Overview

overview

7

Static

static

1

pw1207-fre...ne.exe

windows10-2004-x64

7

pw1207-fre...ne.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/08/2026, 17:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pw1207-free-online.exe
  • Size 3.1MB
  • Sample260820-vzbjvsgk21
  • SHA256 bc917c4424c078290c3cbbb13e5f2f9c2939222d058d70056688718ae33e13a9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryinstallerpersistencespywaretrojan

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 1 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 7 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\pw1207-free-online.exe
    "C:\Users\Admin\AppData\Local\Temp\pw1207-free-online.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Users\Admin\AppData\Local\Temp\is-V2PKE.tmp\pw1207-free-online.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-V2PKE.tmp\pw1207-free-online.tmp" /SL5="$701C0,2294223,1148928,C:\Users\Admin\AppData\Local\Temp\pw1207-free-online.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill.exe" /f /im "updatechecker.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4416
      • C:\Users\Admin\AppData\Local\Temp\is-2FOPV.tmp\SmDownloader.exe
        "C:\Users\Admin\AppData\Local\Temp\is-2FOPV.tmp\SmDownloader.exe" /HWND:1311234 /PATH:"C:\Program Files\MiniTool Partition Wizard 12" /URL:https://www.partitionwizard.com/download/online-setup-config/pwfree-v12.ini /VERYSILENT /USERMSG:1450 /LANG:english
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4168
        • C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe
          C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12" /LANG=english
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4664
          • C:\Users\Admin\AppData\Local\Temp\is-S6RAE.tmp\pwfree-64bit-online.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-S6RAE.tmp\pwfree-64bit-online.tmp" /SL5="$80208,43446255,1148928,C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe" /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12" /LANG=english
            5⤵
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4592
            • C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe
              "C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe" /createtask
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              PID:4172
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.partitionwizard.com/feedback/install-partition-wizard.html?from-free-v1208
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1272
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x33c,0x7ffa26aac188,0x7ffa26aac194,0x7ffa26aac1a0
          4⤵
            PID:2208
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,14212652607635031092,12557384242269506613,524288 --field-trial-handle=2608,i,6647708170629577084,9682304285748383800,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:3
            4⤵
            • System Time Discovery
            PID:3176
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,10906559065888572812,3729749572100843300,262144 --field-trial-handle=2608,i,6647708170629577084,9682304285748383800,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
            4⤵
              PID:4784
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,932406284859302694,11465410793927180055,524288 --field-trial-handle=2608,i,6647708170629577084,9682304285748383800,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
              4⤵
                PID:1468
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,4230998410708465334,14723626958592082110,2097152 --field-trial-handle=2608,i,6647708170629577084,9682304285748383800,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
                4⤵
                  PID:3152
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,9788438867580765341,17539079809269431465,2097152 --field-trial-handle=2608,i,6647708170629577084,9682304285748383800,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
                  4⤵
                    PID:4184
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4104,i,12256628731927002718,7711934988566746778,2097152 --field-trial-handle=2608,i,6647708170629577084,9682304285748383800,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
                    4⤵
                      PID:4612
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4088,i,4098711020753813705,7717284514520792568,2097152 --field-trial-handle=2608,i,6647708170629577084,9682304285748383800,262144 --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:1
                      4⤵
                        PID:3584
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4865575057700661822,3597131016776391182,524288 --field-trial-handle=2608,i,6647708170629577084,9682304285748383800,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
                        4⤵
                          PID:660
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,2052120083733747356,10501901450222098584,524288 --field-trial-handle=2608,i,6647708170629577084,9682304285748383800,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
                          4⤵
                            PID:3960
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,14704125176012527780,7661476127538456809,524288 --field-trial-handle=2608,i,6647708170629577084,9682304285748383800,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
                            4⤵
                              PID:5572
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,9606566237149382360,9635751463519341451,524288 --field-trial-handle=2608,i,6647708170629577084,9682304285748383800,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
                              4⤵
                                PID:5580
                            • C:\Program Files\MiniTool Partition Wizard 12\experience.exe
                              "C:\Program Files\MiniTool Partition Wizard 12\experience.exe" http://tracking.minitool.com/pw/installation.php?from=pwfree12
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:3084
                              • C:\Program Files\MiniTool Partition Wizard 12\MiniTool.GA.Uploader.exe
                                "C:\Program Files\MiniTool Partition Wizard 12\MiniTool.GA.Uploader.exe" "C:\Users\Admin\AppData\Local\MiniTool GA Uploader\GA"
                                4⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks whether UAC is enabled
                                • Suspicious use of WriteProcessMemory
                                PID:1212
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=MiniTool.GA.Uploader.exe --webview-exe-version=1.0.0+cf6340781bd2fc6f2f7219d17c39aecde2a4b47f --user-data-dir="C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1212.2604.6683285579467869691
                                  5⤵
                                  • Enumerates system info in registry
                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                  • Suspicious use of WriteProcessMemory
                                  PID:4416
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffa15efb078,0x7ffa15efb084,0x7ffa15efb090
                                    6⤵
                                      PID:3964
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView" --webview-exe-name=MiniTool.GA.Uploader.exe --webview-exe-version=1.0.0+cf6340781bd2fc6f2f7219d17c39aecde2a4b47f --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1692,i,3825534525695408294,8171379148924591603,262144 --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
                                      6⤵
                                        PID:5516
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView" --webview-exe-name=MiniTool.GA.Uploader.exe --webview-exe-version=1.0.0+cf6340781bd2fc6f2f7219d17c39aecde2a4b47f --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1320,i,3825534525695408294,8171379148924591603,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:3
                                        6⤵
                                          PID:5540
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView" --webview-exe-name=MiniTool.GA.Uploader.exe --webview-exe-version=1.0.0+cf6340781bd2fc6f2f7219d17c39aecde2a4b47f --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2300,i,3825534525695408294,8171379148924591603,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:8
                                          6⤵
                                            PID:5620
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView" --webview-exe-name=MiniTool.GA.Uploader.exe --webview-exe-version=1.0.0+cf6340781bd2fc6f2f7219d17c39aecde2a4b47f --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3416,i,3825534525695408294,8171379148924591603,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
                                            6⤵
                                              PID:6032
                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView" --webview-exe-name=MiniTool.GA.Uploader.exe --webview-exe-version=1.0.0+cf6340781bd2fc6f2f7219d17c39aecde2a4b47f --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3788,i,3825534525695408294,8171379148924591603,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
                                              6⤵
                                                PID:1808
                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView" --webview-exe-name=MiniTool.GA.Uploader.exe --webview-exe-version=1.0.0+cf6340781bd2fc6f2f7219d17c39aecde2a4b47f --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3828,i,3825534525695408294,8171379148924591603,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
                                                6⤵
                                                  PID:4852
                                          • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe
                                            "C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe"
                                            3⤵
                                            • Checks BIOS information in registry
                                            • Drops file in System32 directory
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Checks processor information in registry
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4964
                                      • C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe
                                        "C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious behavior: AddClipboardFormatListener
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3848
                                      • C:\Windows\System32\vdsldr.exe
                                        C:\Windows\System32\vdsldr.exe -Embedding
                                        1⤵
                                          PID:3920
                                        • C:\Windows\System32\vds.exe
                                          C:\Windows\System32\vds.exe
                                          1⤵
                                          • Checks SCSI registry key(s)
                                          PID:2540
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                          1⤵
                                            PID:3632
                                          • C:\Windows\system32\pwdrvio.sys
                                            C:\Windows\system32\pwdrvio.sys
                                            1⤵
                                            • Executes dropped EXE
                                            PID:5804
                                          • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe
                                            "C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe"
                                            1⤵
                                            • Checks BIOS information in registry
                                            • Drops file in System32 directory
                                            • Drops file in Program Files directory
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Checks processor information in registry
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2024
                                          • C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe
                                            "C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe"
                                            1⤵
                                            • Checks BIOS information in registry
                                            • Drops file in System32 directory
                                            • Drops file in Program Files directory
                                            • Executes dropped EXE
                                            • Checks processor information in registry
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5736
                                          • C:\Windows\System32\vdsldr.exe
                                            C:\Windows\System32\vdsldr.exe -Embedding
                                            1⤵
                                              PID:5116
                                            • C:\Windows\System32\vds.exe
                                              C:\Windows\System32\vds.exe
                                              1⤵
                                              • Checks SCSI registry key(s)
                                              PID:1284

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  KBitLocker.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\KBitLocker.dll
                                                  • Size 70KB
                                                  • SHA256 d2998141a37f76469ef3b41791ca602b652d6d15e09288e54b9a1173a82663c0
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  KUserExpCollection.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\KUserExpCollection.dll
                                                  • Size 265KB
                                                  • SHA256 e29a33211810a06fe95bc42d894a987daec7daec8246e4d01b15a92762dbac88
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  MSVCR120.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\MSVCR120.dll
                                                  • Size 940KB
                                                  • SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Qt5Charts.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\Qt5Charts.dll
                                                  • Size 1.3MB
                                                  • SHA256 f22551ef3c8628430749a04189d5ae15ebcd74779ad2157a2ef2b7fc12249cec
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Qt5Core.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\Qt5Core.dll
                                                  • Size 5.3MB
                                                  • SHA256 a71c5a226fbb4334353cc1d0f4abacba8a509f8544f286d352e1ec29c86c0742
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Qt5Gui.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\Qt5Gui.dll
                                                  • Size 5.7MB
                                                  • SHA256 be00d70e40813e1a8ae4715b8e3cdbfb6470dbffc7d591459bb4afc30e77f715
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Qt5Network.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\Qt5Network.dll
                                                  • Size 1.0MB
                                                  • SHA256 1e971e5e8996b350622f447c88dd6d020cb4c32c259550aef29b9fdac8df9645
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Qt5Svg.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\Qt5Svg.dll
                                                  • Size 314KB
                                                  • SHA256 7709c09eec5c6ebf13748501f48e87791e742516503cabd234a723a2f58ff843
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Qt5Widgets.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\Qt5Widgets.dll
                                                  • Size 5.3MB
                                                  • SHA256 3bc64a69dc06e7a12442c04225630ba57c779d6e9e4e1aff9f986c3e68883f27
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  experience.exe
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\experience.exe
                                                  • Size 22KB
                                                  • SHA256 4c0158038c8df52842337cb14962f92b54da35a459ffae2a9417d81657ef4239
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  experience.exe.config
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\experience.exe.config
                                                  • Size 545B
                                                  • SHA256 cee1348f26d14cbc218f24c7e321241ec934cfecc36592ffdb56fe5ea3b0b393
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  idriver.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\idriver.dll
                                                  • Size 26KB
                                                  • SHA256 7be69aeeb28d2c745fbcfdb507699430d756ac5d830234664ac0d64d2ba0b28b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  ikernel.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\ikernel.dll
                                                  • Size 1.4MB
                                                  • SHA256 e07f6fde0287585f244589d9c92f6e5108e7dc10d5a34386f039fe04ea435f80
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  libeay32.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\libeay32.dll
                                                  • Size 1.6MB
                                                  • SHA256 835ed648baaa42517fc79c6c1325acf1b53a64f925bd64ef63408b053e981b00
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  msvcp120.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\msvcp120.dll
                                                  • Size 644KB
                                                  • SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  partitionwizard.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.dll
                                                  • Size 8.0MB
                                                  • SHA256 02ed32946ffa02f938107b9bff233b1e063f38762a553bd209f698b4e07e650d
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  partitionwizard.exe
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\partitionwizard.exe
                                                  • Size 268KB
                                                  • SHA256 13a44ba07699e8bd18b6fc3af00e93234f90314616768eea01d73afb7845e1a8
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  qwindows.dll
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\platforms\qwindows.dll
                                                  • Size 1.2MB
                                                  • SHA256 d3f3f1eea7662a928cea0d9029d83e8b6a23a24d641056c3575e4b2d33b05bd1
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  qt.conf
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\qt.conf
                                                  • Size 46B
                                                  • SHA256 3e25ea931f3228cae2b0138b66aeddb90cf73e93c108621e431c89c87f3fd594
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  updatechecker.exe
                                                  • Path C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe
                                                  • Size 178KB
                                                  • SHA256 52dc9a1db1bb3dc1e85a7bb3052bf58b76ea7a9d1ade5e2e5e1a5f6f7a8e227a
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  settings.dat
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                  • Size 280B
                                                  • SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  settings.dat
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                  • Size 280B
                                                  • SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  settings.dat
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                  • Size 280B
                                                  • SHA256 8fc0daac07f1cba5e2be811f2c7da605f08db262b2865fb00c09cca1533fed22
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  BookmarkMergedSurfaceOrdering
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                  • Size 6B
                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                  • Size 3KB
                                                  • SHA256 8d3ed1970a865d048b6b670aeaef1df00a3e04ec0e817b99d74d5ec32d2c2261
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index~RFe598da0.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598da0.TMP
                                                  • Size 3KB
                                                  • SHA256 bbdc843065fb461b3e54c26a1d224cb33237c38da60a114f43b6e29f96027947
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  SiteList-Enterprise.json
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                  • Size 2B
                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Edge Profile.ico
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                  • Size 70KB
                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Network Persistent State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                  • Size 2KB
                                                  • SHA256 14c4808f6b148271c9696562be9819f09f9a8a0ad961aa4b87af108cee974d0a
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  SCT Auditing Pending Reports
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                  • Size 2B
                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                  • Size 14KB
                                                  • SHA256 3e75b47ed7364b3e026e0ad925aeb62aa5db05fed95a2d05fe73bba55cde597a
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Secure Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                  • Size 30KB
                                                  • SHA256 c2d3195892963d92f790375db2a6cb520c90b69f0ea66cce448a5408e078dae5
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  sync_diagnostic.log
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                  • Size 6KB
                                                  • SHA256 af3672bc4ad5ca194f1d36c52b841ccfd6081e05304ca1cd5471a5e830fe0506
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                  • Size 17KB
                                                  • SHA256 c390777762b65e9a7eb7e222ceb1b84c327bf76f37a66a3b27e1e0fa2f2ca3be
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                  • Size 8KB
                                                  • SHA256 5e3a055630756533cd5d54054bcfe6c012c74ee05b1222d39f4a498fe400b439
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                  • Size 8KB
                                                  • SHA256 bcb52da554c8a9c018b8cc38606b3ebb0d9f1303039a3043c905884aad139070
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  74f9cddc-9574-4b64-ac0c-ca98d495a62f.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\74f9cddc-9574-4b64-ac0c-ca98d495a62f.tmp
                                                  • Size 13B
                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  startup_2026-08-20.log
                                                  • Path C:\Users\Admin\AppData\Local\MiniTool GA Uploader\GA\logs\startup_2026-08-20.log
                                                  • Size 747B
                                                  • SHA256 143b5eb90208401751ac3a37f0fb9a0c6d941b850a993917ad8f3c36b07af759
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  startup_2026-08-20.log
                                                  • Path C:\Users\Admin\AppData\Local\MiniTool GA Uploader\GA\logs\startup_2026-08-20.log
                                                  • Size 1KB
                                                  • SHA256 2c5659ca9245239635e0f2cba15cdd4835ab21b88d575ac001aea6a5cdc1b727
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  MSVCP120.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-2FOPV.tmp\MSVCP120.dll
                                                  • Size 444KB
                                                  • SHA256 d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  MSVCR120.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-2FOPV.tmp\MSVCR120.dll
                                                  • Size 948KB
                                                  • SHA256 e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  SmDownloader.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-2FOPV.tmp\SmDownloader.exe
                                                  • Size 66KB
                                                  • SHA256 166960f92a85a33207dad124fea1938740a82809c05dd449fd19f39c2c029038
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  libcurl.dll
                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-2FOPV.tmp\libcurl.dll
                                                  • Size 317KB
                                                  • SHA256 f959786d18020a9ded99dc668e1f576cac8dd364e22d773d40e4fc693264555c
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  line.bmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-2FOPV.tmp\line.bmp
                                                  • Size 6KB
                                                  • SHA256 efb22f0b990c4ed4a8d36868c7d9d3793b61f0728343306caeae0ae5f0751447
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  support.bmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-2FOPV.tmp\support.bmp
                                                  • Size 822B
                                                  • SHA256 624677996b347cd36593d4a1107b265c903268086f2f548b50c0f329fd649a33
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  unsupport.bmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-2FOPV.tmp\unsupport.bmp
                                                  • Size 822B
                                                  • SHA256 93a93ec1f9af7118b2fb05a1abc420781130e5663b92536a23ec6a4b172a0843
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  pwfree-64bit-online.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-S6RAE.tmp\pwfree-64bit-online.tmp
                                                  • Size 3.3MB
                                                  • SHA256 87732995a2014ed992b63c820b765dc32ecb0376722f9505a1104e221d92d175
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  pw1207-free-online.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-V2PKE.tmp\pw1207-free-online.tmp
                                                  • Size 3.3MB
                                                  • SHA256 398b1fe38a434790f6d5e82d72bbaef3b3dfba13740bde388fb7749312c1b917
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  pwfree-64bit-online.exe
                                                  • Path C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe
                                                  • Size 42.3MB
                                                  • SHA256 8b186b8acf0e302cd18cc94d75129d10eff7573d99afd1ffc940d234394c4bf1
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  settings.dat
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Crashpad\settings.dat
                                                  • Size 280B
                                                  • SHA256 9d38a9322926ef9fe369fc4839ca2871ea4f1097f37fc5afacb324237a0a373b
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  MANIFEST-000001
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                  • Size 41B
                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  TransportSecurity
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Default\Network\TransportSecurity
                                                  • Size 188B
                                                  • SHA256 608c438219b9a770ee5c1628d33c55aa6b9a4e7a1bfbe42e70a6379beea09ac9
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  TransportSecurity~RFe5a2b67.TMP
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Default\Network\TransportSecurity~RFe5a2b67.TMP
                                                  • Size 188B
                                                  • SHA256 9538c296e2849b4762d96ea3947000af5f023302ae9081b42077de2edc271754
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Default\Preferences
                                                  • Size 6KB
                                                  • SHA256 5e83827f677847f113a8085bc5df2ab31d5a693fc25b24eaa34d978791b3510d
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Preferences~RFe5a2898.TMP
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Default\Preferences~RFe5a2898.TMP
                                                  • Size 6KB
                                                  • SHA256 a8c8fdcc4f3982f5bdee7796415796a7081f1e09c648d54f2eb70967fb7bbb7b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  CURRENT
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Default\Sync Data\LevelDB\CURRENT
                                                  • Size 16B
                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  data_0
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\GrShaderCache\data_0
                                                  • Size 8KB
                                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  data_1
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\GrShaderCache\data_1
                                                  • Size 264KB
                                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  data_2
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\GrShaderCache\data_2
                                                  • Size 8KB
                                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  data_3
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\GrShaderCache\data_3
                                                  • Size 8KB
                                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Local State
                                                  • Size 1KB
                                                  • SHA256 7fc592a1f55a3ebe22e0d75b3fc219479b7fd65b322026f63f98ecea5dd2bf8f
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Local State
                                                  • Size 4KB
                                                  • SHA256 7eb114532c9ce5f36fa1fb91e1f3a8dd72de2be4c8f43511218b26ab99691853
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Local State
                                                  • Size 2KB
                                                  • SHA256 c12526f4f34c3ed8f921f07f7cc0d5c7c0d1fd93e6ef9a28dc4356db50f4e458
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Local State
                                                  • Size 3KB
                                                  • SHA256 e336fb92eb4cfa897d9843b8a41796236e4c8a65abc5c49d40f40e0b8d10f027
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Local State
                                                  • Size 4KB
                                                  • SHA256 1f3d30f9e0b5bbdd58241f96af24c0880b2f4e87167a34a546c8e4542f826e70
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State~RFe5988ce.TMP
                                                  • Path C:\Users\Public\MiniTool GA Uploader\WebView2Cache\EBWebView\Local State~RFe5988ce.TMP
                                                  • Size 1KB
                                                  • SHA256 903d8217ece1884f5a8492ae9db5c462e0f9d3fad26d318b14e68c10518336b5
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  memory/1212-594-0x0000017D79770000-0x0000017D79796000-memory.dmp
                                                  Download

                                                  memory/1212-604-0x0000017D7A610000-0x0000017D7A61E000-memory.dmp
                                                  Download

                                                  memory/1212-610-0x0000017D7A620000-0x0000017D7A6A6000-memory.dmp
                                                  Download

                                                  memory/1212-598-0x0000017D797B0000-0x0000017D797B8000-memory.dmp
                                                  Download

                                                  memory/1212-595-0x0000017D5F660000-0x0000017D5F668000-memory.dmp
                                                  Download

                                                  memory/1212-593-0x0000017D60F50000-0x0000017D60F66000-memory.dmp
                                                  Download

                                                  memory/1212-592-0x0000017D5F600000-0x0000017D5F60A000-memory.dmp
                                                  Download

                                                  memory/1212-588-0x0000017D5F650000-0x0000017D5F658000-memory.dmp
                                                  Download

                                                  memory/1212-596-0x0000017D797C0000-0x0000017D797C8000-memory.dmp
                                                  Download

                                                  memory/1212-597-0x0000017D7A5F0000-0x0000017D7A5FA000-memory.dmp
                                                  Download

                                                  memory/1212-590-0x0000017D79650000-0x0000017D79662000-memory.dmp
                                                  Download

                                                  memory/1212-572-0x0000017D5F620000-0x0000017D5F64E000-memory.dmp
                                                  Download

                                                  memory/1212-573-0x0000017D60F30000-0x0000017D60F4A000-memory.dmp
                                                  Download

                                                  memory/1212-553-0x0000017D5F030000-0x0000017D5F1EA000-memory.dmp
                                                  Download

                                                  memory/2024-1098-0x0000000058AE0000-0x000000005902A000-memory.dmp
                                                  Download

                                                  memory/2024-1099-0x0000000058AE0000-0x000000005902A000-memory.dmp
                                                  Download

                                                  memory/2024-1103-0x00007FFA24860000-0x00007FFA24ED4000-memory.dmp
                                                  Download

                                                  memory/2024-1100-0x00007FFA22670000-0x00007FFA22E7F000-memory.dmp
                                                  Download

                                                  memory/2024-1097-0x00007FFA22670000-0x00007FFA22E7F000-memory.dmp
                                                  Download

                                                  memory/2024-1104-0x00007FFA24860000-0x00007FFA24ED4000-memory.dmp
                                                  Download

                                                  memory/2024-1119-0x00007FFA1B580000-0x00007FFA1BCCB000-memory.dmp
                                                  Download

                                                  memory/2024-1124-0x00007FFA349A0000-0x00007FFA34A35000-memory.dmp
                                                  Download

                                                  memory/2024-1123-0x00007FFA34E20000-0x00007FFA34EC6000-memory.dmp
                                                  Download

                                                  memory/2024-1122-0x000000006C740000-0x000000006C86E000-memory.dmp
                                                  Download

                                                  memory/2024-1121-0x00007FFA34F10000-0x00007FFA34FC9000-memory.dmp
                                                  Download

                                                  memory/2024-1120-0x00007FFA1AF60000-0x00007FFA1B57B000-memory.dmp
                                                  Download

                                                  memory/2120-45-0x0000000000400000-0x0000000000760000-memory.dmp
                                                  Download

                                                  memory/2120-81-0x0000000000400000-0x0000000000760000-memory.dmp
                                                  Download

                                                  memory/2120-42-0x0000000002850000-0x0000000002851000-memory.dmp
                                                  Download

                                                  memory/2120-67-0x0000000000400000-0x0000000000760000-memory.dmp
                                                  Download

                                                  memory/2120-5-0x0000000002850000-0x0000000002851000-memory.dmp
                                                  Download

                                                  memory/2120-498-0x0000000000400000-0x0000000000760000-memory.dmp
                                                  Download

                                                  memory/2120-544-0x0000000000400000-0x0000000000760000-memory.dmp
                                                  Download

                                                  memory/2120-41-0x0000000000400000-0x0000000000760000-memory.dmp
                                                  Download

                                                  memory/3084-542-0x0000000002D80000-0x0000000002DA6000-memory.dmp
                                                  Download

                                                  memory/3084-541-0x000000001DA90000-0x000000001DACA000-memory.dmp
                                                  Download

                                                  memory/3084-506-0x0000000000630000-0x0000000000638000-memory.dmp
                                                  Download

                                                  memory/3084-533-0x000000001C080000-0x000000001C0E8000-memory.dmp
                                                  Download

                                                  memory/3848-492-0x0000000058AE0000-0x000000005902A000-memory.dmp
                                                  Download

                                                  memory/4172-478-0x0000000058AE0000-0x000000005902A000-memory.dmp
                                                  Download

                                                  memory/4172-477-0x0000000058AE0000-0x000000005902A000-memory.dmp
                                                  Download

                                                  memory/4308-0-0x0000000000400000-0x0000000000526000-memory.dmp
                                                  Download

                                                  memory/4308-40-0x0000000000400000-0x0000000000526000-memory.dmp
                                                  Download

                                                  memory/4308-545-0x0000000000400000-0x0000000000526000-memory.dmp
                                                  Download

                                                  memory/4592-168-0x0000000000400000-0x0000000000760000-memory.dmp
                                                  Download

                                                  memory/4592-484-0x0000000000400000-0x0000000000760000-memory.dmp
                                                  Download

                                                  memory/4664-165-0x0000000000400000-0x0000000000526000-memory.dmp
                                                  Download

                                                  memory/4664-485-0x0000000000400000-0x0000000000526000-memory.dmp
                                                  Download

                                                  memory/4664-74-0x0000000000400000-0x0000000000526000-memory.dmp
                                                  Download

                                                  memory/4964-1096-0x00007FFA24560000-0x00007FFA24589000-memory.dmp
                                                  Download

                                                  memory/4964-908-0x00007FFA1AEE0000-0x00007FFA1B62B000-memory.dmp
                                                  Download

                                                  memory/4964-532-0x0000000058AE0000-0x000000005902A000-memory.dmp
                                                  Download

                                                  memory/4964-911-0x000000006C740000-0x000000006C86E000-memory.dmp
                                                  Download

                                                  memory/4964-531-0x00007FFA22670000-0x00007FFA22E7F000-memory.dmp
                                                  Download

                                                  memory/4964-1091-0x00007FFA1A8C0000-0x00007FFA1AEDB000-memory.dmp
                                                  Download

                                                  memory/4964-913-0x00007FFA1D580000-0x00007FFA1D615000-memory.dmp
                                                  Download

                                                  memory/4964-1095-0x00007FFA1D580000-0x00007FFA1D615000-memory.dmp
                                                  Download

                                                  memory/4964-1094-0x00007FFA20CB0000-0x00007FFA20D56000-memory.dmp
                                                  Download

                                                  memory/4964-1093-0x000000006C740000-0x000000006C86E000-memory.dmp
                                                  Download

                                                  memory/4964-1092-0x00007FFA214D0000-0x00007FFA21589000-memory.dmp
                                                  Download

                                                  memory/4964-1090-0x00007FFA1AEE0000-0x00007FFA1B62B000-memory.dmp
                                                  Download

                                                  memory/4964-1089-0x00007FF9FEA60000-0x00007FFA01F2D000-memory.dmp
                                                  Download

                                                  memory/4964-912-0x00007FFA20CB0000-0x00007FFA20D56000-memory.dmp
                                                  Download

                                                  memory/4964-910-0x00007FFA214D0000-0x00007FFA21589000-memory.dmp
                                                  Download

                                                  memory/4964-909-0x00007FFA1A8C0000-0x00007FFA1AEDB000-memory.dmp
                                                  Download

                                                  memory/4964-914-0x00007FFA24560000-0x00007FFA24589000-memory.dmp
                                                  Download

                                                  memory/4964-543-0x00007FFA1B630000-0x00007FFA1BCA4000-memory.dmp
                                                  Download

                                                  memory/4964-907-0x00007FF9FEA60000-0x00007FFA01F2D000-memory.dmp
                                                  Download

                                                  memory/5516-690-0x00007FFA43360000-0x00007FFA43361000-memory.dmp
                                                  Download

                                                  memory/5620-752-0x00007FFA42060000-0x00007FFA42061000-memory.dmp
                                                  Download

                                                  memory/5620-751-0x00007FFA43140000-0x00007FFA43141000-memory.dmp
                                                  Download

                                                  memory/5620-1015-0x0000029965CD0000-0x0000029965D00000-memory.dmp
                                                  Download

                                                  memory/5736-1105-0x00007FFA24860000-0x00007FFA24ED4000-memory.dmp
                                                  Download

                                                  memory/5736-1115-0x00007FFA349A0000-0x00007FFA34A35000-memory.dmp
                                                  Download

                                                  memory/5736-1114-0x00007FFA34E20000-0x00007FFA34EC6000-memory.dmp
                                                  Download

                                                  memory/5736-1113-0x000000006C740000-0x000000006C86E000-memory.dmp
                                                  Download

                                                  memory/5736-1111-0x00007FFA1AF60000-0x00007FFA1B57B000-memory.dmp
                                                  Download

                                                  memory/5736-1110-0x00007FFA1B580000-0x00007FFA1BCCB000-memory.dmp
                                                  Download

                                                  memory/5736-1109-0x00007FFA0FD00000-0x00007FFA131CD000-memory.dmp
                                                  Download

                                                  memory/5736-1116-0x00007FFA3B1A0000-0x00007FFA3B1C9000-memory.dmp
                                                  Download

                                                  memory/5736-1112-0x00007FFA34F10000-0x00007FFA34FC9000-memory.dmp
                                                  Download

                                                  memory/5736-1102-0x0000000058AE0000-0x000000005902A000-memory.dmp
                                                  Download

                                                  memory/5736-1101-0x00007FFA22670000-0x00007FFA22E7F000-memory.dmp
                                                  Download

                                                  memory/5804-1029-0x0000000000010000-0x0000000000018000-memory.dmp
                                                  Download

                                                  memory/6032-791-0x00007FFA43360000-0x00007FFA43361000-memory.dmp
                                                  Download