File name:

pw1203-free-online.exe

Full analysis: https://app.any.run/tasks/1b4e4bf7-39da-4395-8577-702841d76005
Verdict: Malicious activity
Analysis date: May 22, 2021, 20:11:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

937A27464DD8E23E00037B39F107FCAF

SHA1:

DB3E7306DF759213C79732E108E7301BB2D14949

SHA256:

E9EE5199A9CB099E9C7FFD548312FC9AE366781F6EE17E7C64FDE178BC6B279D

SSDEEP:

49152:qv991R6nJbf+IVLTccdhCBEm1W1XmDytJwXqSv01uXGrCZZD86:u991YnJbfnLTccGamL2t6Quj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • pwfree1203-32bit-online-package.tmp (PID: 2516)
      • pwfree1203-32bit-online-package.exe (PID: 1936)
      • pw1203-free-online.exe (PID: 3760)

    • Changes the autorun value in the registry

      • pwfree1203-32bit-online-package.tmp (PID: 2516)

    • Loads dropped or rewritten executable

      • experience.exe (PID: 536)
      • updatechecker.exe (PID: 2240)
      • partitionwizard.exe (PID: 3844)

    • Application was dropped or rewritten from another process

      • pwfree1203-32bit-online-package.exe (PID: 1936)
      • experience.exe (PID: 536)
      • partitionwizard.exe (PID: 3844)
      • updatechecker.exe (PID: 2240)

    • Loads the Task Scheduler COM API

      • updatechecker.exe (PID: 2240)

    • Changes settings of System certificates

      • experience.exe (PID: 536)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • pw1203-free-online.exe (PID: 2492)
      • pwfree1203-32bit-online-package.exe (PID: 1936)
      • pw1203-free-online.tmp (PID: 564)
      • SmDownloader.exe (PID: 2748)
      • pwfree1203-32bit-online-package.tmp (PID: 2516)
      • pw1203-free-online.exe (PID: 3760)
      • partitionwizard.exe (PID: 3844)

    • Reads Windows owner or organization settings

      • pw1203-free-online.tmp (PID: 564)
      • pwfree1203-32bit-online-package.tmp (PID: 2516)

    • Drops a file that was compiled in debug mode

      • pw1203-free-online.tmp (PID: 564)
      • pwfree1203-32bit-online-package.tmp (PID: 2516)
      • partitionwizard.exe (PID: 3844)

    • Reads the Windows organization settings

      • pw1203-free-online.tmp (PID: 564)
      • pwfree1203-32bit-online-package.tmp (PID: 2516)

    • Creates a directory in Program Files

      • pwfree1203-32bit-online-package.tmp (PID: 2516)
      • partitionwizard.exe (PID: 3844)

    • Drops a file with too old compile date

      • pwfree1203-32bit-online-package.tmp (PID: 2516)

    • Changes IE settings (feature browser emulation)

      • pw1203-free-online.tmp (PID: 564)
      • partitionwizard.exe (PID: 3844)

    • Reads internet explorer settings

      • experience.exe (PID: 536)
      • partitionwizard.exe (PID: 3844)

    • Starts Internet Explorer

      • pw1203-free-online.tmp (PID: 564)

    • Executed via COM

      • vdsldr.exe (PID: 1080)

    • Creates files in the program directory

      • partitionwizard.exe (PID: 3844)

    • Creates files in the user directory

      • experience.exe (PID: 536)
      • partitionwizard.exe (PID: 3844)

    • Adds / modifies Windows certificates

      • experience.exe (PID: 536)

    • Executed as Windows Service

      • vds.exe (PID: 928)

    • Creates files in the Windows directory

      • partitionwizard.exe (PID: 3844)

    • Low-level read access rights to disk partition

      • vds.exe (PID: 928)

  • INFO

    • Application was dropped or rewritten from another process

      • SmDownloader.exe (PID: 2748)
      • pw1203-free-online.tmp (PID: 564)
      • pw1203-free-online.tmp (PID: 3856)
      • pwfree1203-32bit-online-package.tmp (PID: 2516)

    • Loads dropped or rewritten executable

      • SmDownloader.exe (PID: 2748)

    • Dropped object may contain Bitcoin addresses

      • pwfree1203-32bit-online-package.tmp (PID: 2516)

    • Creates a software uninstall entry

      • pwfree1203-32bit-online-package.tmp (PID: 2516)

    • Creates files in the program directory

      • pw1203-free-online.tmp (PID: 564)
      • pwfree1203-32bit-online-package.tmp (PID: 2516)

    • Changes internet zones settings

      • iexplore.exe (PID: 3728)

    • Application launched itself

      • iexplore.exe (PID: 3728)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2948)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2948)
      • partitionwizard.exe (PID: 3844)
      • iexplore.exe (PID: 3728)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2948)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2948)

    • Creates files in the user directory

      • iexplore.exe (PID: 2948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (57.2)
.exe | Win32 Executable (generic) (18.2)
.exe | Win16/32 Executable Delphi generic (8.3)
.exe | Generic Win/DOS Executable (8)
.exe | DOS Executable Generic (8)

EXIF

EXE

ProductVersion: 12.3
ProductName: MiniTool Partition Wizard Free
LegalCopyright: Copyright © 2021 MiniTool Software Limited, all rights reserved.
FileVersion: 12.3
FileDescription: MiniTool Partition Wizard Free Setup
CompanyName: MiniTool Software Limited
Comments: This installation was built with Inno Setup.
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 12.3.0.0
FileVersionNumber: 12.3.0.0
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: 6
OSVersion: 5
EntryPoint: 0x1181c
UninitializedDataSize: -
InitializedDataSize: 421376
CodeSize: 66560
LinkerVersion: 2.25
PEType: PE32
TimeStamp: 2018:06:14 15:27:46+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 14-Jun-2018 13:27:46
Detected languages:
  • English - United States
Comments: This installation was built with Inno Setup.
CompanyName: MiniTool Software Limited
FileDescription: MiniTool Partition Wizard Free Setup
FileVersion: 12.3
LegalCopyright: Copyright © 2021 MiniTool Software Limited, all rights reserved.
ProductName: MiniTool Partition Wizard Free
ProductVersion: 12.3

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 14-Jun-2018 13:27:46
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000F25C
0x0000F400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.37588
.itext
0x00011000
0x00000FA4
0x00001000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.77877
.data
0x00012000
0x00000C8C
0x00000E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.30283
.bss
0x00013000
0x000056BC
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00019000
0x00000E04
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.59781
.tls
0x0001A000
0x00000008
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x0001B000
0x00000018
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.204488
.rsrc
0x0001C000
0x00064DCC
0x00064E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.38508

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.13965
1580
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.55736
67624
Latin 1 / Western European
English - United States
RT_ICON
3
5.97225
16936
Latin 1 / Western European
English - United States
RT_ICON
4
6.10067
9640
Latin 1 / Western European
English - United States
RT_ICON
5
6.46005
4264
Latin 1 / Western European
English - United States
RT_ICON
6
6.69877
2440
Latin 1 / Western European
English - United States
RT_ICON
7
6.26844
1128
Latin 1 / Western European
English - United States
RT_ICON
4091
2.56031
104
Latin 1 / Western European
UNKNOWN
RT_STRING
4092
3.25287
212
Latin 1 / Western European
UNKNOWN
RT_STRING
4093
3.26919
164
Latin 1 / Western European
UNKNOWN
RT_STRING

Imports

advapi32.dll
comctl32.dll
kernel32.dll
oleaut32.dll
user32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
14
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start pw1203-free-online.exe pw1203-free-online.tmp no specs pw1203-free-online.exe pw1203-free-online.tmp smdownloader.exe pwfree1203-32bit-online-package.exe pwfree1203-32bit-online-package.tmp updatechecker.exe no specs experience.exe iexplore.exe partitionwizard.exe vdsldr.exe no specs vds.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Program Files\MiniTool Partition Wizard 12\experience.exe" http://tracking.minitool.com/pw/installation.php?from=pwfree12C:\Program Files\MiniTool Partition Wizard 12\experience.exe
pw1203-free-online.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\minitool partition wizard 12\experience.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\minitool partition wizard 12\qt5widgets.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
564"C:\Users\admin\AppData\Local\Temp\is-CEFLP.tmp\pw1203-free-online.tmp" /SL5="$C0150,1610513,488960,C:\Users\admin\AppData\Local\Temp\pw1203-free-online.exe" /SPAWNWND=$8017C /NOTIFYWND=$601A0 C:\Users\admin\AppData\Local\Temp\is-CEFLP.tmp\pw1203-free-online.tmp
pw1203-free-online.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ceflp.tmp\pw1203-free-online.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
928C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vds.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
1080C:\Windows\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
1936C:\Users\admin\AppData\Local\Temp\pwfree1203-32bit-online-package.exe /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12" /LANG=englishC:\Users\admin\AppData\Local\Temp\pwfree1203-32bit-online-package.exe
SmDownloader.exe
User:
admin
Company:
MiniTool Software Limited
Integrity Level:
HIGH
Description:
MiniTool Partition Wizard Free Setup
Exit code:
0
Version:
12
Modules
Images
c:\users\admin\appdata\local\temp\pwfree1203-32bit-online-package.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2240"C:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe" /createtaskC:\Program Files\MiniTool Partition Wizard 12\updatechecker.exe—pwfree1203-32bit-online-package.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\minitool partition wizard 12\updatechecker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\minitool partition wizard 12\qt5core.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2492"C:\Users\admin\AppData\Local\Temp\pw1203-free-online.exe" C:\Users\admin\AppData\Local\Temp\pw1203-free-online.exe
explorer.exe
User:
admin
Company:
MiniTool Software Limited
Integrity Level:
MEDIUM
Description:
MiniTool Partition Wizard Free Setup
Exit code:
0
Version:
12.3
Modules
Images
c:\users\admin\appdata\local\temp\pw1203-free-online.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2516"C:\Users\admin\AppData\Local\Temp\is-FOBLF.tmp\pwfree1203-32bit-online-package.tmp" /SL5="$2015E,16413545,488960,C:\Users\admin\AppData\Local\Temp\pwfree1203-32bit-online-package.exe" /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12" /LANG=englishC:\Users\admin\AppData\Local\Temp\is-FOBLF.tmp\pwfree1203-32bit-online-package.tmp
pwfree1203-32bit-online-package.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-foblf.tmp\pwfree1203-32bit-online-package.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2748"C:\Users\admin\AppData\Local\Temp\is-8A1KI.tmp\SmDownloader.exe" /HWND:393646 /PATH:"C:\Program Files\MiniTool Partition Wizard 12" /URL:https://www.partitionwizard.com/download/online-setup-config/pwfree-v12.ini /VERYSILENT /USERMSG:1450 /LANG:englishC:\Users\admin\AppData\Local\Temp\is-8A1KI.tmp\SmDownloader.exe
pw1203-free-online.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\is-8a1ki.tmp\smdownloader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\is-8a1ki.tmp\libcurl.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wldap32.dll
2948"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3728 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
2 119
Read events
1 900
Write events
208
Delete events
11

Modification events

(PID) Process:(564) pw1203-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
3402000003EBE9C3464FD701
(PID) Process:(564) pw1203-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
2C1EBD230C108E6CF0A03774E485554571CBFB6730CE2F3BBAF97C04AD5F2E1D
(PID) Process:(564) pw1203-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(564) pw1203-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(564) pw1203-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2516) pwfree1203-32bit-online-package.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
D4090000D99122D2464FD701
(PID) Process:(2516) pwfree1203-32bit-online-package.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
A7DF6D0067C4062855EC8F0D8582DE2832702C6CDD67CFFE76D5F118F1BBEB79
(PID) Process:(2516) pwfree1203-32bit-online-package.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(2516) pwfree1203-32bit-online-package.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:writeName:RegFiles0000
Value:
C:\Program Files\MiniTool Partition Wizard 12\7-zip.dll
(PID) Process:(2516) pwfree1203-32bit-online-package.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:writeName:RegFilesHash
Value:
8F00822418225065FB317EB8974E4B14034DA6AD4FE58D5DC30F661F188485FE
Executable files
89
Suspicious files
40
Text files
65
Unknown types
83

Dropped files

PID
Process
Filename
Type
2516pwfree1203-32bit-online-package.tmpC:\Program Files\MiniTool Partition Wizard 12\is-SUNVJ.tmp —
MD5:—
SHA256:—
2516pwfree1203-32bit-online-package.tmpC:\Program Files\MiniTool Partition Wizard 12\is-2FME4.tmp —
MD5:—
SHA256:—
2516pwfree1203-32bit-online-package.tmpC:\Program Files\MiniTool Partition Wizard 12\is-OKL01.tmp —
MD5:—
SHA256:—
2516pwfree1203-32bit-online-package.tmpC:\Program Files\MiniTool Partition Wizard 12\is-FFL7R.tmp —
MD5:—
SHA256:—
2516pwfree1203-32bit-online-package.tmpC:\Program Files\MiniTool Partition Wizard 12\is-3O3M5.tmp —
MD5:—
SHA256:—
2516pwfree1203-32bit-online-package.tmpC:\Program Files\MiniTool Partition Wizard 12\is-ROM1U.tmp —
MD5:—
SHA256:—
2516pwfree1203-32bit-online-package.tmpC:\Program Files\MiniTool Partition Wizard 12\is-3NCI5.tmp —
MD5:—
SHA256:—
2516pwfree1203-32bit-online-package.tmpC:\Program Files\MiniTool Partition Wizard 12\is-UPADH.tmp —
MD5:—
SHA256:—
2516pwfree1203-32bit-online-package.tmpC:\Program Files\MiniTool Partition Wizard 12\is-1VA9H.tmp —
MD5:—
SHA256:—
2492pw1203-free-online.exeC:\Users\admin\AppData\Local\Temp\is-6EJD1.tmp\pw1203-free-online.tmpexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
66
DNS requests
24
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
536
experience.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGYrFLnpiw0%2FCgAAAADOSq0%3D
US
der
471 b
whitelisted
2948
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2948
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2948
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2948
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2948
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAGpGO85yE2IjS7H9cUAMYU%3D
US
der
471 b
whitelisted
536
experience.exe
GET
200
104.18.20.178:80
http://tracking.minitool.com/pw/installation.html?from=pwfree12
US
html
321 b
suspicious
536
experience.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2948
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEEf1RANFzZlQBQAAAACHy0o%3D
US
der
471 b
whitelisted
2948
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2748
SmDownloader.exe
104.18.21.178:443
cdn2.minitool.com
Cloudflare Inc
US
unknown
2748
SmDownloader.exe
104.20.7.9:443
www.partitionwizard.com
Cloudflare Inc
US
shared
536
experience.exe
104.18.20.178:80
cdn2.minitool.com
Cloudflare Inc
US
unknown
536
experience.exe
142.250.185.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
536
experience.exe
216.58.212.136:443
www.googletagmanager.com
Google Inc.
US
whitelisted
2948
iexplore.exe
216.58.212.136:443
www.googletagmanager.com
Google Inc.
US
whitelisted
2948
iexplore.exe
13.107.246.45:443
www.clarity.ms
Microsoft Corporation
US
malicious
2948
iexplore.exe
185.60.216.19:443
connect.facebook.net
Facebook, Inc.
IE
whitelisted
2948
iexplore.exe
66.102.1.154:443
stats.g.doubleclick.net
Google Inc.
US
whitelisted
2948
iexplore.exe
204.79.197.200:443
bat.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.partitionwizard.com
  • 104.20.7.9
  • 104.20.6.9
suspicious
cdn2.minitool.com
  • 104.18.21.178
  • 104.18.20.178
suspicious
tracking.minitool.com
  • 104.18.20.178
  • 104.18.21.178
suspicious
www.googletagmanager.com
  • 216.58.212.136
whitelisted
ocsp.pki.goog
  • 142.250.185.99
whitelisted
www.google-analytics.com
  • 142.250.185.206
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
script.crazyegg.com
  • 104.19.148.8
  • 104.19.147.8
whitelisted
connect.facebook.net
  • 185.60.216.19
whitelisted

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
1052
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pw1203-free-online.exe