201e3eafb5c1cbd9a4a2185651c2ea06316452620ec7a94f383e75df84c151b1

Analysis

max time kernel
137s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pw-free-online.exe
Size 3.1MB
Sample260705-pex98sf12j
SHA256 201e3eafb5c1cbd9a4a2185651c2ea06316452620ec7a94f383e75df84c151b1
MD5 e2846bcee2fd4ba400872cdaa71cc3bb
SHA1 0e504990030aad4757d1e2d22e3661152bf6b350
SHA512 886d388a29b3b39132bef8bd5f2f8288a721c29f2be63ef7fc4cd55d82a08637a46347038680216a10c7f03ecb7713b283cf99ed544e9154922be98e2d587808
SSDEEP 98304:NkL2991YnHbfnLTccGEE7kc7EFvEDnIwO66LBtuWpvSgn:+2991OHDtQIc7EhwZ6LLuoKgn
TLSH
T16CE5D03BB268613EC8AE07F25573422059FFBA2964178C5A73F4458ECF2B4601E3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery installer persistence spyware trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MTPW = "\"C:\\Program Files\\MiniTool Partition Wizard 13\\updatechecker.exe\""	pwfree-64bit-online.tmp

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\MiniTool ShadowMaker\DISM5_x64\is-R5EIL.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick.2\is-C4F18.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\translations\qtwebengine_locales\is-FGHOK.tmp	pw_sm_setup_x64.tmp
File opened for modification	C:\Program Files\MiniTool ShadowMaker\Qt5QuickControls2.dll	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls\Private\is-V38HA.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls.2\Imagine\is-9CGNP.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Extras\Private\is-HH8TF.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick3D\Materials\maps\is-0T3QN.tmp	pw_sm_setup_x64.tmp
File opened for modification	C:\Program Files\MiniTool ShadowMaker\Qt5Qml.dll	pw_sm_setup_x64.tmp
File opened for modification	C:\Program Files\MiniTool ShadowMaker\DISM5_x86\api-ms-win-downlevel-version-l1-1-0.dll	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\PETools\amd64\efi\boot\is-VIAL5.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls\Styles\Base\is-RC6IT.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls.2\is-4N0DB.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\translations\is-6C2DR.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\cfg\is-LHKT7.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\DISM5_x64\is-CPBTG.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls\is-S33Q0.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\DISM5_x64\is-INSCL.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls\Styles\Base\is-HR5I3.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls\Styles\Base\is-BJG8R.tmp	pw_sm_setup_x64.tmp
File opened for modification	C:\Program Files\MiniTool ShadowMaker\QtQuick3D\Helpers\qtquick3dhelpersplugin.dll	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\is-7ELA9.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\is-FQMQM.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\DISM5_x64\is-6VAON.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls.2\is-MFIC0.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls.2\Universal\is-5AC6M.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick3D\Materials\is-L2GOV.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\translations\qtwebengine_locales\is-G9UNA.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\is-N497G.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtMultimedia\is-8QIEG.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls\Styles\Desktop\is-J5DLQ.tmp	pw_sm_setup_x64.tmp
File opened for modification	C:\Program Files\MiniTool ShadowMaker\imageformats\qicns.dll	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls\Styles\Base\is-OT2O9.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls.2\Fusion\is-TDLM5.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtWebEngine\Controls2Delegates\is-73B85.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\is-50MVM.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\DISM5_x86\is-GPO85.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls.2\is-CEEK0.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick3D\Materials\is-7LQ2S.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\is-P8K03.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Window.2\is-S22F7.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\translations\qtwebengine_locales\is-2REDI.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\is-EH6VH.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls.2\is-HR067.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\DISM5_x86\is-2R3HS.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtMultimedia\is-EEH3G.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls\Styles\Base\images\is-4ILL1.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\virtualkeyboard\is-U00J4.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\WinPE\imageformats\is-F3LFA.tmp	pw_sm_setup_x64.tmp
File opened for modification	C:\Program Files\MiniTool ShadowMaker\concrt140.dll	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls\Styles\Base\is-6J4K1.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls\Styles\Desktop\is-H953F.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Controls.2\Fusion\is-5M98M.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\WinPE\is-FB7S1.tmp	pw_sm_setup_x64.tmp
File opened for modification	C:\Program Files\MiniTool ShadowMaker\initsrv.exe	pw_sm_setup_x64.tmp
File opened for modification	C:\Program Files\MiniTool ShadowMaker\CornerTips.exe	pw_sm_setup_x64.tmp
File opened for modification	C:\Program Files\MiniTool ShadowMaker\vcruntime140.dll	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\is-1L527.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\DISM5_x86\is-C0FLU.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Dialogs\is-3GS2T.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtQuick\Dialogs\images\is-5AI5T.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\QtWebEngine\Controls1Delegates\is-LBGQA.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\is-4BI5C.tmp	pw_sm_setup_x64.tmp
File created	C:\Program Files\MiniTool ShadowMaker\is-GVB0M.tmp	pw_sm_setup_x64.tmp

Executes dropped EXE 16 IoCs

pid	Process
5684	pw-free-online.tmp
5256	SmDownloader.exe
4840	SmDownloader.exe
1284	pwfree-64bit-online.exe
4828	pwfree-64bit-online.tmp
5044	updatechecker.exe
1780	updatechecker.exe
2764	pw_sm_setup_x64.exe
5852	pw_sm_setup_x64.tmp
1704	testOpenGL.exe
5264	initsrv.exe
480	BootTrigger.exe
3460	experience.exe
2252	AgentService.exe
5640	experience_01.exe
1348	AgentService.exe

Loads dropped DLL 64 IoCs

pid	Process
5256	SmDownloader.exe
5256	SmDownloader.exe
5256	SmDownloader.exe
5256	SmDownloader.exe
4840	SmDownloader.exe
4840	SmDownloader.exe
4840	SmDownloader.exe
5044	updatechecker.exe
5044	updatechecker.exe
5044	updatechecker.exe
5044	updatechecker.exe
5044	updatechecker.exe
5044	updatechecker.exe
5044	updatechecker.exe
5044	updatechecker.exe
5044	updatechecker.exe
5044	updatechecker.exe
5044	updatechecker.exe
1780	updatechecker.exe
1780	updatechecker.exe
1780	updatechecker.exe
1780	updatechecker.exe
1780	updatechecker.exe
1780	updatechecker.exe
1704	testOpenGL.exe
1704	testOpenGL.exe
1704	testOpenGL.exe
1704	testOpenGL.exe
1704	testOpenGL.exe
1704	testOpenGL.exe
1704	testOpenGL.exe
5264	initsrv.exe
5264	initsrv.exe
5264	initsrv.exe
5264	initsrv.exe
5264	initsrv.exe
5264	initsrv.exe
3460	experience.exe
480	BootTrigger.exe
480	BootTrigger.exe
480	BootTrigger.exe
480	BootTrigger.exe
480	BootTrigger.exe
5640	experience_01.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe
2252	AgentService.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	experience_01.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pw_sm_setup_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pw_sm_setup_x64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	experience.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pw-free-online.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pw-free-online.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SmDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SmDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pwfree-64bit-online.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	experience_01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pwfree-64bit-online.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2508	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 9 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/6056-0-0x0000000000400000-0x0000000000526000-memory.dmp	innosetup
behavioral2/memory/6056-41-0x0000000000400000-0x0000000000526000-memory.dmp	innosetup
behavioral2/files/0x000d00000001c594-87.dat	innosetup
behavioral2/memory/1284-88-0x0000000000400000-0x0000000000526000-memory.dmp	innosetup
behavioral2/memory/1284-461-0x0000000000400000-0x0000000000526000-memory.dmp	innosetup
behavioral2/memory/2764-492-0x0000000000F00000-0x0000000000FFB000-memory.dmp	innosetup
behavioral2/memory/2764-1086-0x0000000000F00000-0x0000000000FFB000-memory.dmp	innosetup
behavioral2/memory/2764-3367-0x0000000000F00000-0x0000000000FFB000-memory.dmp	innosetup
behavioral2/memory/6056-3417-0x0000000000400000-0x0000000000526000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4644	taskkill.exe
2404	taskkill.exe
2940	taskkill.exe
2476	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	pw_sm_setup_x64.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\experience.exe = "11000"	pw_sm_setup_x64.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\system_backup_gui.exe = "11000"	pw_sm_setup_x64.tmp

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5044	updatechecker.exe
1780	updatechecker.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4828	pwfree-64bit-online.tmp
4828	pwfree-64bit-online.tmp
5852	pw_sm_setup_x64.tmp
5852	pw_sm_setup_x64.tmp

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	2940	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	4644	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4828	pwfree-64bit-online.tmp
5852	pw_sm_setup_x64.tmp

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5044	updatechecker.exe
1780	updatechecker.exe
1704	testOpenGL.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 6056 wrote to memory of 5684	6056	pw-free-online.exe	88
PID 5684 wrote to memory of 2404	5684	pw-free-online.tmp	89
PID 5684 wrote to memory of 2940	5684	pw-free-online.tmp	92
PID 5684 wrote to memory of 5256	5684	pw-free-online.tmp	95
PID 5684 wrote to memory of 4840	5684	pw-free-online.tmp	96
PID 5256 wrote to memory of 1284	5256	SmDownloader.exe	97
PID 1284 wrote to memory of 4828	1284	pwfree-64bit-online.exe	98
PID 4828 wrote to memory of 5044	4828	pwfree-64bit-online.tmp	99
PID 4840 wrote to memory of 2764	4840	SmDownloader.exe	103
PID 2764 wrote to memory of 5852	2764	pw_sm_setup_x64.exe	104
PID 5852 wrote to memory of 2476	5852	pw_sm_setup_x64.tmp	105
PID 5852 wrote to memory of 4644	5852	pw_sm_setup_x64.tmp	108
PID 5852 wrote to memory of 1704	5852	pw_sm_setup_x64.tmp	110
PID 5852 wrote to memory of 5264	5852	pw_sm_setup_x64.tmp	113
PID 5852 wrote to memory of 480	5852	pw_sm_setup_x64.tmp	115
PID 5852 wrote to memory of 3460	5852	pw_sm_setup_x64.tmp	117
PID 5852 wrote to memory of 2252	5852	pw_sm_setup_x64.tmp	118
PID 3460 wrote to memory of 5640	3460	experience.exe	120
PID 5640 wrote to memory of 5804	5640	experience_01.exe	121
PID 5804 wrote to memory of 6084	5804	msedgewebview2.exe	122
PID 5852 wrote to memory of 1348	5852	pw_sm_setup_x64.tmp	124
PID 5804 wrote to memory of 5156	5804	msedgewebview2.exe	126
PID 5804 wrote to memory of 5156	5804	msedgewebview2.exe	126
PID 5804 wrote to memory of 5156	5804	msedgewebview2.exe	126
PID 5804 wrote to memory of 5156	5804	msedgewebview2.exe	126
PID 5804 wrote to memory of 5248	5804	msedgewebview2.exe	127
PID 5804 wrote to memory of 1148	5804	msedgewebview2.exe	128
PID 5804 wrote to memory of 1148	5804	msedgewebview2.exe	128
PID 5804 wrote to memory of 1148	5804	msedgewebview2.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\pw-free-online.exe
"C:\Users\Admin\AppData\Local\Temp\pw-free-online.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Users\Admin\AppData\Local\Temp\is-MHPTL.tmp\pw-free-online.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MHPTL.tmp\pw-free-online.tmp" /SL5="$60204,2294223,1148928,C:\Users\Admin\AppData\Local\Temp\pw-free-online.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill.exe" /f /im "updatechecker.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill.exe" /f /im "experience.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\is-R9RQC.tmp\SmDownloader.exe
    "C:\Users\Admin\AppData\Local\Temp\is-R9RQC.tmp\SmDownloader.exe" /HWND:917878 /PATH:"C:\Program Files\MiniTool Partition Wizard 13" /URL:https://www.partitionwizard.com/download/online-setup-config/pwfree-v12.ini /VERYSILENT /USERMSG:1450 /LANG:english
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe
      C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 13" /LANG=english
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\is-NIOJO.tmp\pwfree-64bit-online.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-NIOJO.tmp\pwfree-64bit-online.tmp" /SL5="$50250,43196093,1148928,C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe" /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 13" /LANG=english
        5⤵
        Adds Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4828
      - C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe
        
        "C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe" /createtask
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:5044
- - C:\Users\Admin\AppData\Local\Temp\is-R9RQC.tmp\SmDownloader.exe
    "C:\Users\Admin\AppData\Local\Temp\is-R9RQC.tmp\SmDownloader.exe" /HWND:917878 /PATH:"C:\Program Files\MiniTool Partition Wizard 13\..\MiniTool ShadowMaker" /URL:https://www.partitionwizard.com/download/online-setup-config/pwfree-v12-bundle-sm.ini /VERYSILENT /USERMSG:1439 /LANG:english
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\pw_sm_setup_x64.exe
      C:\Users\Admin\AppData\Local\Temp\pw_sm_setup_x64.exe /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 13\..\MiniTool ShadowMaker" /LANG=english
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\is-BL0TS.tmp\pw_sm_setup_x64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BL0TS.tmp\pw_sm_setup_x64.tmp" /SL5="$401CC,151418292,964096,C:\Users\Admin\AppData\Local\Temp\pw_sm_setup_x64.exe" /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 13\..\MiniTool ShadowMaker" /LANG=english
        5⤵
        Drops file in Program Files directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5852
      - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill.exe" /f /im "SchedulerService.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
      - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill.exe" /f /im "AgentService.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4644
      - C:\Program Files\MiniTool ShadowMaker\testOpenGL.exe
        
        "C:\Program Files\MiniTool ShadowMaker\testOpenGL.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1704
      - C:\Program Files\MiniTool ShadowMaker\initsrv.exe
        
        "C:\Program Files\MiniTool ShadowMaker\initsrv.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5264
      - C:\Program Files\MiniTool ShadowMaker\BootTrigger.exe
        
        "C:\Program Files\MiniTool ShadowMaker\BootTrigger.exe" "C:\Program Files\MiniTool ShadowMaker\SMMonitor.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:480
      - C:\Program Files\MiniTool ShadowMaker\experience.exe
        
        "C:\Program Files\MiniTool ShadowMaker\experience.exe" http://tracking.minitool.com/backup/installation.html?mt_lang=en&mt_edition=pw-trial&mt_ver=4.8.1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe
        
        C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe https://tracking.minitool.com/backup/installation.html?mt_lang=en&mt_edition=pw-trial&mt_ver=4.8.1
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5640
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=experience_01.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5640.5932.2090853681748885118 /pfhostedapp:2010d47a88120bbc9a76e169e9c86aa71aeab1a3
        8⤵
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:5804
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:2010d47a88120bbc9a76e169e9c86aa71aeab1a3 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x110,0x194,0x7ffb08195fd8,0x7ffb08195fe4,0x7ffb08195ff0
        9⤵
        
        PID:6084
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView" --webview-exe-name=experience_01.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1884 --field-trial-handle=1872,i,18436689445576760284,6190615733330945628,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:2010d47a88120bbc9a76e169e9c86aa71aeab1a3
        9⤵
        
        PID:5156
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView" --webview-exe-name=experience_01.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2148 --field-trial-handle=1872,i,18436689445576760284,6190615733330945628,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:2010d47a88120bbc9a76e169e9c86aa71aeab1a3
        9⤵
        
        PID:5248
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView" --webview-exe-name=experience_01.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=1872,i,18436689445576760284,6190615733330945628,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2010d47a88120bbc9a76e169e9c86aa71aeab1a3
        9⤵
        
        PID:1148
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView" --webview-exe-name=experience_01.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3448 --field-trial-handle=1872,i,18436689445576760284,6190615733330945628,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:2010d47a88120bbc9a76e169e9c86aa71aeab1a3 /prefetch:1
        9⤵
        
        PID:4780
      - C:\Program Files\MiniTool ShadowMaker\AgentService.exe
        
        "C:\Program Files\MiniTool ShadowMaker\AgentService.exe" -i
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2252
      - C:\Program Files\MiniTool ShadowMaker\AgentService.exe
        
        "C:\Program Files\MiniTool ShadowMaker\AgentService.exe" -s
        6⤵
        Executes dropped EXE
        
        PID:1348
      - C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
        
        "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe" -i
        6⤵
        
        PID:200
      - C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
        
        "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe" -s
        6⤵
        
        PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.partitionwizard.com/feedback/install-partition-wizard.html?from-free-v13.6
    3⤵
    PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x374,0x7ffb048dc188,0x7ffb048dc194,0x7ffb048dc1a0
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,10868930852832390296,13393099105158976244,262144 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,16691357332528194118,5528704007162277476,524288 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
      4⤵
      System Time Discovery
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,10264143820472740972,14858058101074908969,524288 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:13
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,716067898993552987,12666979253941155656,2097152 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,17035536214559882696,396766787166177639,2097152 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,16577422306413042513,17459362447651620049,2097152 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,1538541197643395423,14053326449488098187,2097152 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4708366437874392111,13885608620574511399,524288 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,1835568676041596912,4668784402116432206,524288 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,8873833297398888012,16914595568250595911,524288 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,10405512562197753657,9963460076563352455,524288 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,10405512562197753657,9963460076563352455,524288 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:3632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,4281902670876329796,5251393814580831786,524288 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,2462388240989678611,15858705041692423805,524288 --field-trial-handle=2268,i,4985173463825043491,3047816736371715574,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:3432
- - C:\Program Files\MiniTool Partition Wizard 13\partitionwizard.exe
    "C:\Program Files\MiniTool Partition Wizard 13\partitionwizard.exe"
    3⤵
    PID:5240

C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe
"C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Program Files\MiniTool ShadowMaker\SMMonitor.exe
"C:\Program Files\MiniTool ShadowMaker\SMMonitor.exe"
1⤵
PID:3800

C:\Program Files\MiniTool ShadowMaker\AgentService.exe
"C:\Program Files\MiniTool ShadowMaker\AgentService.exe"
1⤵
PID:5208

C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
"C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe"
1⤵
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2252

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Qt5Core.dll

Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Core.dll
Size 5.3MB
SHA256 a71c5a226fbb4334353cc1d0f4abacba8a509f8544f286d352e1ec29c86c0742
MD5 a7e479e3fb8c45b4b572a301588c0de0
SHA1 a254d7e90a27196a6e40b9daacc1f72748ccc155
SHA512 92c4303df4967d48a957d258dc2502eedd50a39c7d5d2120f69233f53d67dde13be7112309dd71c0ba9b005951e59a416c5139861522c73cfba3bd49e6b370ae
SSDEEP 98304:vWcwN5Gs2OJsv6tWKFdu9CwCGNcqCWHfUY:vWcwN5GspJsv6tWKFdu9CwLNcqCWHfP
TLSH
T1C8467C577BA98161E5B7C23D89A7820AE2B37C111B329BCF5259171D2E337E11A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Gui.dll
Size 5.7MB
SHA256 be00d70e40813e1a8ae4715b8e3cdbfb6470dbffc7d591459bb4afc30e77f715
MD5 89c68c9d29d7c527097eb4a1317f71ad
SHA1 58add7d0d991931ac92eb144e007894412ae570a
SHA512 bfe224dec896857ebe32e75e52823f821b3791312d9629d63b565e2cd12e1854aff5e66cc416555dfbe08887a6171dfb6393e9084a0adaa2ee3528aaf0e2617f
SSDEEP 49152:W8S02e0os7wJ/mpFdnTQWQNaRItxDfhPwcD2XB4/nHUWHNFSQDnxq2Nlnftvg32l:C0R0oetTbQQRIfD0Wt0szfbbmDA
TLSH
T11556068A725A6252C977E27D875F052EE1F37852C3428BC748159B480F637EA1B7FE02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Widgets.dll
Size 5.3MB
SHA256 3bc64a69dc06e7a12442c04225630ba57c779d6e9e4e1aff9f986c3e68883f27
MD5 d654ed44099c61cf7ddc07dabeca28d3
SHA1 1acf0f22f3cb15585fe8ec97dad00eda8ac30d51
SHA512 9012f71a8dd27c56b46b341c97a8ac964bdf399f1f9d8740763be34bc4d179db5bb4fbee153e715990a37c2b1391b2622bcacffe32756abfaceb45183bf7f0ea
SSDEEP 98304:ypxOayP48Lqfk8bNbqDu3mn/cbF3EmFRRp/Y5HOWLG9N/PyaB6qCcz3O4IIWsDeF:ypxOayP48LqfkcbqDu3mn/cbF3EmFRRS
TLSH
T147467C97B3A541C1C16FD239CE898617D6B270148B238BDF16D9CF592F636E22A3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp120.dll

Path C:\Program Files\MiniTool Partition Wizard 13\msvcp120.dll
Size 644KB
SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
MD5 edef53778eaafe476ee523be5c2ab67f
SHA1 58c416508913045f99cdf559f31e71f88626f6de
SHA512 7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8
SSDEEP 12288:EOB4p+q4N8d4l2ms4cTHN+m+gy/vEPYysExtvsIvX71A+2EKZm+GWodEEpvYG:jAtvsIvL2EKZm+GWodEEpvYG
TLSH
T158E45B13FB150AB0E192D37891D78741D7F1BC898822F30752ABE27D5F67391AA2B361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr120.dll

Path C:\Program Files\MiniTool Partition Wizard 13\msvcr120.dll
Size 940KB
SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
MD5 aeb29ccc27e16c4fd223a00189b44524
SHA1 45a6671c64f353c79c0060bdafea0ceb5ad889be
SHA512 2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006
SSDEEP 24576:cj7dDxvo5outISmDa5HSueghIHkCvf44lmWymt:cnLLSl1tCX44h
TLSH
T1CE25BE4576A106F9D473D2B4CA679647F2B2B85A0530DB6F02E08A6D3F23B30966F317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

partitionwizard.exe

Path C:\Program Files\MiniTool Partition Wizard 13\partitionwizard.exe
Size 268KB
SHA256 7ff9f8bd571c4d2dfd8e87d816b8a62cfeaea8bdd416133ae8cf5363fc612a21
MD5 ce53e7e94958bbcbdbf9e08d07b50286
SHA1 0a0a996a02ab2c719681a38a6047cd57010d8588
SHA512 49e0628082478b5a281731cd2e4ffaf28bdab3508dc7c67e6600db1bf70248276ddb2d131ca22dd4eb6986272cc23b42ed5b64a1b98041fba8d0c3d2b5f0fbc4
SSDEEP 6144:fQSxqXfTwbWno+EDji9b6wK/WQX0MlheM4iYdXGWehI+lrxpUT2:fQADgtUiQX0MlheM4iYdXGWehI+lrxpj
TLSH
T1B1445B86A65330D6C8758C3DDD924F4997353C3F026A678B058056AB4F37A97EE3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files\MiniTool Partition Wizard 13\platforms\qwindows.dll
Size 1.2MB
SHA256 d3f3f1eea7662a928cea0d9029d83e8b6a23a24d641056c3575e4b2d33b05bd1
MD5 9608d1a7416a2534dee37613fb8bcb35
SHA1 c6dac2916d5740a406e784d035f7dee3e6ddb971
SHA512 11fbd7751abd89354383645666a70a6ceb37ec005eb064b5307101823d900073f82631f95201cbc81b4a965f1ca2f5c180b9779778ac09bd5fc6a851ae405e0c
SSDEEP 24576:pX7MVFVym740j81K8w8P2xQuUjvkp+dBZrEL:l7MzVy50qK8seuUQp+K
TLSH
T157457C83B3A582A5D16BD238C65B870ED7B1701413319BEB51A4CF496F23BE3263E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt.conf

Path C:\Program Files\MiniTool Partition Wizard 13\qt.conf
Size 46B
SHA256 3e25ea931f3228cae2b0138b66aeddb90cf73e93c108621e431c89c87f3fd594
MD5 ed54ff3a93486892b6a41c877df944d8
SHA1 c9a359103ff7bd26b4a74daeef24476e3fb95232
SHA512 5821dfaf8a09fb2783b9b670fd984d07af8bbbc5e219aa73b8187b052b947475cda2cc59cdfd2556ad1805ee5081323749a3f196a397ffbf641846a302be98d9
MD5 SHA1 SHA512

Submit Download

updatechecker.exe

Path C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe
Size 178KB
SHA256 70ca06cba73aef4a983ef369c737dc0bb84964f00533451f59b19c9ca81e3727
MD5 6bd30e7e94e6d16fe78bc1b0329d2a25
SHA1 c4aa8f5beabeb87d5a95867b0c80b9c2f2a73b44
SHA512 b2df706c4e86a87e51b921bfbf3e68959e8ee3b28cccee45a44741d05d169088f3b367a68d83cb2c59e252e9f67ee96627aece24935a9a15d62d176260d1545c
SSDEEP 3072:MQNV/7jy5vKU8K8kzkiq5AR7ArwwLf7gY2OyefF9Q:MQHycUJ8SSgY2Oyec
TLSH
T193044967365552D5C16AC138CD894916F2B7B0958B228BEF4229CE7A1F336E2FE3C344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Program Files\MiniTool ShadowMaker\MSVCP140.dll
Size 552KB
SHA256 7c4ce9d6bfcd6d9db4eef4e75ecdcf5a8e5320106e80f1eca617439fa43f33e8
MD5 cb75d6437418afe1a7b52acf75730ff1
SHA1 54c2da9552671b161cc87eb50fbdb86319b00f56
SHA512 f58abb740a30467e2d8aedd7eed357da020fdc7d966e245890d102a52e96fea296e122c1d2bc112423fc64b6f5e70b7df3f3eb7de1bf5c2f5f0eb3644f1e06d6
SSDEEP 12288:P/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6z9y5QEKZm+jWody:XN59IW6z9OQEKZm+jWodEEYZ
TLSH
T1FDC41923B75D05E0E195A3B8A1838305D7F17C4A8312A3C792FB96AD2F673D56B3B190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_1.dll

Path C:\Program Files\MiniTool ShadowMaker\MSVCP140_1.dll
Size 23KB
SHA256 5c27f359ba7f801f283e1c49d4cc668b6c1505d424b15dfa42d879f57a1f5fdb
MD5 c1bbf607cd0d540adab62d63a118c0c6
SHA1 0e9d84f5bbe1ed34c10f3666116b5016e1ae2c4a
SHA512 1ece3e9766bd9a978424cd6ba59adf90df41015accffbb3755bebc663e8e5c813546fd4f0b76d1d18d8b5838be0b391eea239ec9cc6be5fdf28a4fcbfeb82327
SSDEEP 384:lXt9apR9fFHN2iWc45gW/YI14gHRN7ByCHIrlm/NST:lXK79fFHETB3vq
TLSH
T110B23A86FB688803F426583085A6EE16B93DB3D19B2193DF1351E75D0DE37C1AA35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-0GR69.tmp

Path C:\Program Files\MiniTool ShadowMaker\PETools\amd64\boot\is-0GR69.tmp
Size 4KB
SHA256 f425e135aac26b55e2bac655e62e2ce0b16255226c583d9ab43b2e93e8a6d932
MD5 d4befebf3cef129ac087422b9e912788
SHA1 62313ec73f381c052f2513ca6279cfb5107e98c0
SHA512 3814e4682cad2ef40061d3d5e8142c964cc73a6c6dfc72ba59cbab0922dd0c7e279703450e3a1f4fcfde3498565bf6ef28a30e7de53a0eda75b3fea76d03929b
TLSH
T1D4810A160E6A711FFEEF8270CD5A118146C9FCAD6457A428A07801FB7D562B44DB330A
MD5 SHA1 SHA512 TLSH

Submit Download

is-R55MD.tmp

Path C:\Program Files\MiniTool ShadowMaker\PETools\amd64\boot\is-R55MD.tmp
Size 1024B
SHA256 a7a0edaf85f70e833fac02d0a416ae56ae2a3593e787f39c25dbb12830ca737c
MD5 eb145d5f87ddf43c8bd6f27e97db8bf2
SHA1 2021c98f81b177d17543ebd34004891183fa3dd4
SHA512 b85ff5a038173898b7f96890cb3998034bbcc50301cb31db112eeb04c3a1ed3c6b6d7905e48fc8cfe1fbb058b32e61349653b345bfe25fbfaa2ccffffda031ab
TLSH
T10511F1B73EC33D8BCFB895B29023DD3018D704C9015406A0D1845D6AF56470C5560080
MD5 SHA1 SHA512 TLSH

Submit Download

is-NVUBB.tmp

Path C:\Program Files\MiniTool ShadowMaker\PETools\amd64\is-NVUBB.tmp
Size 388KB
SHA256 2fc3d311969b63a258446488ec75c275d736ded13d74624e1c541f43a72ab483
MD5 21bf183c15afe62a8d1137bb9007b2a3
SHA1 d656dd1e85d7e8acffdefa9ced5d74bf0b978e39
SHA512 8a67833d502edaba077c783dab69a7d8c9155971c409f78cb87948bd4415b7a58410517aced73d6ed7d13a6b975af769aa0623b9dffd9537f5a1ce0248308291
SSDEEP 12288:egXZ0dArM1eu8fh5TZUV4SJ8ez8Fq1WsH/3UzM:bXI1e1XZUVD8e4a/kzM
TLSH
T1D18422C85698BF1FC5494DF6168B580DD0B24A8337A025CEF762752E8F85B22B36970F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-4FHRD.tmp

Path C:\Program Files\MiniTool ShadowMaker\PETools\x86\boot\is-4FHRD.tmp
Size 3.0MB
SHA256 cd2c00ce027687ce4a8bdc967f26a8ab82f651c9becd703658ba282ec49702bd
MD5 22d9945b4aae36dd59620a918f2e65f4
SHA1 bb025cedca07887916c4b7e5fa7a641ed3e30c14
SHA512 dd2d0ea7d5cf98064838ce0b74711f77534e1a2a14c7f74d44ed4b83acdb6f413d74671d2c6a8574aee88afb456b53a6b8452419a3bdddf2f7e9095c9d1d272e
SSDEEP 3072:S/pcj53vs/InbrTIHvPnHmC5irUuMo/+ncoZZihnh:acRn7y/EouH/cpi
TLSH
T1F3E54B52E6209B16E2FEC339D9BB1B2673A6AC06D302410FF606B3D96DBB7509DC4453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files\MiniTool ShadowMaker\Qt5Core.dll
Size 5.8MB
SHA256 6b5338cf3fd3f1d4c060c3f6fca84ef7ce5cc19449a48332b6da9f3c0158694f
MD5 484cc5d10aafd02f2b5b46edf32f7303
SHA1 4101d7111ff77d36e55eb9fc5bbd63b3dcf27bd2
SHA512 85a3c5e74bb5ee6c909df5ef6610938da0e9c56355596650943947e65aceb261f0f2310016cac9e0e25a518902fbc3bb3983ee084b10e8b44f483e00878204e8
SSDEEP 98304:qjHF64CPGbzD6mReJsv6tWKFdu9C1i73xqfKgw1m:2HF64CPGXDMJsv6tWKFdu9C103xqfKFg
TLSH
T161568B57B6A70150D0B6C23CC9A78217E6B3781287228ADF429CA74A5F777E12D3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-6QUUP.tmp

Path C:\Program Files\MiniTool ShadowMaker\QtQuick3D\Materials\maps\is-6QUUP.tmp
Size 334B
SHA256 03003aa01026e944b75447078f5758d0ffab854d03e9ce80780a174411073f7f
MD5 882310febbcd112f6416015145fd8c6d
SHA1 e142d0ba597a2c773e6354673bbc4a760f8d963f
SHA512 b21d8a189123c3019b5c99c1927d9eb10293cbe9321cb54d1fe183bf57efd22f778a61e47be27afb8f54d731ce17f96a6c6452dc76c3a8596b1bf1fdd532d4c4
TLSH
T130E02D9A6790097EC2E7577145C12F2396BB8138251742E644B7543A3C73BA4611BB85
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\MiniTool ShadowMaker\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Program Files\MiniTool ShadowMaker\VCRUNTIME140_1.dll
Size 36KB
SHA256 1554b5802968fdb2705a67cbb61585e9560b9e429d043a5aa742ef3c9bbfb6bf
MD5 37c372da4b1adb96dc995ecb7e68e465
SHA1 6c1b6cb92ff76c40c77f86ea9a917a5f854397e2
SHA512 926f081b1678c15dc649d7e53bfbe98e4983c9ad6ccdf11c9383ca1d85f2a7353d5c52bebf867d6e155ff897f4702fc4da36a8f4cf76b00cb842152935e319a6
SSDEEP 384:5GnvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbRuncS74G5WreKWn14gHc:rCm5yhUcwrHY/ntTxT6ovq7nt+dN
TLSH
T19FF24B9467788082E46B95B4C4E3AF27FB38F4615760938F0BA4825D2F637D0E63D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-ABRKG.tmp

Path C:\Program Files\MiniTool ShadowMaker\WinPE\is-ABRKG.tmp
Size 172B
SHA256 55bbd5c1b2a56a2e6ce92d3b59b460c30c56798ccd7804ec2790a5869f2b850b
MD5 9db4e733cb93ba9ff2e8f72f042fcda8
SHA1 2810dcdd7e56bf498ae3c1ec5ce8b23838c33413
SHA512 7b08f399d342b65ea13d5ebb19de1f4fe1dcdaaec4fdfe29e17cb365c7a9b47718fb5ad189df854397f691a492e451dad4ad7460f69150161b4cb7bd73c6e0e4
TLSH
T12FC08C4036CCC346FFF60DA0E8F0B007140A33C54C12E00D28D1404C0C60B007CB0004
MD5 SHA1 SHA512 TLSH

Submit Download

is-ETFE7.tmp

Path C:\Program Files\MiniTool ShadowMaker\WinPE\is-ETFE7.tmp
Size 168KB
SHA256 cd711e09012f37003af75e982e2e40df14445aca2800a3702a18612074ad660b
MD5 91899280efb4496c8ac0a004cd1469e2
SHA1 aa9a223cedc82f3ce8e9080bd6273062a9b56958
SHA512 5fd1c76157a0abc7e477c26a52d3e6a037a36b31a91e0958163a3b2337214a4d018b8880ea6f763c3812a37bc08917f0d9ea947f988dfec88720146e5783f251
SSDEEP 3072:7tsIhYtpXYj0SNsgNS55pOW2p4N29Tt1VwOdcstRe7XPYXCZPbUUYq/y5KfKdLkS:5IL5pz218NW
TLSH
T12FF33D4113F8651CF2F26B796E7B8240DF62BCA9A971D90F5704786C0530E86DA3BB72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-FB7S1.tmp

Path C:\Program Files\MiniTool ShadowMaker\WinPE\is-FB7S1.tmp
Size 165B
SHA256 c8ac2d7e987ee422dc2743826882ee52285296681e58a5ae8232acef0866c64a
MD5 ff2308e976215e0bb4d82a6a28ccdaad
SHA1 d438b2711f4e90d92f9ef183438a20ea87d78c69
SHA512 7f912293df38067fd06b1ba73698b274a7110a0e20dfb7131d08fd5638f1c7bfce1d7984c4b70a28599b0208a055c53ad63eb4d6628dd7640acaca585bd5a95e
TLSH
T1C4C08880B2CCCE8AFFF30CB028E0B203080A33B0BC22F20E2882008C3020B00A8A0008
MD5 SHA1 SHA512 TLSH

Submit Download

is-NLV23.tmp

Path C:\Program Files\MiniTool ShadowMaker\WinPE\is-NLV23.tmp
Size 126KB
SHA256 f0ee03c9936b459cc9bdf184df9b7efad98d40ab7b99e89166a42e019a0ec0ea
MD5 1c0ab06b3388e79a2206cbfd28e374a2
SHA1 fb94c71ee606c6cf5181840b4a6122eefd93770b
SHA512 1e90991d22b0c34e7947edbc5864f662ad01b2da7888fbe3a6e814607ea5abb6fc0b34a7ee0accede471d7442755f00fe99c4a8b029244bf034189cd00d74d07
SSDEEP 1536:O8YYSCjKBJ26c1Z7f25pVmuLXpxfqt7FEUWNrfQje9kWI23pKXvx:ZYuKBJ01Z7u5pQuLbESUWNzAAI23pKfx
TLSH
T175C309D979B8341BF5A5C03E53079318DBA3993CE1B29A43EB44FD36215044EBB2F692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glfw3.dll

Path C:\Program Files\MiniTool ShadowMaker\glfw3.dll
Size 220KB
SHA256 14054faa371c6070baa6753a48930a9175171b78fa1a3a114ccec6d9dcca520b
MD5 2b3dc38265d8e97e1cd2855e538c81d0
SHA1 0cb11718f0d2cfe7f9648a61a1f730cabf12978d
SHA512 c5158d80d8e3492bcfe0a128964f0e464e4632e8754aa1d3a832e5fb69de97f731ec59d68bdd9f599b3614eb58911a3361268e15397feb33ccd80e8ff0dded66
SSDEEP 3072:z5s0P9Ktl3aaDS6ZIykso3xgRRojOR7uTqb3VhfI:z5s0Pctl3lu6ZIngiTqb3Vhf
TLSH
T1BF24741963B1090ACF6B4473C6CFF9219477B04C3BDBA5DF7E5409E47E16BB281A8A24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-DJC3U.tmp

Path C:\Program Files\MiniTool ShadowMaker\is-DJC3U.tmp
Size 169KB
SHA256 cea2e299584f3cabd374492b3430d622662e658289fcc25cc0392ef1854cdadd
MD5 dbdbaa2ba083a61d79840461cd267c89
SHA1 62de8be6046c8ceea52a8be62fbee2d540782dc5
SHA512 8cdaab99640e52506f089d6130d2cf9bd8dabe63d39792e27fad7a51c1e045a4a3e611b447404db7b3a4a73827db7ef303d5aa5271c51b167bf11077fb19a172
SSDEEP 3072:aNEwXAITwIHM9zbxelZsQI0CM6eERGedlPEaERr9NYo+wbxFJn+szhA003ITiBwZ:QVAFexI0HH0GeTPEPrLbxFFuk4a1
TLSH
T11A04D0C0E9270AE7382DB17BBC83CC5899B133664BCEBED91C5C0CDC4565E5EE96025A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-U44V8.tmp

Path C:\Program Files\MiniTool ShadowMaker\is-U44V8.tmp
Size 2.3MB
SHA256 2a7efe3b2cd9fe6b99d03a98881e702915c0ca5a7be40d0d6239359d50208d08
MD5 a932841a7be9c114828b26b322979bb8
SHA1 e29afb43c3a5e629cf9202a9750b1bb16d1f2d9f
SHA512 eef46e2e2f4caa73fe341f2c6e736f921e7866692368f50d8ce24c9d325f81a781e14156f74903a2b71f3cc790b1dd0071912e8f6254d5f29621d5a459e2a04f
SSDEEP 24576:AQVmfRRRRRRRRRd5RRRRRyH7IHRRRRp/qXiB8Yptt1FQJeAgnamXTfqfOOp3THTO:AQV+GHjyaYWnwryOlVO+mO2W
TLSH
T18AB59F75B598972CDEC7012CCAADAB811BFBDE1085E08861D857F863CA7346BE051CE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lang.ini

Path C:\Program Files\MiniTool ShadowMaker\lang.ini
Size 24B
SHA256 209c59557c8be210b3c32d283c9df8654dcaa09fb9c5677ba071da1634735643
MD5 5a84ea18562126a5738abfd2ee4f618f
SHA1 e21662bd256fa3b9edd6eef876d3e68bd12a6903
SHA512 eefecf1a91123e231a4e0d82e0a5318c497e809d9767961ed439f86a867a81f3e7d7bca2894eed8f4d05cb112c1835c4f2da4170fc3aea96662dc556a0067824
MD5 SHA1 SHA512

Submit Download

system_backup_gui.exe

Path C:\Program Files\MiniTool ShadowMaker\system_backup_gui.exe
Size 4.8MB
SHA256 5d4c37962db3147265236d3b5d163a92d2e60cbb1beb69c089d2a046b9f0c8fc
MD5 5a0eee92beddf3c037f62936cb9b1811
SHA1 3eda4719e7b2c1d161a9f123a43f9c6373808921
SHA512 46afb67973acd0374f027b5633c5f0410644be4e9b8e14ed39b915afc9e3ff5f0fd8b227180073c6bec9bca8dff33acc67a9897137047c77e47e02d42aa6bb68
SSDEEP 49152:nzzeRd20tQoSAekaO+2GGeGtpNtxjfXvn/3Pqxl/niXZ/0SuIjIpQ7x07o+FviJT:4fdbMFIjvCFAJ3+znXnnCILzA
TLSH
T15736282B359802A5E076C578DFDA8985E5B3B851430A4DF7321AAE2C0F3BFD94A35DD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

testOpenGL.exe

Path C:\Program Files\MiniTool ShadowMaker\testOpenGL.exe
Size 392KB
SHA256 43fcd274830246500d0d2c6357eaf1fa8fa2754e534c19deea63bfec10115803
MD5 6242655f6556af90b1d3cd16d4cccc25
SHA1 c4eb4a46ba3b1e95705bd8068b85cd409211ca3c
SHA512 2aa09554a2ef56db534a235554791cb72814d694ad682cde03f8d3a3207b26886d94ece3e2dbc9af1c55f67c7b24219ab9313572a9815a222d0946ee79599641
SSDEEP 3072:Py7bVleSs+D+z59MWNUGXi50UB3xVaR/bFw:POv8CpVt
TLSH
T161840FE0B914DDCEFD285572306EB5760A772CE988D37552B887B3953CB1A8CE4E3902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-L6PN1.tmp

Path C:\Program Files\MiniTool ShadowMaker\x64\is-L6PN1.tmp
Size 2KB
SHA256 04f7aaa54815fb794e2cde30e0b63b8da9a984f2ff635fa63c5f693a89f08eb8
MD5 39b7adfd0f84457da41fe73b807cc780
SHA1 4984249e447f6cf697be2b980ca9d8f155c4a407
SHA512 cab93d6c21cc1f8d2f0b2feb395cfa0a2276f3c9f5bb6a913b63bab3fdc33680974a7c1520b38993b4ad992cb8e66c417c56c485f9fba4938b12a9c65a2e4531
TLSH
T13F51BB9857478670FA8B32A0BF237893B6253150E0F6754073ED8198D386E1D87B0AFE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9610d14fc53bc066b0cde09fa202708c78fae2265b2d7218b6ead39020915efe
MD5 883b4f6700c01826b3f40ad70d080f97
SHA1 6505a1b90dac5b8513d03161dbbea0e7c9079229
SHA512 f0fccef86128ff7db24ac223933771f65bd1109b2e412edee7c9a13011bdf367b04d54d76071ec2ce1846c589bd959e1ff5653164d66b973c203e4c29aec2668
SSDEEP 96:KUOEKbKmiEgKNObm7KmgIIOW4tVgGOK47g0OcOGlkWPHfItpfdK:SLrCm7KmgIIJ4tWGm7g09OGlkWPHfItW
TLSH
T120917949787B176038BE251B81A9D81BC68170A73289E92B3F5961D31F2BD005FFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a3d5dbfdf05303c0c83289f15dc027527a4979b7849b6cafc152db19110d4ead
MD5 76464fb810227a94685b8c3611ad72af
SHA1 bc52596e590a191e8f60226697330493f777b2e9
SHA512 ef91f3833bc0c8070b5a7b42ef4208a37fc6b9ab92296daa3be69d7b88de94483485f9b639018985cc8bde9f64341710b0fe74742801a2f088c89373b937ae5f
SSDEEP 768:nrv+4UNbdF3Q8LKQOJI1aJ5/hUAFjQIMyOV3N5E9EIR:nbsbf3ghNFUIpONNm5R
TLSH
T15F03BF31B8A8DBB35CFBE284B61AB2937FF4116748C50A44D9EE9B0C41472DE174BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6049e27a0817d6093d5db1ec8b1cbf202e8191470aa44b22a155844f8a7c1be9
MD5 ae299c8a75d79b130648907914681f8d
SHA1 e47961a96dc4d5bf24f5b019076a1fba76662ce0
SHA512 f7b194773f0b658a2fb2e0fca93ab8757515ebd13beeb4b348659454ec7c08c6769b14aac0ee8485bfecd71af7d0a89268700ce657f502f91b6d22401dd8c697
SSDEEP 768:9rv+4UNbdF3mJ6QOJI1ab/hUAFjQIMyOV3N5E9MnV+8r0mL:9bsbf3DhNFUIpONNmADrv
TLSH
T15203BF32A8A4DAB39CE7D6C5770A72437FF441A395C50A84C9EE6B0D824B5DD231BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

experience_01.exe

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe
Size 157KB
SHA256 c87e5168bb5a6268c7530bb826b9d88b137516825862e1b24cac1ba31247a91a
MD5 83695e8cf6c2c3daf622d1cdcfe3f6f7
SHA1 26c34a54f6e0fe38d55373dd0b4f328839773a74
SHA512 07634692b232ba651680b525b38e8489f0f3307cd67256dbab69fa5f91945728afcec62a47f017a5a2f18e411ab1b7de444c5591df487d00c006f959d7ceb6e1
SSDEEP 3072:QsSMRqJ37oszwXMO2H/S+T3FMmNxq989UwsdI46cZOxLybTb423cCxwuwMuHYboq:QsSykroO/OK/SG3Fa89OdI46cZOxLybJ
TLSH
T1E2F39D15B6C0C4B2D977183548B0DAB66A7EF9310F805ACB7798037E5E303C1AE35A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5945410d1a580727dc70895369bdd9d4b3627cbce8482e6aa99c2a503683406e
MD5 806b642fcf3bfdf131ac227edf70e4a2
SHA1 837a58b78baffc8a9721b0cd5c427d694f4d7ce9
SHA512 786c3c5506eede4718054468008cc0ee4c8e9035d7912ff4f6c42852b271fe33f7ce93c869c9a81a1bb5612fea822bc0c3a43a07f2f24bd6d4d067fd0f9449aa
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bdb7531642ee99ec2f064b92be4690ec72ebd2a399a377f974cf00cedf0cd75c
MD5 d67a7cbc8fa04a8f01833133bcfc731f
SHA1 767b480c888d53d32c40a524602e52a84b0d2e54
SHA512 3976f50a8dd0ea3215e8caa4770bf7672eb2a3b63decb282d277377e3a67c7a999368ea6e9095b627ec98fce3f00cb4a77a1ec4b144db620d3d96b24d44f940a
TLSH
T10FD0122232418134C01430330147A9090C10C21B40094481BC3C956E1A480641902482
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 52ae0f30b4fa60766b1b7cad5a5259aa72fe78d4153fe86151c821850980c82f
MD5 dd7b69053ff69e49e55d974e9c2f9e44
SHA1 217fa397b2f2fe6f0c06d284e3b5059af05f2216
SHA512 7fe7b1865177a2cb0e1925e874ec1febf485699661a942e7804f7cba3de53530892b933d9e8527c290f4c046a08e9b4362c529c24dda0f0525caa6f7364395dd
TLSH
T1DC3199B3D8944B72AC525605320EAFA7DE201077D7524E54B4EE4F0C02DB14D676FC31
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 8e4c31efb80e5c6f681a00299168122eae256c0a7254351054ca58c0d2c9a2b9
MD5 412cd4a45a264dfeb29bf5777d86a8a3
SHA1 ca4a1d9bbac18a6dec0b3019ca5fe8fe616561d8
SHA512 97013af6c01b76aa3a659bc7ca19ed6fbea2f07608a2f16985744fda992f183cc82e6af9096786618cbc07da45d8bceededec418ab0facb6172ef15c1fec739e
TLSH
T1F5518473AC149B7789A28608760E2F73DE345166AB622F64B9ED0F0C01DB61D234BC76
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 da932d088a353b3d87d2a6e90b8815f179fba48bf81c7cbe70482596c4a91d6d
MD5 305cc78f5545d2fbfb565c2feea6d35f
SHA1 a59bd9e0add340b6903bc0958aa4af029f5d44ba
SHA512 bdc373aea636362469672799f57ff28c0e5fd98d7ef98357e1d4df9864bcc709ac4f26ad5a57255b60fb7b39fca7e8206fec2e37f2ed2398c53ebd362b83ad0d
TLSH
T1BC71A677A8649A774DA2CA04794A2B27E7A45137EA953FA4E9FC0F0C01DB35C1347C16
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\MinitoolLimited\experience_01.exe.WebView2\EBWebView\Local State
Size 4KB
SHA256 eb007d0e229f50e0d7a4d5fdf4a1075f52934e06eaa90a27cee7726f2ad72ead
MD5 f978c7a177c65474374e16788875fc12
SHA1 b1abd5aaa7131981f35147f96ea5245b8d62cc2a
SHA512 e834774c89e5e2d23ab0c70b8ca4b3309fa49599f613967e4873ad5c3ecabf77c006063615cde9a172dcebb652758780089f01fdb000a39cc5eb64424e424986
SSDEEP 96:aNkGSCzfkg6UiPCl8kh/cI9URoDoto+5mVBOs76zJZUZJTqJYa:aNBStg6ByeoDUhsOstVS
TLSH
T1D881B627A8649A774DF2D508794A2F13EBA45133DA963FA8E9FC0F0C02DB28D1347817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pw_sm_setup_x64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-BL0TS.tmp\pw_sm_setup_x64.tmp
Size 3.5MB
SHA256 16ad6b23acc98b15e741db4421a955b6f0f0de0f9b05b8cc25e7253ed8a52a26
MD5 5fe3c7d5690022b686e47f98b10048a2
SHA1 1d7bb68ae3ecf9a6a2d79f274eb3bfb24d23ddc1
SHA512 97163a213703f69e7e829067cae2aa4050a7b31b05b60a6a3ef3965f506247c9fa07bf7897086a3752ea1ee3fc5a2791fecc8aa433066c4d0e93ade99b36b4cc
SSDEEP 49152:0WwGHAkqMu7ot6SCiGoghuXs7+KXrmeSVrJuh52gu8c333yZnXnnCILzO1:09GdkJuXbeSVQdu7333inXnnCILzi
TLSH
T167F55C23F24D693ED05B3E3D663793A0987B7E602D128C57AAEC3A4C4F355801E2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pw-free-online.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-MHPTL.tmp\pw-free-online.tmp
Size 3.3MB
SHA256 76d39d5863fb82115fc68424edaae98dc09d3f59d4f9f1db9875aa752171829f
MD5 00b847d4268f3586d682496374c583a9
SHA1 71369bc1e091944f6172aef69249775d632e1a84
SHA512 da888e99de838dcc5b7574580272d98fbb1c78f1c9721de22cfc34a01e4cfaf4d75e537cf21026f8974f1219423ca6ea86c72df574ae3de2ebe6356d95304642
SSDEEP 49152:Vdx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjv333L991R6njR:WHDYsqiPRhINnq95FoHVBv333L991Yn1
TLSH
T1DFF54C17F389723ED46B1B7656338550983BBA216913CCA7A7F8394C8E3D4902E3E647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

help.chm

Path C:\Users\Admin\AppData\Local\Temp\is-NHUME.tmp\help.chm
Size 6.1MB
SHA256 ad1d641b22b8629c4515cbe1eac136040f290631b23fc72627f03002caaa0301
MD5 cbaf08243eb6c7ce4183a1e35afb049d
SHA1 9e3dacf61ffb9dd7ebf9fca694698baed14f5e9a
SHA512 c7a97e356da16b4a26c33ffea9ff0b0e0f07bea7a4d09a001b5396c4ab8a1b8d144b01ffbcd7d7526adac2ab5086e7c5729aa61fca14593073ffebae86e6cec3
SSDEEP 196608:rPUnV09kO6itI5mdiyGrcS87mhQskVmJvErOx1CYBby:QV09vxUmdi5cS87mhKVAvqYBe
TLSH
T1F756331E2771B829CC7D463C9D58F718EC83058B223A4D5B78D078CE6AF46B14E6ED89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwfree-64bit-online.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-NIOJO.tmp\pwfree-64bit-online.tmp
Size 3.3MB
SHA256 66b219416ce983c7de0e30f9a8a852012fd51e8844404eefd73f9e1e1213dc93
MD5 3a15c8ece1f04ccd6211b0a2f0bdf8d2
SHA1 1275f857bffa268233e6d8601f027f305d5f3718
SHA512 fbc56b3eb4e79d2994beaa611c362e5c8a97ff779e71aefa5c2be1f233dedc117c4e4836696aadbd5a9889e2b049e4e1b0ebac2774af9a14c4ca87a2d3cb0a03
SSDEEP 49152:Qdx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjv333L991R6njd:NHDYsqiPRhINnq95FoHVBv333L991Ynx
TLSH
T10DF54C17F389723ED46B1B7656338550983BBA216913CCA7A7F8394C8E3D4902E3E647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP120.dll

Path C:\Users\Admin\AppData\Local\Temp\is-R9RQC.tmp\MSVCP120.dll
Size 444KB
SHA256 d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
MD5 a883c95684eff25e71c3b644912c73a5
SHA1 3f541023690680d002a22f64153ea4e000e5561b
SHA512 5a47c138d50690828303b1a01b28e6ef67cfe48215d16ed8a70f2bc8dbb4a73a42c37d02ccae416dc5bd12b7ed14ff692369bc294259b46dbf02dc1073f0cb52
SSDEEP 12288:/VHbDqy90l5yQBggQerfhUgiW6QR7t5ss3Ooc8DHkC2ehSxPA:tbOqQbnrMs3Ooc8DHkC2ehSxo
TLSH
T12BA45C237B864CF2D19E53B231C9531257FAFC6541A1F303ABEEE1593FA6286E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path C:\Users\Admin\AppData\Local\Temp\is-R9RQC.tmp\MSVCR120.dll
Size 948KB
SHA256 e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
MD5 2fb20c782c237f8b23df112326048479
SHA1 b2d5a8b5c0fd735038267914b5080aab57b78243
SHA512 4c1a67da2a56bc910436f9e339203d939f0bf854b589e26d3f4086277f2bec3dfce8b1f60193418c2544ef0c55713c90f6997df2bfb43f1429f3d00ba46b39b0
SSDEEP 24576:wmFyjHVMxBuwQLYucGp4iiqgNb3HoIbiIw:2My2yRgFoIbnw
TLSH
T1BE25BE12B982C0B2C57602B1152DE772197FB971443684B7ABD98F0E1DB46C0FB6BB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmDownloader.exe

Path C:\Users\Admin\AppData\Local\Temp\is-R9RQC.tmp\SmDownloader.exe
Size 66KB
SHA256 166960f92a85a33207dad124fea1938740a82809c05dd449fd19f39c2c029038
MD5 0bb1be1cee6bc878acbb41b1af7cfc88
SHA1 e8769d43088d5800bc169455077329bb8cf973b7
SHA512 91a7c4f634ff2becf934fa04fcaf8e0f27173394428dd08b90050cc0685f1fc403234c09cf3b20308a91e952f2023875ff2fd9d6386c783eb966ec5a71931056
SSDEEP 1536:MyJGWwlNcvMTQRhYiDZExECS1UIs+PFiknWXi2U:MyJGWbYidExEf1Jse5ngXU
TLSH
T196631A02E600A139E8AB0AB28DFF155D9179EE61174410E3B7C8E64EDB96BF63D3111F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-R9RQC.tmp\libcurl.dll
Size 317KB
SHA256 f959786d18020a9ded99dc668e1f576cac8dd364e22d773d40e4fc693264555c
MD5 56f4c7d613927081e8311bc46ee0ec92
SHA1 b6aed1f136b7ebc94f5246d7d1518a5747998ed4
SHA512 5b4f1aa6db8bde8eb4b76ac036520fba09fe31958b0b74d3c17e0064cecc0f3995dc8b1a479b690c28831173328a0821f62cdc72ab26d3be575c6afc98544243
SSDEEP 6144:+IVOTKuYnSBJyz7emSDtYVA/6rXHgMRhXWXZFvyOw03wbokxRivVXxClrzW:+zKObjWVS6rXHgMfmjvyDAwbtuVXxCs
TLSH
T139648D92AE8121F1E6C9027C71B3673B0D345E19A355DAD7E390DD5588222E2EE3E3CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

line.bmp

Path C:\Users\Admin\AppData\Local\Temp\is-R9RQC.tmp\line.bmp
Size 6KB
SHA256 efb22f0b990c4ed4a8d36868c7d9d3793b61f0728343306caeae0ae5f0751447
MD5 9dc5bf6e4b2cad053d12ad24260d9327
SHA1 84b7d911b8d8002ff95edb523d108038b6ea3bf0
SHA512 25c3b183d96ee5ef9f5fe35ce898e718baf894dcb0a82049dde59b0779a7ede88907f1d1f44ff155cb1ea178c296aaf36975341679f7289920e615d4c01844f9
SSDEEP 3:3k/gl8lkpXZR3ARa38mmDmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmK:Uol0k13ARa38mmg3ARa3l
TLSH
T121E102533958C584F6946074CF1ECDEC1180BD46DD90022331C57B0F26300843E4C140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

support.bmp

Path C:\Users\Admin\AppData\Local\Temp\is-R9RQC.tmp\support.bmp
Size 822B
SHA256 624677996b347cd36593d4a1107b265c903268086f2f548b50c0f329fd649a33
MD5 12ca16a9c8707b7f0a257e6cabbbea3a
SHA1 a0b81eb518de7eb4ee4f3ded01fdf781151ff874
SHA512 70c595f65be3bd9d9d2f44b5240b3bf8f9e7b923c59fdf8f07dd3f89bd8731a9cb9abab2fe899b5aac1e402ec33c782974c9554584c088de9e051f99b21c9c78
TLSH
T11A01D41735DA7FB0CF19BEF48A1D4C2900517DF00CF5414D006132D996388FDB01457A
MD5 SHA1 SHA512 TLSH

Submit Download

unsupport.bmp

Path C:\Users\Admin\AppData\Local\Temp\is-R9RQC.tmp\unsupport.bmp
Size 822B
SHA256 93a93ec1f9af7118b2fb05a1abc420781130e5663b92536a23ec6a4b172a0843
MD5 4ac29de505cfb25bbb88d190ad379d82
SHA1 582b2a54ce52a950614ee7dc444e5d1b4c532e54
SHA512 fbfd193b678c5c2fc8a1a1d17dddf832d6aee35ab3f01ddb9f44eb48ce8125cd4efde9f7816161133ec13d477a3aaae842d8ea8ffbd97653eb5bfc96fbe204b6
TLSH
T1DF0101AA31B01DE0DC6800B0003862C439824D35AB8C42A2C71DF08ED63207620AC840
MD5 SHA1 SHA512 TLSH

Submit Download

pwfree-64bit-online.exe

Path C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe
Size 42.1MB
SHA256 54eae82df2e581dea562ad7dce6999a1838ada91742f5a2dc09f3b235a33c3b6
MD5 f978a5ab63b97065f3f6e1e11383f441
SHA1 c8f6c070a49d9ed497c670114f7f6c1a417dfb94
SHA512 08b1a6112c877b3900ba53758ce4f450772857571654aa6f678ab3649888e75cfa0ebf7123633068996c94af98b147fd3920413e29b03b7fef282156d9deedea
SSDEEP 786432:jWIN0qXFvh3CPe9m4rcnlZ7aqtHHXZuSm2H4p/g4bzF04DCdyFWlcjekL4WwvSXH:yE0QtRxJcl1VHpuSRHeg4N04DCdyFW65
TLSH
T142A7337BB258613ED46E4BF162B3422069FFBA1869134C5A33F055CECF2B4601E3A657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5988_719410035\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-88-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/1284-461-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/1348-3260-0x00007FFB086D0000-0x00007FFB08C16000-memory.dmp

Download

memory/1348-3308-0x00007FF7BED10000-0x00007FF7BEEF1000-memory.dmp

Download

memory/1348-3347-0x00007FFB275E0000-0x00007FFB2770F000-memory.dmp

Download

memory/1780-483-0x0000000071880000-0x0000000071DCA000-memory.dmp

Download

memory/2252-3222-0x00007FFB074C0000-0x00007FFB07A06000-memory.dmp

Download

memory/2252-3223-0x00007FF7BED10000-0x00007FF7BEEF1000-memory.dmp

Download

memory/2252-3231-0x00007FFB275E0000-0x00007FFB2770F000-memory.dmp

Download

memory/2764-492-0x0000000000F00000-0x0000000000FFB000-memory.dmp

Download

memory/2764-1086-0x0000000000F00000-0x0000000000FFB000-memory.dmp

Download

memory/2764-3367-0x0000000000F00000-0x0000000000FFB000-memory.dmp

Download

memory/3800-3330-0x00007FFB086D0000-0x00007FFB08C16000-memory.dmp

Download

memory/4780-3370-0x00007FFB2D300000-0x00007FFB2D301000-memory.dmp

Download

memory/4828-456-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5044-473-0x0000000071DE0000-0x000000007232A000-memory.dmp

Download

memory/5156-3317-0x00007FFB2D300000-0x00007FFB2D301000-memory.dmp

Download

memory/5156-3570-0x000001798D4C0000-0x000001798D593000-memory.dmp

Download

memory/5208-3331-0x00007FFB086D0000-0x00007FFB08C16000-memory.dmp

Download

memory/5208-3605-0x00007FFB275E0000-0x00007FFB2770F000-memory.dmp

Download

memory/5208-3342-0x00007FF7BED10000-0x00007FF7BEEF1000-memory.dmp

Download

memory/5240-3444-0x0000000071880000-0x0000000071DCA000-memory.dmp

Download

memory/5240-3474-0x00007FFAFE940000-0x00007FFAFEF1C000-memory.dmp

Download

memory/5240-3445-0x00007FFB00670000-0x00007FFB011DB000-memory.dmp

Download

memory/5684-488-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-79-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-61-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-46-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-81-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-3408-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-3409-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-92-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-6-0x0000000002530000-0x0000000002531000-memory.dmp

Download

memory/5684-43-0x0000000002530000-0x0000000002531000-memory.dmp

Download

memory/5684-83-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-460-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-2905-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-799-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-63-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-42-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5684-59-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5852-3366-0x00000000008A0000-0x0000000000C27000-memory.dmp

Download

memory/5852-1087-0x00000000008A0000-0x0000000000C27000-memory.dmp

Download

memory/5852-3203-0x00000000008A0000-0x0000000000C27000-memory.dmp

Download

memory/6056-41-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/6056-3417-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/6056-0-0x0000000000400000-0x0000000000526000-memory.dmp

Download