126024edfb0f67101526456370a4c76e346e974afb5047338b7f6ed87d508f687873daaecc891ded1ac5

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\is-D6RPL.tmp
                                Filesize

                                165B

                                MD5

                                ff2308e976215e0bb4d82a6a28ccdaad

                                SHA1

                                d438b2711f4e90d92f9ef183438a20ea87d78c69

                                SHA256

                                c8ac2d7e987ee422dc2743826882ee52285296681e58a5ae8232acef0866c64a

                                SHA512

                                7f912293df38067fd06b1ba73698b274a7110a0e20dfb7131d08fd5638f1c7bfce1d7984c4b70a28599b0208a055c53ad63eb4d6628dd7640acaca585bd5a95e

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\is-E29SF.tmp
                                Filesize

                                103B

                                MD5

                                d0e5f187217e796e9d33107e12db9bf8

                                SHA1

                                b6ff6f997c8221121f8980f894e27167570694ea

                                SHA256

                                f93c41584626e0c4f4abf54572d25d3e01e96cf99802049b8d9706743e283d61

                                SHA512

                                d379f6ca31dde8bcfe5894ce689ce16ab5f043cdf00111547c64b276cc4b231c6c6ab9ade3b9359020493008fb847a05a7c509205a4f16d0489cc694199965d0

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\is-FGE6J.tmp
                                Filesize

                                100KB

                                MD5

                                7bdff6235a8c7a9e3f9c3915f4d95197

                                SHA1

                                af38ce3946b37c84eda3d8f9f278f84336004384

                                SHA256

                                330995487dcac57ea57a53cb0f447e32099e6f63d190effaf6c28dba23c38b7d

                                SHA512

                                c555a1950a0ef6ef4df852ded8f983dd72d04c927bda770212335d0d7fd9ac668bff05f8e9ed81347e43520a92d764cf55b4c9a5d31ac3851950f1da08ff5318

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\is-J1DG1.tmp
                                Filesize

                                121KB

                                MD5

                                37f0bc9593d1f3aa4a0f45a841784f8c

                                SHA1

                                c8bf7ddc8be8b868ac47d91be0ebd10a8f162099

                                SHA256

                                1ad6f2ad63f3846fb07fb991df21c5e7587b438bfb1e15bc43acfdaa7e6bfc1e

                                SHA512

                                5c170bb6fe263a819256f0760ec702a5ac50c4ac0790ec1edbebe21b14d9c43a07374384b4c1b2cef482446807bdfbfe51f6abfec6d4951c9966e6d3fca4d254

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\is-L6IGM.tmp
                                Filesize

                                172B

                                MD5

                                9db4e733cb93ba9ff2e8f72f042fcda8

                                SHA1

                                2810dcdd7e56bf498ae3c1ec5ce8b23838c33413

                                SHA256

                                55bbd5c1b2a56a2e6ce92d3b59b460c30c56798ccd7804ec2790a5869f2b850b

                                SHA512

                                7b08f399d342b65ea13d5ebb19de1f4fe1dcdaaec4fdfe29e17cb365c7a9b47718fb5ad189df854397f691a492e451dad4ad7460f69150161b4cb7bd73c6e0e4

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\is-PBAUU.tmp
                                Filesize

                                406B

                                MD5

                                7cb71b006fcdcf8ade80e31fd5ab8060

                                SHA1

                                655380fb2cca01b0ca707f748fc7dcf006732518

                                SHA256

                                be8918559280a2e74748bf8f6238b568ed7cbf75183b2180a6a8a979a1ebf243

                                SHA512

                                ce095bb84dbf2e72304471f97e80799185fab42b843f95bd84df4b97764786687807f057dc4434287c8982937329e664f7de476445ff6e2cbf298d7a44b48d55

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\is-S35GP.tmp
                                Filesize

                                126KB

                                MD5

                                1c0ab06b3388e79a2206cbfd28e374a2

                                SHA1

                                fb94c71ee606c6cf5181840b4a6122eefd93770b

                                SHA256

                                f0ee03c9936b459cc9bdf184df9b7efad98d40ab7b99e89166a42e019a0ec0ea

                                SHA512

                                1e90991d22b0c34e7947edbc5864f662ad01b2da7888fbe3a6e814607ea5abb6fc0b34a7ee0accede471d7442755f00fe99c4a8b029244bf034189cd00d74d07

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\pxeBoot\is-FK55S.tmp
                                Filesize

                                256KB

                                MD5

                                3ff0e1c7e264d70358f21db2198cb524

                                SHA1

                                f9a11da016f506881e2b46151d1842b75433f16c

                                SHA256

                                caef57205444357498da40ea4cc9efaffc9e4ae8eeb6c070ebf803bf304ba8d6

                                SHA512

                                fcfe38cffbba8ebffc91af54bf4b04ebf9598fa7e545c5ecd2c082ee26e65dda80803ee6e76a7199faabc1380e62512cf46f8efcf4f48712ab16255894535932

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\translations\is-6OE2N.tmp
                                Filesize

                                68KB

                                MD5

                                712c274cdc4e39651e8b518f66dc7dec

                                SHA1

                                7ff61f4b8da29b686e3d3b3274da0a03b8cc95c8

                                SHA256

                                c847943855a39bb6539c34e4a23ec6a4888c79f687d08020df5b73eec877993a

                                SHA512

                                dcde669cc4681dfdcd48cf1610e842a0abb879fc40d039478a151985f7413b419ee0c6aa3e31e632971b999f552a2fcf887c6eb34ea34a641d0ab6398f2b5f63

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\translations\is-RU4BG.tmp
                                Filesize

                                16B

                                MD5

                                bcebcf42735c6849bdecbb77451021dd

                                SHA1

                                4884fd9af6890647b7af1aefa57f38cca49ad899

                                SHA256

                                9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85

                                SHA512

                                f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\WinPE\x64\is-3CG6V.tmp
                                Filesize

                                2KB

                                MD5

                                39b7adfd0f84457da41fe73b807cc780

                                SHA1

                                4984249e447f6cf697be2b980ca9d8f155c4a407

                                SHA256

                                04f7aaa54815fb794e2cde30e0b63b8da9a984f2ff635fa63c5f693a89f08eb8

                                SHA512

                                cab93d6c21cc1f8d2f0b2feb395cfa0a2276f3c9f5bb6a913b63bab3fdc33680974a7c1520b38993b4ad992cb8e66c417c56c485f9fba4938b12a9c65a2e4531

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\experience.exe
                                Filesize

                                242KB

                                MD5

                                f039d42fdfdea5d3588e1a8d7df96070

                                SHA1

                                2fafe603528685606515bce3be4033c0ced5cde6

                                SHA256

                                f581f317d6fd9fe03fd13fd2a6717ef6293693d1d44aee8c88e64f956e763777

                                SHA512

                                ecc823de49c26e0a0549c055b6eab4010f10e7d5731c5abfb7673ba0dd3d4f6cc99014b4099a46654f9b5aafc2a503cbf235f0696fa844e69d2bd24b7b4e06ce

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\glfw3.dll
                                Filesize

                                220KB

                                MD5

                                2b3dc38265d8e97e1cd2855e538c81d0

                                SHA1

                                0cb11718f0d2cfe7f9648a61a1f730cabf12978d

                                SHA256

                                14054faa371c6070baa6753a48930a9175171b78fa1a3a114ccec6d9dcca520b

                                SHA512

                                c5158d80d8e3492bcfe0a128964f0e464e4632e8754aa1d3a832e5fb69de97f731ec59d68bdd9f599b3614eb58911a3361268e15397feb33ccd80e8ff0dded66

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\help.chm
                                Filesize

                                6.1MB

                                MD5

                                cbaf08243eb6c7ce4183a1e35afb049d

                                SHA1

                                9e3dacf61ffb9dd7ebf9fca694698baed14f5e9a

                                SHA256

                                ad1d641b22b8629c4515cbe1eac136040f290631b23fc72627f03002caaa0301

                                SHA512

                                c7a97e356da16b4a26c33ffea9ff0b0e0f07bea7a4d09a001b5396c4ab8a1b8d144b01ffbcd7d7526adac2ab5086e7c5729aa61fca14593073ffebae86e6cec3

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\initsrv.exe
                                Filesize

                                59KB

                                MD5

                                23c126c9d9ccfafa983a645313a2769f

                                SHA1

                                3e060df3c23e72d3211fa7a76cb2940779755865

                                SHA256

                                bd136fffdfa9f4047b3ce86e493d9bf4c65b97fe42c6d1fe5b79c555f6b0f4ec

                                SHA512

                                6ca4edeb6842639967eecf74273b84e8eb4e91e10f438ce67612586a112bbc95bd5bc71378d53333cbd6fd43c9472aae5752b33761beaeb814e3aeb328b6b537

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\is-8LOEH.tmp
                                Filesize

                                2.3MB

                                MD5

                                a932841a7be9c114828b26b322979bb8

                                SHA1

                                e29afb43c3a5e629cf9202a9750b1bb16d1f2d9f

                                SHA256

                                2a7efe3b2cd9fe6b99d03a98881e702915c0ca5a7be40d0d6239359d50208d08

                                SHA512

                                eef46e2e2f4caa73fe341f2c6e736f921e7866692368f50d8ce24c9d325f81a781e14156f74903a2b71f3cc790b1dd0071912e8f6254d5f29621d5a459e2a04f

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\is-CHV52.tmp
                                Filesize

                                169KB

                                MD5

                                dbdbaa2ba083a61d79840461cd267c89

                                SHA1

                                62de8be6046c8ceea52a8be62fbee2d540782dc5

                                SHA256

                                cea2e299584f3cabd374492b3430d622662e658289fcc25cc0392ef1854cdadd

                                SHA512

                                8cdaab99640e52506f089d6130d2cf9bd8dabe63d39792e27fad7a51c1e045a4a3e611b447404db7b3a4a73827db7ef303d5aa5271c51b167bf11077fb19a172

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\lang.ini
                                Filesize

                                24B

                                MD5

                                5a84ea18562126a5738abfd2ee4f618f

                                SHA1

                                e21662bd256fa3b9edd6eef876d3e68bd12a6903

                                SHA256

                                209c59557c8be210b3c32d283c9df8654dcaa09fb9c5677ba071da1634735643

                                SHA512

                                eefecf1a91123e231a4e0d82e0a5318c497e809d9767961ed439f86a867a81f3e7d7bca2894eed8f4d05cb112c1835c4f2da4170fc3aea96662dc556a0067824

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\msvcp140.dll
                                Filesize

                                552KB

                                MD5

                                cb75d6437418afe1a7b52acf75730ff1

                                SHA1

                                54c2da9552671b161cc87eb50fbdb86319b00f56

                                SHA256

                                7c4ce9d6bfcd6d9db4eef4e75ecdcf5a8e5320106e80f1eca617439fa43f33e8

                                SHA512

                                f58abb740a30467e2d8aedd7eed357da020fdc7d966e245890d102a52e96fea296e122c1d2bc112423fc64b6f5e70b7df3f3eb7de1bf5c2f5f0eb3644f1e06d6

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\msvcp140_1.dll
                                Filesize

                                23KB

                                MD5

                                c1bbf607cd0d540adab62d63a118c0c6

                                SHA1

                                0e9d84f5bbe1ed34c10f3666116b5016e1ae2c4a

                                SHA256

                                5c27f359ba7f801f283e1c49d4cc668b6c1505d424b15dfa42d879f57a1f5fdb

                                SHA512

                                1ece3e9766bd9a978424cd6ba59adf90df41015accffbb3755bebc663e8e5c813546fd4f0b76d1d18d8b5838be0b391eea239ec9cc6be5fdf28a4fcbfeb82327

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\system_backup_gui.exe
                                Filesize

                                3.1MB

                                MD5

                                8b51a2207def8a5649d6b3aa08179336

                                SHA1

                                e3710954949afb9ed8bcb7d9a9a76d12d830963a

                                SHA256

                                766b0adeee8b6c879ae3b7695e98835265eff0ad64ece1ccfc474ba0b703c369

                                SHA512

                                e23352531ef9f6e050f3d99134141a813c4fe84b6f64c333132940d574df9e7f466afe67eb0ae76c319c4432e8fabeeaeda7946483f8e1dfacd31ad77a0368fd

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\testOpenGL.exe
                                Filesize

                                390KB

                                MD5

                                4f5b85c12251ccdd54e00d93e9063124

                                SHA1

                                520a30f5133afcbd1232d7598427a1436093dd32

                                SHA256

                                56aa9d4eb0d87fd0ee254b17765f7474b45165c3503f5c3ab3fead2171d9da48

                                SHA512

                                3f14bf0878731b6094d59524f5e1390e94eac1d3b7b00666ff0e1dd65cc05489780f011f34b28c9a5284e79ce51e2328e92bec363f8ef4fdd592d0df5797f66a

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\vcruntime140.dll
                                Filesize

                                94KB

                                MD5

                                a87575e7cf8967e481241f13940ee4f7

                                SHA1

                                879098b8a353a39e16c79e6479195d43ce98629e

                                SHA256

                                ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

                                SHA512

                                e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\vcruntime140_1.dll
                                Filesize

                                36KB

                                MD5

                                37c372da4b1adb96dc995ecb7e68e465

                                SHA1

                                6c1b6cb92ff76c40c77f86ea9a917a5f854397e2

                                SHA256

                                1554b5802968fdb2705a67cbb61585e9560b9e429d043a5aa742ef3c9bbfb6bf

                                SHA512

                                926f081b1678c15dc649d7e53bfbe98e4983c9ad6ccdf11c9383ca1d85f2a7353d5c52bebf867d6e155ff897f4702fc4da36a8f4cf76b00cb842152935e319a6

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\x64\is-LEI5D.tmp
                                Filesize

                                400KB

                                MD5

                                1ed06edc10b4333f66ba61ea97075831

                                SHA1

                                c0eb3e5204b4ca27fee60ae707151fc1b85baf8f

                                SHA256

                                89ea54b4f5b6ccb9b0d5083ef8acc6855d1915d41c0d6902834f6970ee2c2736

                                SHA512

                                7270be77363755e1846c155f6c5c555ad84741e13d917d7090b4dad0cae51ce669bc1a4e5f0b061da7b2b2296f4ca4f2cf0f63159731ec6fc1935dbfae9bb90b

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\x64\is-ROA71.tmp
                                Filesize

                                21KB

                                MD5

                                17291a612431d3e8b731a932dd88e8db

                                SHA1

                                98994cc4da47e298d6d1e2baf2bd702c09242ae2

                                SHA256

                                4ab325db9871344c23f523c5fe10d351df4cef61e450180c34b95141f038a4a0

                                SHA512

                                a4b5ed6c53008c3f8a8ec8589588b54214fcc33c6bc825d7dada99899f0d1208510e94bc58dc6a8519d918628559b5a80361d9859868e93998bbfbc5a2e8cfb6

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\x86\is-0G6HN.tmp
                                Filesize

                                18KB

                                MD5

                                05fb36a51e04a6c6b3a5f125fa692e6b

                                SHA1

                                1d5c8a6766e54a81b75f1df4a397100c9b42b149

                                SHA256

                                2ec85cea38c19cb8ff369565074a6a261804aae016337ab193943162ae270d2d

                                SHA512

                                4ba03b2addb6c870baf4671239461d329e126d829006aa27483dbf91291687c69afb86cad148965b8fa199081fdf65afad14108b4192840c1825d1c604c722a5

                                Download Submit
                              • C:\Program Files\MiniTool ShadowMaker\x86\is-Q60HI.tmp
                                Filesize

                                325KB

                                MD5

                                7bc0c0c439b4ffc39e27180dbad146bc

                                SHA1

                                b6f63718453a325b5563fe83937d0d42b4adefd6

                                SHA256

                                9b64c14ecc89594cb89c6a76da6fbcc94ee9a52506969b238403bfbf17f49712

                                SHA512

                                92adb6e8477716c1e792f87a0a3c67db43d62f8a725ac10cd55b0aa989acc07ae0ee5b6ca04a60e4c356c6537055d345b6eb79edc5ea50afe1f4e957a9de68ca

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                Filesize

                                152B

                                MD5

                                4158365912175436289496136e7912c2

                                SHA1

                                813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

                                SHA256

                                354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

                                SHA512

                                74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                Filesize

                                152B

                                MD5

                                ce4c898f8fc7601e2fbc252fdadb5115

                                SHA1

                                01bf06badc5da353e539c7c07527d30dccc55a91

                                SHA256

                                bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

                                SHA512

                                80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                Filesize

                                432B

                                MD5

                                f8a61e5c7fb7bc7a30898422dfd63824

                                SHA1

                                db5cb300635b0ae8e330f85eed32d45a764a0060

                                SHA256

                                2ca3db69f2d03aab3c37ff1796c2f402c0dbf21457f12e83389a7a5447a2c355

                                SHA512

                                ae3ae9df61e823c7d959af315394c2daedb1d32cd0bc68bc747b535c879aa05071cec52437423099f294ee949dde8cfd398ab3044bd4cc1df4839129dbe36c5a

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                Filesize

                                1KB

                                MD5

                                5c6829b40069791e48626dc11d07b75d

                                SHA1

                                861e291fca0043ade5bb46860276a42746c9c235

                                SHA256

                                1c0a607f5554ca9a03514328d5925cae0067612697a1d41c62a45fa5701bafde

                                SHA512

                                1a135acc06d8146c4d2595d77760e82ffe308fcf7cea7454548c96fc5ebb4e4f9f839fba443f23cf8f81b1f65c3d3134c3c9e03bf0a4a6626504391424a24dfc

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                Filesize

                                7KB

                                MD5

                                6cae3e42779da9588cccff11860f501f

                                SHA1

                                950ce46abc9da441a5fcf9a692f7ebbd0306ddb3

                                SHA256

                                3fc12dcc91ebe9ab27bd0f6a263cb760b8327d0cfde334d9b229f03d6cdcc09f

                                SHA512

                                7db2403f2570b0482e16cfb280809464b1ae32deade3ef42f7870752bb822998984d3a727322a54890b6e0f180db0e101f220b9c480cac8b9d7c137580a4eb34

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                Filesize

                                5KB

                                MD5

                                16dbb036eb9068af83471ba049902da6

                                SHA1

                                0d47cb03267f1b442296190fe005d62301310822

                                SHA256

                                a5e9d13424dd32e5735651ec633dad3c7cf13455ea99ddb3e0393cd238abb64d

                                SHA512

                                dc258d67aea4a6338a3d4030558e1d27e64ff2c3a1031c81c54e09d863cf1469811330302d186441cdf42c40a86821727098af2fcc9281b92c12d4fb14ddbc47

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                Filesize

                                16B

                                MD5

                                46295cac801e5d4857d09837238a6394

                                SHA1

                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                SHA256

                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                SHA512

                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                Filesize

                                16B

                                MD5

                                206702161f94c5cd39fadd03f4014d98

                                SHA1

                                bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                SHA256

                                1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                SHA512

                                0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b4640831-5665-4c45-a1a6-582bd510dfde.tmp
                                Filesize

                                11KB

                                MD5

                                62c456dbd416fbf8ffa7ffaa66c7d9c8

                                SHA1

                                5bf47e6fdef8deab5345002a6a779e38e5f6ed8e

                                SHA256

                                4d2f9353f8c8fbfd2ecc03d88a297bfc5b94bfbf5918fe4007b7f9c0379d3afe

                                SHA512

                                90a1a707d57b0d184abdd0e50b3655363cfe98d19097a1cc044ff783cc052e7a128d034ec805493fb9ae0fb1e4993fa7e5685bb9f82f81b07dfb6087392a7e90

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\is-6EM3S.tmp\pwfree-64bit-online.tmp
                                Filesize

                                1.5MB

                                MD5

                                0ffb244cd63f44b50ba573ae841a2d01

                                SHA1

                                e1b88b0a95ea7e0eb3da8d94b1297d4b88a96196

                                SHA256

                                6948125034370d9ef171880bb6ab29fba176b200902c453530505f7b5013db5c

                                SHA512

                                98978a59b27c535fb731718bd21dc6f14143dca7d5dc633530f5c64d708fa47f4839268304061bd9aa84121b62138d2c13b80a0a594beee6c7ed64a8bc09b1bd

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\is-ISGU0.tmp\MSVCP120.dll
                                Filesize

                                444KB

                                MD5

                                a883c95684eff25e71c3b644912c73a5

                                SHA1

                                3f541023690680d002a22f64153ea4e000e5561b

                                SHA256

                                d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb

                                SHA512

                                5a47c138d50690828303b1a01b28e6ef67cfe48215d16ed8a70f2bc8dbb4a73a42c37d02ccae416dc5bd12b7ed14ff692369bc294259b46dbf02dc1073f0cb52

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\is-ISGU0.tmp\SmDownloader.exe
                                Filesize

                                66KB

                                MD5

                                0bb1be1cee6bc878acbb41b1af7cfc88

                                SHA1

                                e8769d43088d5800bc169455077329bb8cf973b7

                                SHA256

                                166960f92a85a33207dad124fea1938740a82809c05dd449fd19f39c2c029038

                                SHA512

                                91a7c4f634ff2becf934fa04fcaf8e0f27173394428dd08b90050cc0685f1fc403234c09cf3b20308a91e952f2023875ff2fd9d6386c783eb966ec5a71931056

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\is-ISGU0.tmp\libcurl.dll
                                Filesize

                                317KB

                                MD5

                                56f4c7d613927081e8311bc46ee0ec92

                                SHA1

                                b6aed1f136b7ebc94f5246d7d1518a5747998ed4

                                SHA256

                                f959786d18020a9ded99dc668e1f576cac8dd364e22d773d40e4fc693264555c

                                SHA512

                                5b4f1aa6db8bde8eb4b76ac036520fba09fe31958b0b74d3c17e0064cecc0f3995dc8b1a479b690c28831173328a0821f62cdc72ab26d3be575c6afc98544243

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\is-ISGU0.tmp\line.bmp
                                Filesize

                                6KB

                                MD5

                                9dc5bf6e4b2cad053d12ad24260d9327

                                SHA1

                                84b7d911b8d8002ff95edb523d108038b6ea3bf0

                                SHA256

                                efb22f0b990c4ed4a8d36868c7d9d3793b61f0728343306caeae0ae5f0751447

                                SHA512

                                25c3b183d96ee5ef9f5fe35ce898e718baf894dcb0a82049dde59b0779a7ede88907f1d1f44ff155cb1ea178c296aaf36975341679f7289920e615d4c01844f9

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\is-ISGU0.tmp\msvcr120.dll
                                Filesize

                                948KB

                                MD5

                                2fb20c782c237f8b23df112326048479

                                SHA1

                                b2d5a8b5c0fd735038267914b5080aab57b78243

                                SHA256

                                e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa

                                SHA512

                                4c1a67da2a56bc910436f9e339203d939f0bf854b589e26d3f4086277f2bec3dfce8b1f60193418c2544ef0c55713c90f6997df2bfb43f1429f3d00ba46b39b0

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\is-ISGU0.tmp\support.bmp
                                Filesize

                                822B

                                MD5

                                12ca16a9c8707b7f0a257e6cabbbea3a

                                SHA1

                                a0b81eb518de7eb4ee4f3ded01fdf781151ff874

                                SHA256

                                624677996b347cd36593d4a1107b265c903268086f2f548b50c0f329fd649a33

                                SHA512

                                70c595f65be3bd9d9d2f44b5240b3bf8f9e7b923c59fdf8f07dd3f89bd8731a9cb9abab2fe899b5aac1e402ec33c782974c9554584c088de9e051f99b21c9c78

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\is-ISGU0.tmp\unsupport.bmp
                                Filesize

                                822B

                                MD5

                                4ac29de505cfb25bbb88d190ad379d82

                                SHA1

                                582b2a54ce52a950614ee7dc444e5d1b4c532e54

                                SHA256

                                93a93ec1f9af7118b2fb05a1abc420781130e5663b92536a23ec6a4b172a0843

                                SHA512

                                fbfd193b678c5c2fc8a1a1d17dddf832d6aee35ab3f01ddb9f44eb48ce8125cd4efde9f7816161133ec13d477a3aaae842d8ea8ffbd97653eb5bfc96fbe204b6

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\is-M8R30.tmp\pw-free-online.tmp
                                Filesize

                                3.3MB

                                MD5

                                38088568f4393edc27739e4e3b3b157a

                                SHA1

                                5c37c271965fd43472c7c1fd48c3b490388923d8

                                SHA256

                                398b1fe38a434790f6d5e82d72bbaef3b3dfba13740bde388fb7749312c1b917

                                SHA512

                                032b02eea7fe8d0c2607f26d2ebab00d5a4fa075af34b7e7a145a815982fc6a457d84b5329033341b87f5b28fb95347ba2f22618fefc48331cc1f313c1dc4edb

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\is-TAURK.tmp\pw_sm_setup_x64.tmp
                                Filesize

                                1.3MB

                                MD5

                                5c4a0a1e17be1814f183575cfe43550c

                                SHA1

                                67fb9168558bf5f5ce288fc744f13f66a14fdff4

                                SHA256

                                4a7bdc30b49496db767a5ac413664ce33765a060dca0af59536d884a5473a3df

                                SHA512

                                d294cf9404555aa960c93988187d98157217b7422b62643d9297fd1b9af883d89a89cc030706f89c597afba4f8edf4b2350807c3852856cc3c8ab4aac45582ea

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe
                                Filesize

                                19.7MB

                                MD5

                                7e96c8c3e1b65128192b4f51b196304e

                                SHA1

                                837d473933c8001ed80355828e57c006e5cc3064

                                SHA256

                                42df723a33b6475544a5c522d88d48a992163d9e83bff27791fcc4da09ef8be5

                                SHA512

                                af4a06046d722b4a243fa19f089590b571d2e9af2946659c72be8ca4063df71030b28b8d139feefa38d1b03c95e83395c8806f4a19c36e1fcf1480208f8e27e7

                                Download Submit
                              • C:\Users\Admin\AppData\Local\system_backup_gui\QtWebEngine\Default\Session Storage\MANIFEST-000001
                                Filesize

                                41B

                                MD5

                                5af87dfd673ba2115e2fcf5cfdb727ab

                                SHA1

                                d5b5bbf396dc291274584ef71f444f420b6056f1

                                SHA256

                                f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                SHA512

                                de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                Download Submit
                              • memory/372-420-0x0000000063F30000-0x000000006447A000-memory.dmp
                                Filesize

                                5.3MB

                                Download
                              • memory/428-3778-0x00007FF83E650000-0x00007FF83EB96000-memory.dmp
                                Filesize

                                5.3MB

                                Download
                              • memory/872-3815-0x0000000000400000-0x0000000000760000-memory.dmp
                                Filesize

                                3.4MB

                                Download
                              • memory/872-119-0x0000000000400000-0x0000000000760000-memory.dmp
                                Filesize

                                3.4MB

                                Download
                              • memory/872-42-0x0000000000400000-0x0000000000760000-memory.dmp
                                Filesize

                                3.4MB

                                Download
                              • memory/872-6-0x0000000000400000-0x0000000000760000-memory.dmp
                                Filesize

                                3.4MB

                                Download
                              • memory/872-682-0x0000000000400000-0x0000000000760000-memory.dmp
                                Filesize

                                3.4MB

                                Download
                              • memory/872-438-0x0000000000400000-0x0000000000760000-memory.dmp
                                Filesize

                                3.4MB

                                Download
                              • memory/1008-3779-0x00007FF83E650000-0x00007FF83EB96000-memory.dmp
                                Filesize

                                5.3MB

                                Download
                              • memory/1384-0-0x0000000000400000-0x0000000000526000-memory.dmp
                                Filesize

                                1.1MB

                                Download
                              • memory/1384-2-0x0000000000401000-0x00000000004B7000-memory.dmp
                                Filesize

                                728KB

                                Download
                              • memory/1384-41-0x0000000000400000-0x0000000000526000-memory.dmp
                                Filesize

                                1.1MB

                                Download
                              • memory/1384-3822-0x0000000000400000-0x0000000000526000-memory.dmp
                                Filesize

                                1.1MB

                                Download
                              • memory/1732-3777-0x00007FF83E650000-0x00007FF83EB96000-memory.dmp
                                Filesize

                                5.3MB

                                Download
                              • memory/2804-3776-0x00007FF83E650000-0x00007FF83EB96000-memory.dmp
                                Filesize

                                5.3MB

                                Download
                              • memory/2956-3804-0x0000000063F30000-0x000000006447A000-memory.dmp
                                Filesize

                                5.3MB

                                Download
                              • memory/2956-3802-0x00007FF83CCB0000-0x00007FF83D1CB000-memory.dmp
                                Filesize

                                5.1MB

                                Download
                              • memory/2956-3803-0x00007FF83C650000-0x00007FF83CCA4000-memory.dmp
                                Filesize

                                6.3MB

                                Download
                              • memory/3100-2840-0x0000000000400000-0x0000000000552000-memory.dmp
                                Filesize

                                1.3MB

                                Download
                              • memory/3100-3791-0x0000000000400000-0x0000000000552000-memory.dmp
                                Filesize

                                1.3MB

                                Download
                              • memory/3132-430-0x0000000000400000-0x000000000044C000-memory.dmp
                                Filesize

                                304KB

                                Download
                              • memory/3132-2839-0x0000000000400000-0x000000000044C000-memory.dmp
                                Filesize

                                304KB

                                Download
                              • memory/3132-3792-0x0000000000400000-0x000000000044C000-memory.dmp
                                Filesize

                                304KB

                                Download
                              • memory/3368-424-0x0000000000400000-0x0000000000587000-memory.dmp
                                Filesize

                                1.5MB

                                Download
                              • memory/4408-425-0x0000000000400000-0x0000000000481000-memory.dmp
                                Filesize

                                516KB

                                Download
                              • memory/4408-73-0x0000000000400000-0x0000000000481000-memory.dmp
                                Filesize

                                516KB

                                Download
                              • memory/4768-4020-0x00007FF841240000-0x00007FF84175B000-memory.dmp
                                Filesize

                                5.1MB

                                Download
                              • memory/4768-4016-0x00007FF841240000-0x00007FF84175B000-memory.dmp
                                Filesize

                                5.1MB

                                Download
                              • memory/4768-4015-0x00007FF83D140000-0x00007FF83D794000-memory.dmp
                                Filesize

                                6.3MB

                                Download
                              • memory/4768-4019-0x00007FF83D140000-0x00007FF83D794000-memory.dmp
                                Filesize

                                6.3MB

                                Download
                              • memory/4768-4018-0x00000000638C0000-0x0000000063E0A000-memory.dmp
                                Filesize

                                5.3MB

                                Download
                              • memory/4768-4017-0x00000000638C0000-0x0000000063E0A000-memory.dmp
                                Filesize

                                5.3MB

                                Download
                              • memory/4840-3801-0x0000000063F30000-0x000000006447A000-memory.dmp
                                Filesize

                                5.3MB

                                Download
                              • memory/5796-4060-0x000002074F100000-0x000002074F101000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4065-0x000002074F100000-0x000002074F101000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4027-0x00007FF841350000-0x00007FF84175C000-memory.dmp
                                Filesize

                                4.0MB

                                Download
                              • memory/5796-4026-0x00007FF688A00000-0x00007FF688D15000-memory.dmp
                                Filesize

                                3.1MB

                                Download
                              • memory/5796-4029-0x000002074E170000-0x000002074E5B0000-memory.dmp
                                Filesize

                                4.2MB

                                Download
                              • memory/5796-4031-0x000002074E5B0000-0x000002074E7B0000-memory.dmp
                                Filesize

                                2.0MB

                                Download
                              • memory/5796-4024-0x00007FF83E650000-0x00007FF83EB96000-memory.dmp
                                Filesize

                                5.3MB

                                Download
                              • memory/5796-4061-0x000002074F100000-0x000002074F101000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4062-0x000002074F100000-0x000002074F101000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4064-0x000002074F110000-0x000002074F111000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4066-0x000002074F110000-0x000002074F111000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4028-0x00007FF688A00000-0x00007FF688D15000-memory.dmp
                                Filesize

                                3.1MB

                                Download
                              • memory/5796-4119-0x000002074F110000-0x000002074F111000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4124-0x000002074F110000-0x000002074F111000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4123-0x000002074F110000-0x000002074F111000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4122-0x000002074F110000-0x000002074F111000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4121-0x000002074F110000-0x000002074F111000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4120-0x000002074F110000-0x000002074F111000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4118-0x000002074F100000-0x000002074F101000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4126-0x0000020750730000-0x0000020750731000-memory.dmp
                                Filesize

                                4KB

                                Download
                              • memory/5796-4025-0x00007FF841350000-0x00007FF84175C000-memory.dmp
                                Filesize

                                4.0MB

                                Download