8b186b8acf0e302cd18cc94d75129d10eff7573d99afd1ffc940d234394c4bf1

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pwfree-64bit-online.exe
Size 42.3MB
Sample260831-ph2rtstygs
SHA256 8b186b8acf0e302cd18cc94d75129d10eff7573d99afd1ffc940d234394c4bf1
MD5 ca3decee5524ae7bc51ece2d9effc5f7
SHA1 86db052abd9e7426728e8d767681113de539baa8
SHA512 efcbf19b966e9194d7efa6e5d7d3b3b7e0fb357049806d5fdc3168f8f47a2feea0c49bf57dd47f49a5bec2de95bacb3742ad72c78e4b44583cefc6ff9e4ef891
SSDEEP 786432:LVIN0qXFvh3CPe9m4rcnlZ7aqtHHXZuFCJekXq5J6mktZpti6FO+xX7jiKEkVOsj:ZE0QtRxJcl1VHpuhkUIJXiMXC870ZW
TLSH
T13DA7332BB160643ED46E4BF261B3462169FFBA64B5234C5A73F095CDCF270202F2A657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery installer persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MTPW = "\"C:\\Program Files\\MiniTool Partition Wizard 13\\updatechecker.exe\""	pwfree-64bit-online.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\Qt5Core.dll	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\SQLite.Interop.dll	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\WebView2Loader.dll	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\diskspd\diskspd64.exe	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-DJN65.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-1EL40.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-V9MQ3.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\imageformats\is-K1RDS.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-Q3E2T.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-F74G4.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-IV09N.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\PETools\amd64\efi\microsoft\boot\is-ULQ55.tmp	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\x64\pwnative.exe	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\diskspd\diskspd32.exe	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\imageformats\is-O6E8H.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\diskspd\is-LF52G.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-LPBBH.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\PETools\x86\boot\is-LGRTM.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\PETools\x86\boot\is-R9E2S.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-MATE2.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-3HETP.tmp	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\avcodec-58.dll	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\x64\is-5T0PG.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\en-us\win8_x64\is-V753N.tmp	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\7z.exe	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\unins000.dat	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\avfilter-7.dll	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\PEDrivers\x64\f6flpy-x64\is-HHHCI.tmp	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\SDL2.dll	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\x86\wimserv.exe	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-I9V75.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\PETools\amd64\boot\is-7NOD7.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-16GES.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-339JM.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\imageformats\is-ND2UG.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\PEDrivers\x64\f6flpy-x64\is-3NR8O.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-O4RO7.tmp	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\MicrosoftEdgeWebview2Setup.exe	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-4IKHE.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-IN4GG.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-93IH7.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-4BGK9.tmp	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\swscale-5.dll	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-LNL1P.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-5PBAB.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\imageformats\is-JBNJL.tmp	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\avdevice-58.dll	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-MRJAE.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-A52TS.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-PKPM7.tmp	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\wimgapi.dll	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-1ARLH.tmp	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\KWebPage.dll	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\efs.dll	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-0G5O4.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-7GVSU.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\en-us\x64\is-ODJ3R.tmp	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\Qt5Widgets.dll	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\PETools\x86\boot\is-QCB34.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\en-us\win8_x86\is-OEPNK.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\pxeBoot\is-8SRST.tmp	pwfree-64bit-online.tmp
File created	C:\Program Files\MiniTool Partition Wizard 13\is-V5FP4.tmp	pwfree-64bit-online.tmp
File opened for modification	C:\Program Files\MiniTool Partition Wizard 13\msvcr120.dll	pwfree-64bit-online.tmp

Executes dropped EXE 3 IoCs

pid	Process
5036	pwfree-64bit-online.tmp
2576	updatechecker.exe
4260	updatechecker.exe

Loads dropped DLL 23 IoCs

pid	Process
2576	updatechecker.exe
2576	updatechecker.exe
2576	updatechecker.exe
2576	updatechecker.exe
2576	updatechecker.exe
2576	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe
4260	updatechecker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pwfree-64bit-online.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pwfree-64bit-online.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4652-0-0x0000000000400000-0x0000000000526000-memory.dmp	innosetup
behavioral1/memory/4652-7-0x0000000000400000-0x0000000000526000-memory.dmp	innosetup
behavioral1/memory/4652-417-0x0000000000400000-0x0000000000526000-memory.dmp	innosetup

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2576	updatechecker.exe
4260	updatechecker.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5036	pwfree-64bit-online.tmp
5036	pwfree-64bit-online.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5036	pwfree-64bit-online.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	updatechecker.exe
4260	updatechecker.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 5036	4652	pwfree-64bit-online.exe	86
PID 5036 wrote to memory of 2576	5036	pwfree-64bit-online.tmp	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe
"C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Admin\AppData\Local\Temp\is-Q5B2J.tmp\pwfree-64bit-online.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Q5B2J.tmp\pwfree-64bit-online.tmp" /SL5="$402D8,43446255,1148928,C:\Users\Admin\AppData\Local\Temp\pwfree-64bit-online.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe
    "C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe" /createtask
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2576

C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe
"C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KBitLocker.dll

Path C:\Program Files\MiniTool Partition Wizard 13\KBitLocker.dll
Size 70KB
SHA256 d2998141a37f76469ef3b41791ca602b652d6d15e09288e54b9a1173a82663c0
MD5 5ef7e1a355066dea41a6727462ee2196
SHA1 5655cf1e3e230304268b1b2facc39af8e814463f
SHA512 7ca58558a95ae2292dac15e8c65f64f16bd4f3a3855e55664814e9911f0578eaa77178ccf908560caaaa3fa7306da32e1c594170a164f9ee52d9f40f54faec7e
SSDEEP 768:CbCS1FsrWKU6NZIERT2+2YZcY/Zs0tZ1GsOACH594gC5YiyJSA5ALu:CbCesrWwFRTkYO0tZ5OACHXE7Y
TLSH
T167634B0717B90462E0A6A2BC9B878661E2F378662B3287CF5765435F0F33BC1497E361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KUserExpCollection.dll

Path C:\Program Files\MiniTool Partition Wizard 13\KUserExpCollection.dll
Size 265KB
SHA256 e29a33211810a06fe95bc42d894a987daec7daec8246e4d01b15a92762dbac88
MD5 c8b72fd96ce211163eb41788489118a4
SHA1 aad375ba32024377842029bdfb8aa55682117cc0
SHA512 3fbc4ed613b1606a0c2b5ef9c6e9b5d7da24f13149bd62baf1683d95733ecc4c257dff6633d620d47a428d3d16fb8d302d84b807f5a71a47c81069196e44254b
SSDEEP 3072:90M01pE5kPIk6MppPRoBRCyDXB4+cpoPpe3eCpqZ4mrHFLhZrOutkbe+2u3C/:9P8t8vr1c6Z46FrOuW34
TLSH
T1CB44C60EEA6549B1D437E479C1C3AA2AF97274A6873097DB4755DB2B1F2B3D0B839300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP120.dll

Path C:\Program Files\MiniTool Partition Wizard 13\MSVCP120.dll
Size 644KB
SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
MD5 edef53778eaafe476ee523be5c2ab67f
SHA1 58c416508913045f99cdf559f31e71f88626f6de
SHA512 7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8
SSDEEP 12288:EOB4p+q4N8d4l2ms4cTHN+m+gy/vEPYysExtvsIvX71A+2EKZm+GWodEEpvYG:jAtvsIvL2EKZm+GWodEEpvYG
TLSH
T158E45B13FB150AB0E192D37891D78741D7F1BC898822F30752ABE27D5F67391AA2B361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path C:\Program Files\MiniTool Partition Wizard 13\MSVCR120.dll
Size 940KB
SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
MD5 aeb29ccc27e16c4fd223a00189b44524
SHA1 45a6671c64f353c79c0060bdafea0ceb5ad889be
SHA512 2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006
SSDEEP 24576:cj7dDxvo5outISmDa5HSueghIHkCvf44lmWymt:cnLLSl1tCX44h
TLSH
T1CE25BE4576A106F9D473D2B4CA679647F2B2B85A0530DB6F02E08A6D3F23B30966F317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Charts.dll

Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Charts.dll
Size 1.3MB
SHA256 f22551ef3c8628430749a04189d5ae15ebcd74779ad2157a2ef2b7fc12249cec
MD5 07e4bd7c3a018d39206e9a30c35d9320
SHA1 f1cf5dd2e45bf2d9020855d469c60fcee7f22046
SHA512 00c5d0a0fd623d1657ff91b8b6ab118a01eca837227a234af34aeccab678feac2cb0cb76ff768eae68bbf150432ef7bd549c57d0665f62f80a71866df67d875a
SSDEEP 24576:M2Pr9Td4eL5eLKXdVr+yPiGduV61uOADnAj0PZRK7Q:z4eL5eLKzr+6idIF+CQ
TLSH
T10C55D56BFA4542C1F159D3BACD9B5626F572B08047D6CBDB23A98B0C1E933C12B7E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Core.dll
Size 5.3MB
SHA256 a71c5a226fbb4334353cc1d0f4abacba8a509f8544f286d352e1ec29c86c0742
MD5 a7e479e3fb8c45b4b572a301588c0de0
SHA1 a254d7e90a27196a6e40b9daacc1f72748ccc155
SHA512 92c4303df4967d48a957d258dc2502eedd50a39c7d5d2120f69233f53d67dde13be7112309dd71c0ba9b005951e59a416c5139861522c73cfba3bd49e6b370ae
SSDEEP 98304:vWcwN5Gs2OJsv6tWKFdu9CwCGNcqCWHfUY:vWcwN5GspJsv6tWKFdu9CwLNcqCWHfP
TLSH
T1C8467C577BA98161E5B7C23D89A7820AE2B37C111B329BCF5259171D2E337E11A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Gui.dll
Size 5.7MB
SHA256 be00d70e40813e1a8ae4715b8e3cdbfb6470dbffc7d591459bb4afc30e77f715
MD5 89c68c9d29d7c527097eb4a1317f71ad
SHA1 58add7d0d991931ac92eb144e007894412ae570a
SHA512 bfe224dec896857ebe32e75e52823f821b3791312d9629d63b565e2cd12e1854aff5e66cc416555dfbe08887a6171dfb6393e9084a0adaa2ee3528aaf0e2617f
SSDEEP 49152:W8S02e0os7wJ/mpFdnTQWQNaRItxDfhPwcD2XB4/nHUWHNFSQDnxq2Nlnftvg32l:C0R0oetTbQQRIfD0Wt0szfbbmDA
TLSH
T11556068A725A6252C977E27D875F052EE1F37852C3428BC748159B480F637EA1B7FE02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Network.dll
Size 1.0MB
SHA256 1e971e5e8996b350622f447c88dd6d020cb4c32c259550aef29b9fdac8df9645
MD5 68ec8a5f852fe3eca746393e01124ad3
SHA1 8d750ef88248e20316056e5f7a09a7973cb7145a
SHA512 efa0294bc337d039b49a806e542d8cdf948054594dea02f8ccf09ade4942a49c566d6804b5d9e5f439ff5a78dd74c67143fcd54e778201fab57174faec259084
SSDEEP 12288:uPxv9zVdSzSJEc8tEQtd4Qie3hp1e2WO9MeuSVOHQhERYqWSrvuYjxt2+w7RHstY:UlSzi8tEQ7+e3hp1e2WOeXnrJS+w72G
TLSH
T101356BBB735A4291E47AD238CC568603E6B2705487269FEF0368CF592F736E2663D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Svg.dll
Size 314KB
SHA256 7709c09eec5c6ebf13748501f48e87791e742516503cabd234a723a2f58ff843
MD5 fac5600e5a488ec7ea3c4875fa95772e
SHA1 916607210ac16188c3d24393166eaf4e3957b678
SHA512 1c8f6b682095b5c781bb1ef6ee2e8bfdea52f5d2dbd713eab31008c31c3b52ca02f84051d6ddec0d68b3f20dcf0fd194916608cd50ff4dbcb9447ebe8205fe48
SSDEEP 6144:a3y2oiXfFHV8tz1mhiWl8b5rBQ6+Soi/7IOxlBWLtYH7OAq4K:atpPFHV8tz1mh9l8bK
TLSH
T152642897F2560E86E56BD27CC8468515E1B338104373C7EF066A8A6A3F172E2BE3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files\MiniTool Partition Wizard 13\Qt5Widgets.dll
Size 5.3MB
SHA256 3bc64a69dc06e7a12442c04225630ba57c779d6e9e4e1aff9f986c3e68883f27
MD5 d654ed44099c61cf7ddc07dabeca28d3
SHA1 1acf0f22f3cb15585fe8ec97dad00eda8ac30d51
SHA512 9012f71a8dd27c56b46b341c97a8ac964bdf399f1f9d8740763be34bc4d179db5bb4fbee153e715990a37c2b1391b2622bcacffe32756abfaceb45183bf7f0ea
SSDEEP 98304:ypxOayP48Lqfk8bNbqDu3mn/cbF3EmFRRp/Y5HOWLG9N/PyaB6qCcz3O4IIWsDeF:ypxOayP48LqfkcbqDu3mn/cbF3EmFRRS
TLSH
T147467C97B3A541C1C16FD239CE898617D6B270148B238BDF16D9CF592F636E22A3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idriver.dll

Path C:\Program Files\MiniTool Partition Wizard 13\idriver.dll
Size 26KB
SHA256 7be69aeeb28d2c745fbcfdb507699430d756ac5d830234664ac0d64d2ba0b28b
MD5 5a356382239a68bc664cb4ec21e5dac1
SHA1 5c717a07bfe6b5ae419f1e96f92c611ddd3781bf
SHA512 8caff312721977c21c9ab074ac29133ea58fa98494caf78af3fad0f505928c1ed13e8c99f180e54af2ba8c4392955da2c5c48a0dcdebf5ee813b45cf5ac71c2e
SSDEEP 384:9cigmcQYVufeuW8RAEPwgRGerk1zOfiorMHQIYiyJu3QmVy8RbmL4nNydJ37:CF8kuDWfEPwDWGzOfhK5YiyJSt5ALF
TLSH
T132C28E974744A849DC53C531E9E28A3BF8B0F1911F6193CF3268C6698F913C27ABE358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ikernel.dll

Path C:\Program Files\MiniTool Partition Wizard 13\ikernel.dll
Size 1.4MB
SHA256 e07f6fde0287585f244589d9c92f6e5108e7dc10d5a34386f039fe04ea435f80
MD5 1bc2eebaf10d0b02dae40087c1438512
SHA1 461f4df11e2838dcc7a96452df5bf3013536ae87
SHA512 79d108471081f9bc56b632b0e94c7b85345524cbdc0e8c80cecea13b3f1ca476bf4d8c598794a848184fb38d3113c3a3aac6c42a58c8d4ef50d1953a5781f82e
SSDEEP 24576:ZJRdgFiEQhpEIZvmJeJoMjnFMRJKKw12/uV2bH/vwbH/vhbH/v1:ZprEQhp2J2FqBwguV2b/ob/Jb/9
TLSH
T1A0655A12B250C154E1BAC0399EBBE6DFD2627805EF2186EB75E0435F6D37BE05A39213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qdds.dll

Path C:\Program Files\MiniTool Partition Wizard 13\imageformats\qdds.dll
Size 56KB
SHA256 181ed94d3ad037ddf8ab60bb552ab852afcfa1a759c3adea06bda9f07692be79
MD5 cd58de80b21c0da2b242c15dfd825196
SHA1 4f0fc112d823c2360a1a0577e1aa845355b722ef
SHA512 8039269c51e93c9f97fbde1e4aa6f61e84afdf9b07f26da590f009820c6df4a5fdbcbf76d24ff42442f754189d6cbadc8384c079283fe3b4e4fa958033b3623b
SSDEEP 768:Ax6yfZ6hBeDNUrwrK/OvPIkJsicEjY4/bC7g4gOA6PrfTFiGriXiRc:A44D6rWK/Ovgk6uTL3OA6PrbFiGWXi2
TLSH
T14B435C81A32990D6F123C678C1E75E17EAF3B4504B9147CF4AE4CA9E2F173E2293A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgif.dll

Path C:\Program Files\MiniTool Partition Wizard 13\imageformats\qgif.dll
Size 37KB
SHA256 503c306efd3394eb0f9617c481b0fa5964ee690badea992a592b6241db2aaf3a
MD5 83a8a84a578656713d9cb48dc2df9a92
SHA1 0105569de76fabe34bacdebf2d4cf045b4ebb1ec
SHA512 d9706e49b63b56769e427af9f3b11ed5e19028254f950adf23c3d0d0d6279627e0983bad715e88ff3bf6aa72550ba5ccdc25e688a1b89ced71bd728fbcd379ee
SSDEEP 768:o9xoE7ZP1tn1LjJkA6ZwLlm8OAbGT/FiwriXiRx:o9LP9LjqwLlm8OAbS/FiwWXiz
TLSH
T115036D8A5F3D5181E053C234C5970F2BDA72B0A05B6187CF59A5829E1E6B7C23E3973E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qicns.dll

Path C:\Program Files\MiniTool Partition Wizard 13\imageformats\qicns.dll
Size 44KB
SHA256 a1a7fc64e928a3bee12295ff613be9a13d1d2fd3e934e7726c0cfa33d24bf6fb
MD5 48dad7bb1b009d171dbf7abb4a48a979
SHA1 ed4e972de80c9dd8987e1a6f26a2175e3618cdce
SHA512 41e6bedfe1cc3dd0e798c8701220e545128b09112fc5c9243df18f6c1aec371cc5aa592fc92d9b0bef3bbcc376d23f120078a91088ba6bdfd8bf7d3553ad1f78
SSDEEP 768:GAvq1sXHz4BTHDrRt8FbWOAvJb5M5FirriXiRnx:XwZJiFKOAvJb5M5FirWXi1x
TLSH
T13F134C927B3A4281E163D234C5970A37E9B1F8525B929BDF0250C73E2E6B3C1393D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Program Files\MiniTool Partition Wizard 13\imageformats\qico.dll
Size 38KB
SHA256 fd738fdaacc34c9a01a547bd18d3ca1ac620096cdb3e1f94895ac08b371d40d0
MD5 d3f182546f058a7e4f62d258420f2aa5
SHA1 80664c4508ce02448713cc6f34d0a8b13dcd4cd0
SHA512 c2e28c0530e54e0e4455a5da082e3420833cbf48d9a267e97b3cd1e63b32fe93e03f211d0a5401f11013d6061b6a49b76d009dea6ff367327dea2f562b4b75bf
SSDEEP 768:84bnXHGamyEa0K78cgb2v95iBO39FNGXOusyNGJFiariXiRs:FwyAEt95CO39FNGXOusGGJFiaWXiO
TLSH
T1B9035C83672D1180E163C678CA9A5E16EDB2B4A157629BCF12B0C71F1F1B3D23E39359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Program Files\MiniTool Partition Wizard 13\imageformats\qjpeg.dll
Size 239KB
SHA256 5cda55e959ff3d8ed56710b077be98373986fc698d0eb2c29526904f7355a3ec
MD5 0b682ba9c08df63e406546dc2b4349b5
SHA1 c0485e7e1fcd5e7d5324cc8c0f3a66652a855a1e
SHA512 77dae7de8dadb6df9d51222b3ac5091fc25b8dd642edf7dfa77ba98649effbff316f22af6340ae851793a29cd54bd5bfeb884eabc6bea49f96e0ec58ad598887
SSDEEP 6144:iIBDQKXZn5Pm3HOl5rBUGc2n+kLo+zamhB4zSQxpdhq7EIcmeOARIck:dV5PgOjrBpcgLoeRh9pD
TLSH
T125345B4677742CD8D9BBC0BCC6AACA46E7B138520B08DBEB469046976F03BD12D7E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Program Files\MiniTool Partition Wizard 13\imageformats\qsvg.dll
Size 31KB
SHA256 2aae1e9a9e910ead378889e5f9db669ec497d164d997e81612afac60ccb02c46
MD5 1014f8919ff8a28b5f834b8d0c462b28
SHA1 1d1fe59e497996f1688e993d8917cf6ab1bb3be0
SHA512 ca09812e5a0630459dad76f9c06bb62f3a99be340bd619f4db149905ba45a39313891bfda7af362d44540de6a6d7d4db7aa263ab74e79fc24a32f59d8ba4be3b
SSDEEP 384:S/GlIB/TGBHAXtK3yI7pJ355aCIjpQf+7gj1CP76yQUOusj18dPVziz/OEGNGb50:qGjlB7pJJkWmeSWyROui18pFi9riXiRE
TLSH
T1ECE23A9A9B3D5492E06396BCC9C64E27E473F4515B6287CF11A6834E2E6B3C13C3C34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtga.dll

Path C:\Program Files\MiniTool Partition Wizard 13\imageformats\qtga.dll
Size 30KB
SHA256 18e17b0ef4813d3b4571b9b03b28bd689693b1dcb84d5f689a833393165d5e54
MD5 3c5ca5a8c9ac8f6ef7d90e5d77f10bc8
SHA1 f2a21ae75e05a91d11ba64fa8afbec04d06c0473
SHA512 4d61ac4e29c58c58e03d5531050ed25f256c8fed34ace46811d912ddeab68176ad710af70c02d39e83c9f3829e941cb8cb20d9ac339235c205ea3208768bbc09
SSDEEP 384:YSsO/nXWx2Qj6PaGqHi4x051QZl0A+RwNivq4PlmOAswoAQVzizJ5GNGb5hiX8Zz:/34xQ1ZAHqqqmOAVoDFilDriXiRR
TLSH
T10EE24C9AAF385042E153867CCAC34A17D972F4A15F6287CF26B4838E5D6B3D22D78346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtiff.dll

Path C:\Program Files\MiniTool Partition Wizard 13\imageformats\qtiff.dll
Size 353KB
SHA256 ed02f3a1070d1696e663e03b43da0350fab36160f1f486a5d7448994ae1046f9
MD5 e2be460aa6ec66884db28140e2037312
SHA1 b0042775e540943ba160415bd060ee1d340a404b
SHA512 b28f9eeda258fb7579f8d1bc465303d1231771088587eea1a3829b1b90b6f2610338be79a6b5108285438782ac520981bdec430d395e80d38710202b89e8c509
SSDEEP 6144:d3S7Rc/frOvQod55Dopr37gPEO3OuosuEmb:diFc/frHojBopLM+N
TLSH
T1E0747105DED049ABD876813556E7C616F273B4893F02C78BA658B1343F427D029AB2FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwbmp.dll

Path C:\Program Files\MiniTool Partition Wizard 13\imageformats\qwbmp.dll
Size 29KB
SHA256 c9146916d2415cf514abe2d337e94e29231215f0d01b748741d5ba8f09faa239
MD5 aa0d9d5eae818c84384b614d7f376b35
SHA1 cc8e100d70b46ffc180dd75a245306cf8167ad02
SHA512 110fc91670d082bee645563722575e420ceee647f435470839836aba418af754a39efe10992dc16e9f995782c5de7d6bffd7dfbc2400b9d548aa9cc8fb5982eb
SSDEEP 768:c7vAMyTgFtx3LFBqPOAjOVKwFihriXiRl:0n7JYPOAjOIwFihWXif
TLSH
T16AD24C8A67299041D5B38674CAD78A23EAB2F0515B6347DF22B5C34E2E673C13E3C359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwebp.dll

Path C:\Program Files\MiniTool Partition Wizard 13\imageformats\qwebp.dll
Size 374KB
SHA256 58ccdf8d4e361b6d0d8847abbc959e6a42be03d8b5415e29773ffa2422e4f7d2
MD5 87982296888e36f944acb3e2cbcfa8f6
SHA1 312a03b7e7e2799b1e5a3ef2b0db9ec7b56b2c84
SHA512 23b52a2aa8c99979a719582ee5e62c34c93e2e362121c0968ac4a17b02ea5bb5ea534d153e7e2230c43025693281cb88ae4c56bddb66bae5220ef85d0d9b2c80
SSDEEP 6144:Yi4aChw8K+NxRgHEGoNAmk6IPcJF7w6MxY8S+qOu1m412w:YiAw8K+gOdk6IPcJF7w6
TLSH
T1B6847C4AF5562CC8C9AFC0788ABD551BF6B03C6C034196F716D4BE69AA33FD0563A702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Program Files\MiniTool Partition Wizard 13\libcurl.dll
Size 358KB
SHA256 9cb1fd31980b44e00701e41bfd40aa652a0899dc07f8633152f58bb6c4ae8a9e
MD5 dbde86ed37b7f08a332e2ad1e02cff55
SHA1 9ef3784264cabfb09b7921e0fead61693e749ccd
SHA512 b2bc64ac2df10e1015204153220dec9153abd9e6929ee369422424166fa1e14a5aa5bcbb3c2bb0fa8f6bff9e42c61f89953c6eab8e5e734d964ca511139c0a0b
SSDEEP 6144:HOShO5Syu62bo2Vwe2bhgB85plbIiuMjPlrc1nhR3PMXQ5lbx/l:HOAO5qbrVw+8Vb4MjNo1nhuUn
TLSH
T1EE747C86FBB418E6E5979038C5639607E2B2706D1350A3CF57B4CB692F23BE1763A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libeay32.dll

Path C:\Program Files\MiniTool Partition Wizard 13\libeay32.dll
Size 1.6MB
SHA256 835ed648baaa42517fc79c6c1325acf1b53a64f925bd64ef63408b053e981b00
MD5 4953909e4ae41c00760ad60600bc6e39
SHA1 95301766b9859b4df074c60195fd5b6b15c42ba3
SHA512 8f82fd11fd5c37d4b27f9969aa3c60b2209e271bf43436d7e20ecb14b250fcd3c9ba2e5a6554bb8d5635098f6e22046d8b3089c8d9c9679ad853a18cb272adde
SSDEEP 49152:MeHclOqxprXWiCc6yOge8VRz3irHAfP05:9526yReURTirHAS
TLSH
T11D756B12AB5815E6DABBC27894778627D3F1B45503B09BEF4B6D89B80F43BD9137A300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

partitionwizard.dll

Path C:\Program Files\MiniTool Partition Wizard 13\partitionwizard.dll
Size 8.0MB
SHA256 02ed32946ffa02f938107b9bff233b1e063f38762a553bd209f698b4e07e650d
MD5 7af58ab94a3077f8e6ef9547c146593f
SHA1 0a1fb266550315b76415d3c8bb54c8ee988c12aa
SHA512 e764805faf824c362d27b7db0c6b7c6a726b69aed2825239a514dbc2938c059a4f0a705a587070066aa52c7a0fd379c05542722e98c5cce1cbace57b88464423
SSDEEP 98304:cjVRLOy9OQtnn6k9uw+9fiQTiIZG9t7wingPivf:cjzLPXtnxuwIfDOIM9txGivf
TLSH
T1A886BE2FB65652A4D17AC138CAD75AE2C27171154F268EEB720ECB2D0F33BD5883D690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

partitionwizard.exe

Path C:\Program Files\MiniTool Partition Wizard 13\partitionwizard.exe
Size 268KB
SHA256 13a44ba07699e8bd18b6fc3af00e93234f90314616768eea01d73afb7845e1a8
MD5 616351cfc24b2eeef740ddc6f9ccb126
SHA1 f9e48198989b5625df602a80c1be5ccca774e080
SHA512 66f967c056b54a73ac1a892c1eab4645fe43877ee457ecc81286abc0d7a30bab13ed6479732c3d9fbf0ad7caecd728ef43674c6f5b004872e408494b77c68a74
SSDEEP 6144:eQSxqXfTwbWno+EDja9b6wKvWQX0MlheM4iYdXGWehI+lrxpUB:eQADgFU6QX0MlheM4iYdXGWehI+lrxpI
TLSH
T198445B86A65331D6C8758C3DDD924F4997353C3F026A678B018056AB4F37A97EE3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files\MiniTool Partition Wizard 13\platforms\qwindows.dll
Size 1.2MB
SHA256 d3f3f1eea7662a928cea0d9029d83e8b6a23a24d641056c3575e4b2d33b05bd1
MD5 9608d1a7416a2534dee37613fb8bcb35
SHA1 c6dac2916d5740a406e784d035f7dee3e6ddb971
SHA512 11fbd7751abd89354383645666a70a6ceb37ec005eb064b5307101823d900073f82631f95201cbc81b4a965f1ca2f5c180b9779778ac09bd5fc6a851ae405e0c
SSDEEP 24576:pX7MVFVym740j81K8w8P2xQuUjvkp+dBZrEL:l7MzVy50qK8seuUQp+K
TLSH
T157457C83B3A582A5D16BD238C65B870ED7B1701413319BEB51A4CF496F23BE3263E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt.conf

Path C:\Program Files\MiniTool Partition Wizard 13\qt.conf
Size 46B
SHA256 3e25ea931f3228cae2b0138b66aeddb90cf73e93c108621e431c89c87f3fd594
MD5 ed54ff3a93486892b6a41c877df944d8
SHA1 c9a359103ff7bd26b4a74daeef24476e3fb95232
SHA512 5821dfaf8a09fb2783b9b670fd984d07af8bbbc5e219aa73b8187b052b947475cda2cc59cdfd2556ad1805ee5081323749a3f196a397ffbf641846a302be98d9
MD5 SHA1 SHA512

Submit Download

updatechecker.exe

Path C:\Program Files\MiniTool Partition Wizard 13\updatechecker.exe
Size 178KB
SHA256 52dc9a1db1bb3dc1e85a7bb3052bf58b76ea7a9d1ade5e2e5e1a5f6f7a8e227a
MD5 9bb4bf53c8f0a399bf34e5c512a01243
SHA1 0eb3e2cf494a8d150ee071e12c063b937dbbdb53
SHA512 0db2ef8b834aa46baa609d48480ef4e880af528b1c363caa27597618c65ac587ac1512fa81f63ecbe15d57e529cca8e957a4cf61575f124877ba14c9e526c370
SSDEEP 3072:0aWxsktzTzHBRDhTKwnqqnWG+8JLBFY2O4e31lB:1WRzLDBKRINFY2O4ed
TLSH
T11804495736A442D5C167C138C9894916F2B770918B228BEF5229CE7A1F336E2FE3C745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwfree-64bit-online.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-Q5B2J.tmp\pwfree-64bit-online.tmp
Size 3.3MB
SHA256 87732995a2014ed992b63c820b765dc32ecb0376722f9505a1104e221d92d175
MD5 be377936d370a4947fbe57e7393ebacd
SHA1 c4e2c86a961c9adfeac20f91da375db6fdf341ce
SHA512 65b3fc2f71bf7a85ba22d4922197494ba35094132913343028f7503a06ae777ebc4a1192bf74d3e6e5a14508f9b8a28e40adb7bba3f4af11bd64ea834ac25c4e
SSDEEP 49152:Qdx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjv333L991R6njD:NHDYsqiPRhINnq95FoHVBv333L991Ynf
TLSH
T16FF54C17F389723ED46B1B7656338550983BBA216913CCA7A7F8394C8E3D4902E3E647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-402-0x00000000727D0000-0x0000000072D1A000-memory.dmp

Download

memory/4260-414-0x00000000727D0000-0x0000000072D1A000-memory.dmp

Download

memory/4260-438-0x00007FFA72CE0000-0x00007FFA734EF000-memory.dmp

Download

memory/4652-0-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/4652-417-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/4652-7-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/5036-416-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5036-404-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5036-9-0x0000000002710000-0x0000000002711000-memory.dmp

Download

memory/5036-8-0x0000000000400000-0x0000000000760000-memory.dmp

Download

memory/5036-5-0x0000000002710000-0x0000000002711000-memory.dmp

Download