hxxps://drive[.]google[.]com/file/d/1bEZOjFIF2w3W9CBd3Q3o2NQL4H488Nh7/view

Analysis

max time kernel
147s
max time network
270s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1bEZOjFIF2w3W9CBd3Q3o2NQL4H488Nh7/view

Score

7^/10

discovery evasion trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	EasyBCD2.4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	EasyBCD.exe

Executes dropped EXE 7 IoCs

pid	Process
4860	EasyBCD2.4.exe
4640	EasyBCD.exe
1456	EasyBCD.exe
2332	UtfRedirect.exe
2368	bootgrabber.exe
640	bootgrabber.exe
3844	bcdedit.exe

Loads dropped DLL 2 IoCs

pid	Process
4860	EasyBCD2.4.exe
4860	EasyBCD2.4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EasyBCD.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	drive.google.com
12	drive.google.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ca\EasyBCD.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\el\ProgressDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\he\LicenseDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\he\MainUI.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\hu\DefragDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\udefrag.exe	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ca\ProgressDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\el\AboutBox.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\es\DriveSelect.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\es\EasyBCD.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\pl\LicenseDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\sl\MainUI.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\sv\MainUI.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\tr\BcdLibrary.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\tr\EasyBCD.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ar\OptionsDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\bg\ProgressDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\bg\SdiMaker.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\EasyRE.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\fr\MainUI.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\it\MainUI.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ko\AboutBox.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ko\DriveSelect.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\sl\OptionsDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\uk\LanguageDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\uk\OptionsDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\zh-CHS\OptionsDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\he\AboutBox.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\sl\LanguageDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ar\EasyBCD.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ar\LicenseDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\de\LanguageDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\el\DonationDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\properties.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\fr\properties.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\it\DonationDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\sl\LicenseDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\uk\DonationDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\bg\DefragDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\el\LanguageDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\pt\BcdLibrary.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ar\DefragDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\bg\OptionsDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\el\properties.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\es\OptionsDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\hu\AboutBox.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\sv\LanguageDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\profiles\NeoSmart.bcd	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ca\OptionsDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\pt\properties.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\sl\DefragDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\Newtonsoft.Json.dll	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\profiles\detect	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\el\OptionsDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\pt\AboutBox.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\sl\ProgressDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\sv\SdiMaker.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\uk\LicenseDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\udefrag.dll	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\fr\ProgressDialog.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\pl\SdiMaker.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\pt\MainUI.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\zh-TW\SdiMaker.xml	EasyBCD2.4.exe
File created	C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ca\AboutBox.xml	EasyBCD2.4.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EasyBCD2.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UtfRedirect.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootgrabber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcdedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootgrabber.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0009000000023d31-144.dat	nsis_installer_1
behavioral1/files/0x0009000000023d31-144.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1224	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	EasyBCD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	EasyBCD.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	EasyBCD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	EasyBCD.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 198853.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
4212	msedge.exe
4212	msedge.exe
5088	identity_helper.exe
5088	identity_helper.exe
3988	msedge.exe
3988	msedge.exe
4868	taskmgr.exe
4868	taskmgr.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	4868	taskmgr.exe
Token: SeSystemProfilePrivilege	4868	taskmgr.exe
Token: SeCreateGlobalPrivilege	4868	taskmgr.exe
Token: SeDebugPrivilege	4640	EasyBCD.exe
Token: 33	4640	EasyBCD.exe
Token: SeIncBasePriorityPrivilege	4640	EasyBCD.exe
Token: 33	4868	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4868	taskmgr.exe
Token: SeDebugPrivilege	1456	EasyBCD.exe
Token: 33	1456	EasyBCD.exe
Token: SeIncBasePriorityPrivilege	1456	EasyBCD.exe
Token: 33	4640	EasyBCD.exe
Token: SeIncBasePriorityPrivilege	4640	EasyBCD.exe
Token: 33	4640	EasyBCD.exe
Token: SeIncBasePriorityPrivilege	4640	EasyBCD.exe
Token: SeBackupPrivilege	3844	bcdedit.exe
Token: SeRestorePrivilege	3844	bcdedit.exe
Token: SeRestorePrivilege	3844	bcdedit.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe
4868	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4860	EasyBCD2.4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 2216	4212	msedge.exe	85
PID 4212 wrote to memory of 2216	4212	msedge.exe	85
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1404	4212	msedge.exe	87
PID 4212 wrote to memory of 1412	4212	msedge.exe	88
PID 4212 wrote to memory of 1412	4212	msedge.exe	88
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89
PID 4212 wrote to memory of 2132	4212	msedge.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1bEZOjFIF2w3W9CBd3Q3o2NQL4H488Nh7/view
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc634746f8,0x7ffc63474708,0x7ffc63474718
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1736 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Users\Admin\Downloads\EasyBCD2.4.exe
  "C:\Users\Admin\Downloads\EasyBCD2.4.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4860
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im easybcd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1224
- - C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\EasyBCD.exe
    "C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\EasyBCD.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies Internet Explorer settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
  - - C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\bootgrabber.exe
      "C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\bootgrabber.exe" /tlist
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2368
  - - C:\Windows\System32\msfeedssync.exe
      "C:\Windows\System32\msfeedssync.exe" forcesync
      4⤵
      PID:2128
  - - C:\Windows\system32\msfeedssync.exe
      msfeedssync.exe sync
      4⤵
      PID:1564
  - - C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\UtfRedirect.exe
      "C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\UtfRedirect.exe"
      4⤵
      PID:4720
    - - C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\bcdedit.exe
        
        "C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\bcdedit.exe" /enum all
        5⤵
        
        PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5432 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6642389567797738320,20596027065409772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1232 /prefetch:1
  2⤵
  PID:4780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:828

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4868

C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\EasyBCD.exe
"C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\EasyBCD.exe"
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1456
- C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\UtfRedirect.exe
  "C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\UtfRedirect.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2332
- - C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\bcdedit.exe
    "C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\bcdedit.exe" /export "C:\Users\Admin\Documents\EasyBCD Backup (2024-11-06).bcd"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\bootgrabber.exe
  "C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\bootgrabber.exe" /tlist
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:640
- C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\UtfRedirect.exe
  "C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\UtfRedirect.exe"
  2⤵
  PID:3780
- - C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\bcdedit.exe
    "C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\bcdedit.exe" /enum all
    3⤵
    PID:820

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:664

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\90392d8f269d4222b394016f99a101a9 /t 2864 /p 3560
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\EasyBCD.exe

Filesize
965KB

MD5
e478c92160a3c73c77cdc9f515dfd8b0

SHA1
f0fa230f8c26bcbddc3b68f38ce0793d46c0ca2b

SHA256
6a6e16c176004128b918ef3f9ecf1d51d828e6099fba6542b5ac6abdb67c1030

SHA512
3682b4f5bc31cd056c3f552da657309093e35b4757c073a223385c04765f622ce9ee000fb5dbc950c68ad7913ffdcc831ef65bd5ed7241f6179ea375b17be822

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\EasyBCD.exe.config

Filesize
330B

MD5
3379ac7243adcfa51a02295dbedc956a

SHA1
469bbae4b1844832809196c89f198029beef4af8

SHA256
7ec2512b59e62a3aeb0a1025bf152a31291e17e7e469ce18efae153064665b03

SHA512
08d7101b21b87e11aff79cd8b47ec3ba2878cf72406e4d59771531ce6098609f8340607cd8b9ae0721c56f8fba5927c93f0412f0042879f04f2cd223d82430a4

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\NeoSmart.Localization.dll

Filesize
25KB

MD5
ad0a59ae87d4ba106e965c62f0bc3d88

SHA1
5b39b6fd95b5bee72a17d79a1f4958256a5c4149

SHA256
3a56005b2efb34620019ef432fe90eeb63726fc78b37be841f25c2aed82eb1db

SHA512
562b2cbd3fdbbb71dee9fdb68bd24b9bbf27beab93de338a616baec837910f31ad3b13d75564d45a1cca26e1150517b47d0b3984bae7d08675593bde22bbea98

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\BootGrabber.exe

Filesize
183KB

MD5
2e12b37d32c8bcf8920f5ebb6d24a6b9

SHA1
7fcd9e4ebfa2c400d6340133440c087e56a3c9e6

SHA256
f9842333f0b562b4ab5349a09fc173b0b2971c1f600502c4284781c78a735d7e

SHA512
aa82f1ed984174a1b5a610eb28a422da6172dd027678d9d4b7a9714e85e050616403ad294a005ad1ab39032758a4d2fd8d498b1241dedda8c91698ffc7d3c527

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\bin\UtfRedirect.exe

Filesize
189KB

MD5
5b40791899fa37507e7c08bc3d9f5294

SHA1
cb98852ec22251b5124507427d05b3dfe7ec53a7

SHA256
5a87d9485f6e13ee2c3ba4ac289a3e237d17a43ed428b8a5bd5f00fc4800d1ac

SHA512
d2c0de00943d7e9961571a8e798688e46a8e7267086e15abaae8abca0fa7aedd02d5df3c5eb3dc6cfab0c5982694129bf5b9c0cb5d8e978fec0d76d54e441390

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ar\properties.xml

Filesize
186B

MD5
89159f29003c36dd7da4161c42606347

SHA1
a448050ecdedeefa12c6032b3792a3369d30043b

SHA256
2a205ea793f84bac49dc3549c87f606591b44a283d49aae70c69eb646b3ee6ca

SHA512
e77d668184175639b0d201e23a9c5b1d763ace339b2bf8ac614c0dc35775dff813a7e89a805c1f98766eb9714f2fc02a156c9dede59240cdb9e20f1254f7a2ea

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\bg\properties.xml

Filesize
199B

MD5
9ccb633ed2044b5b67261312a0a3c056

SHA1
bb248410b363f746ae0f89115a9d512b9e98c1c6

SHA256
38370820738b34c81dcfa498434eb54ed7ed10505373ecb0edd94fc4f2f0d6b7

SHA512
9c36312b83eeb13138dd7b1149891c7d89eaa8acb8679ee64ebb2c2dd6522acdaa324908752cc142230a2b4e6039cadc06d676e7e5f35a9b867dc96805cae1c3

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ca\properties.xml

Filesize
180B

MD5
a714b71a9f9690f25fec26951c951232

SHA1
e2a79fdc13419e137491664e0acc1d86a26da767

SHA256
afcdcd139142fba46181c44816b445fb91e4533428e2b72b0ede4374339f66d8

SHA512
8f4d255987bd5923ae06f3d1d29c11c2a18a210cf534565d9b007b6c3b7b720f759c41314be569a03611d50ac6749c88f86bb0250d6352d7b6130992e531e8e4

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\cs\properties.xml

Filesize
189B

MD5
1c7cfba3f2a05a270627e03f25cb3e1a

SHA1
9a93327622db15072e118473a64bb9cc3ff11a4e

SHA256
b6e322d269da30367d4d77d70c875b8464c95088198fe2ada099aa6022fc4fa8

SHA512
9d400661ece761212186f65483533326591c815067c97f6df63ac5965002b166dd552f7b39c4da45a73b5d5a91c2e575525470404302e4c8a9cf0d89bb4dc24b

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\de\properties.xml

Filesize
180B

MD5
a58b4498c7db23672183262ce985ddd8

SHA1
59de71ea9d33f527478d80e6b601c4d2862d7451

SHA256
13a47f469be7b0b173ba78b874f17a2230281f4768431407670b5cfb06516a2a

SHA512
81953e927188ce06230af4ebb3b031e2661aefa3da6d3d49f5c3e8d6c6bc39fe1cbbcd818f330fec2ec29e4edea0aaa7ed72b7c04d0cc8dd78c3626896323b2b

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\el\properties.xml

Filesize
189B

MD5
81801a5b8c97d1dd05b2459856c81f67

SHA1
d7be95901b44e5314b596551650b41576f390c67

SHA256
aea9feaa58af7d1bf8ca98ed578ad36201eec5f7600b74eb7b04e832ad312be9

SHA512
73fef24de419b5a5df7fe852a4ae4e71686129e1fa16ed61747a77ce89d60cee884707d82d5c38ad817253db1fd7aeaf50d76e89a6774ed1071ad77aae2648ce

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\AboutBox.xml

Filesize
1KB

MD5
57c22bc804349d6b4c292e5e6fac5883

SHA1
4fbf2329b8db7273c2cac2159ef7e021abfc7d02

SHA256
d1e45ca02de4d82c4abf4200487a3f9b759239cbc671b8f17fb21969b1c1ad6b

SHA512
b7edc55696746049c59d29d3af3cf029b3e9f21c1ad0024ed5421ee32f55d2a9f4d713a272e8a8b2ea359fa649e4451be911037a6e84dbb7ba3e3fcbad04ac5a

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\BcdLibrary.xml

Filesize
2KB

MD5
9b4be1d3d51da52e41e2a21fec4c97fd

SHA1
df4b2426d3f96e2ca9d59b3de0c98718990be442

SHA256
5b94b2efbf3ca74dc78dcf49c6c521cd6ff823d5ad238226a400e5e5a8e4b0fc

SHA512
6e8fdf99a0998253aa8a6e45dea72cdb07065d914d79847344a6527635fdb103d8bf5be1500c49927e2569f815ada88494e8725cf2102a384110f8c6b8d8a3f8

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\DefragDialog.xml

Filesize
329B

MD5
314b52187045ec5cb47d3270286cf1a8

SHA1
354e0faca02392bb1e3bc188127fa39dbf81e95b

SHA256
19a4765488f7574ff0fe54ee538df47968b3614f716369e2874a31735c007620

SHA512
768173d405d0e6d271216fe81e856a3f3bd9af830d4a96721cb8098dccac49ceb7c532afb8baa1d74ca5f951b8f02b3e0aeac83a1ab0ff790c9ded6eb8ed5b07

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\DonationDialog.xml

Filesize
1KB

MD5
96d0729ab37766f2a749d6fb4f594936

SHA1
4d6239e47562df05b45f5b9e38a111317b623f1b

SHA256
7ebf9f1dce431c3ecc61f398751338517b2b6f7bac9a289f6232e26c663dc391

SHA512
bb3736acc931f5f99879c81cd8640e6f35815cce9becf666e14e706bcef57eac611efa1b850919c1fc4a4ca47d93e52a2b5eba1d32cc2fe55be792bf2e57389e

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\DriveSelect.xml

Filesize
997B

MD5
e2fdc84096a9b2e5a9927070021c48de

SHA1
11d1ef6208b3ece6f3f280efd1ae2b55f55d1c82

SHA256
2f5186a8f12d42176de86d4962b5dbb6ddd9071d2f5d1cdc51eb2f124c6a50ac

SHA512
2bad387cccb4938b91272ef495dad91a7fdaee327d69959075217f00ecd3d11e9a9feca68c3c47957dd50d02049aefebedc8e9a8628a02643e0c753f9406cf09

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\EasyBCD.xml

Filesize
18KB

MD5
6d85acdb10090c82a8ef6587c9dbb7c9

SHA1
4154908d0a05d93531eab09853c2053455456754

SHA256
a941b2c1fdd614e5145161aadb56c0f5dae4836bfd6b29018bf6d5fb99280aac

SHA512
dc261dfe778240913775389c687159e86d3ec1bcc3f8593ce76145c2b9185fa52e75fb8dbdd255085e313e8f860c25c578b1967c8d8cfe82b57fa8246bbd5527

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\EasyRE.xml

Filesize
1KB

MD5
c33d9d4eae1c16fb973a1ff94dc759f2

SHA1
baa4871b1222c4ee140589d024af321ae9b3f11c

SHA256
daed6dc83fb3c08023cce6728b7c60b30174a00fdea7f97af65d04c34c5880a5

SHA512
ae492299285e085d00c6eeaf8d2c3971183267c8e223384349f7fc92616645bf34882ff3675a6baab0d451778cddfca11224df4ca695d46d3fb4dd3139f24485

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\LanguageDialog.xml

Filesize
399B

MD5
928d365e6227dd6858ed623b28e21158

SHA1
85305451574575ab97141cf844c5ebcb60a6895b

SHA256
96c6c5effb537c5fdb8b3b8f907fef21bdb3eeaee6a4c6ff12f064bef342d209

SHA512
7d092bc0dfe2bedb7fb84e7ab56500bfb143c15b2baacbd001e06c6d36d43fe216ee5e68a8e328a64f5668be319dcf6b8e8b448b50953305ebeead7c05727295

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\LicenseDialog.xml

Filesize
1KB

MD5
0fee3c196f488b5e0628989fda34c0df

SHA1
c41d95d996896769a6a745eac25802089b9963d8

SHA256
33f23516c1853a17e41edc603d860b8ead64cb1bdb9c27925629282166a539d2

SHA512
829b1948407d92036aee161d410606e79c23c7c477d874119c849bcb2004a44beff74f5cae881686e286e28dd134f85ad9b44a73e6adad61f6126ab52315f1d3

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\MainUI.xml

Filesize
12KB

MD5
e9f36537dfe6333eb2affc5fd010e290

SHA1
8eb2c560ec375830b3b699c65b8b9b8c68fe9014

SHA256
eedfe23ab06b57b87774a19b5e4b8b5d7d59169b1a978197a28ffb7b7d46399b

SHA512
213b7fc186b8bc9400bd6bb78c97a4ac23279d33317ca684e076706ab3ed5801cc6830f7cdafb018e0a5e1fe42a36c73cbc55162fddc3a5de988cc733ff96241

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\OptionsDialog.xml

Filesize
2KB

MD5
2175b75eec134dd2beae5c64465835af

SHA1
8b20b04f63fd4b5fd35b1c6e0500bfd741ebd85f

SHA256
299f7cc883e64e72b093a8be83da0627d8fc87206d8b0f6a360200e8f9d85823

SHA512
95fa08e628b5b3ed5fd415e2e83e01c9956da18b37efe5c9f9e9a5874c1730df1177ed5cd01481105a33da77fd6e8601a57f36dad4a57b7bce6e1b85211e7819

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\ProgressDialog.xml

Filesize
360B

MD5
b71bcfcd26da542cdc999461273a5f8d

SHA1
8ead413c2af8e562439d2493f53ea2213b408780

SHA256
787fae5a46c80688d65ef3ae0d238af468636747e1e80f48283ca22a8b46bb1c

SHA512
135a1e12390601acaf7b3fe283f8d80856bffb031077939c998b7049d1d56855c374cec7b268e1061063494411aba646dcac725a01a02d7e4913fc5cbe2631cc

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\SdiMaker.xml

Filesize
782B

MD5
44e86fb9d4f0143d20c4bcebfd3a6a0b

SHA1
64b034817dec4764e3d03fb15df7e4187dbf3eb6

SHA256
a69e3291bdca335d32871d8615f1bb9e47e7132c157f87514d3843f07b29f86a

SHA512
08d6412a9a054da5f9d16d89015860efd099ee22510c73b7e1e49fee1433ddda7f7af7840262e421bb0fe595b9a6fa04f0d088fcf5506a254c0fdb10861c26db

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\en-US\properties.xml

Filesize
180B

MD5
b15bdc1412728c5baaef79cc09e73555

SHA1
998c68baee96c3d34035a3b63b49ba58203d3aff

SHA256
b8a414bfd8078839d7fc94ab64b63f03f75aa71016fe021a48fe6b3be3173126

SHA512
fd211b0517fb09075306a65eab59a195a0b41172e6fda1ea072dc8b240747c70068b993a76085f5a6f9f29c87df58f50b3eb140740ce8dc0f1c467c590d48d7d

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\es\properties.xml

Filesize
181B

MD5
24980c9236c762569fac2f3ffc3a3e10

SHA1
d8380bc3d26130309ad00f1cd9a0244e4243dc80

SHA256
05f9e3c442d844db5f7670face7491ba06ea36ca39dcf9399f3523b73533da4c

SHA512
ee99c87f1dbbd89c4df0d8976114219fabb9e3c784c5a8c55f7069a756ea1b9bab2ce30cb84258ed5abb5fc7283797266ca12b6b13f8fe7cbfbb2045ecaea22f

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\fi\properties.xml

Filesize
180B

MD5
151a76df53f9522669ad3711b2f98dbf

SHA1
3dc70444f61648e36b014fbf2e8d1e5d9b052bfc

SHA256
65ec459523f97c31239e707368f47485ffaccede48869e2545e8886d7ba93a63

SHA512
772e0c04f0678cc175d137d6a1e3cc65d64683d0717a81da192017f2da601e5f15d142c373704fc8a2e819e3694794e3b1927c6f2798210cef6429492bca4118

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\fr\properties.xml

Filesize
182B

MD5
01c5765fff28df5ab1e619fdbdb1536f

SHA1
73b95005f7516ba228c3c6112261fc42d219cc10

SHA256
c42345da25d4e1061d982c5dea87addfbc23d3a74cd6330b3e1070638c23c842

SHA512
6cc17f8d0b941990846e209731da095261358092c53c9fb2b5db3519678e50e62d161672a14fe45c222c8620a46f8d4cf384754c63adf6319192bc22b13f6a0d

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\he\properties.xml

Filesize
183B

MD5
e3030ba887f98057e14cf750db78ec61

SHA1
840fc0afbef4990e7f3bcc3e3ad73ff08128dcd9

SHA256
dcc2e94794400a30c8d7b1b9972b678e1d212d2450678c2c66de44753f2d1634

SHA512
fda37f0222270518f84a2aa6a09924f01c6554bfd4e6032f0a1e2602e1ee8c9184d38a208c5768720c8cb2f238e51f6dabefcbcc7e72e24e0c56173fd4e4cafc

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\hu\properties.xml

Filesize
179B

MD5
e98525bc3765790290ab0e4391dd734a

SHA1
74d0a72056371ec81d839c3923202cbac284965e

SHA256
5549bb91cb211155de224687f457928f462ab1b33bc25a2a9a47c8ceac5045d3

SHA512
78e13fe2b0f881fd090a596cae897c02dca3b3cfc454ad7e2d284fd6b3d8365a59024ae542bafa5e79a227bf87454531d7a49a51ac8a0fd8b7b204a6b6db9eb8

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\it\properties.xml

Filesize
181B

MD5
80618ee927d60e0c76a6f26cd23ef2bc

SHA1
664e69598d96364dd736fa460035b3a585aa79cb

SHA256
8b68ee5de07ff96e991d40f69a0e3e0b0ed6d557de05702f46c9cda5652706e4

SHA512
19c2bfedd675650dfd0666af6a1dac051d0163fb8cee1abfa76700669aa44fb1c31e98b70238413c8fe95cfd181e6f3cd610bbbce7f03d139863ceb19632c7dd

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ko\properties.xml

Filesize
182B

MD5
4ca82ba76ba620eaefa73b9a9804debe

SHA1
c1f355034abde7c3d625a15c031abb6834f6fc43

SHA256
3f4baf5ac2c342d5df9dbfa00000a60e82e1d557e70501235b9b292e14f5a53f

SHA512
f52c914d21dcf555542467769c77eeab25a1650006ba8edd5bdbfcc3563a01f09610ce5d5077c8542501c04947b98c5ddb42ae0414974d8a278d323aa1a453df

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\pl\properties.xml

Filesize
179B

MD5
d49fe9bc96a4190c531633ce38f830a9

SHA1
0968278da799e430cdf39814bcc09d074b5475ce

SHA256
2ea52f03f10ae2deb4cc8ea670748300db8debf155539c87f5de2fb540d93541

SHA512
d7ad430077e836a1c35c9335dde053fff4b246defbe44a5740c22c9bd5b4a97cb1a2503b8b5f7e3376fcfdb2253de4f42d27589db429673abc4c5a89551d7ce4

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\pt\properties.xml

Filesize
183B

MD5
0cc787cfef9cee9e59e00fd7723487f2

SHA1
3e8c0dd6ad350ef35caeb6c70d7e220fd465a88d

SHA256
4c374df5b2d7aaa9d62c36d5f40fd4ceca4787b1e17e8cf3715c1fb8c950d71f

SHA512
42069b75ecf3e93b98431eff20056dadab3ba9b14f3bf3d8d78d4605cf4c23775691016efe21b362dd4233fe850adbb06cc8e69a2f36debd4ee42e2c5dcf10a9

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\ru\properties.xml

Filesize
187B

MD5
441992f49ab7ffa73f826383ec6b420e

SHA1
cb5de3ad4a2a4f1d469f90efa926083a8fb5bdd2

SHA256
def731ab68cff2081d712527e9e0068259c19e974001e38072c46a18a90b5b9d

SHA512
c970d0569a5dd85ceb71cd25bad8eb1482a4d1bcb1f5de7d2fdba36027ab419c3f604c5a7dd894c48fb230f8e1a843ef9f21fae6beffb1fab1afb7e000d50e24

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\sl\properties.xml

Filesize
186B

MD5
fce9ea94a832172cdd5b1bf4d229bb5e

SHA1
939b6494ac39d4e8b0880c4ae9e75b85b63576df

SHA256
a21d44c9ea6e1c7f0aeb5884cac269d84b1d4fea74ea03638ed043f8b053e3fb

SHA512
585ce0b0f7f896ced05733645abc87ed1ec8c3d899c59c46fe2f7227c4cfde59aba7587507b1d7491105673436f4994a0d274a6a644adcb67da17c5da77e135d

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\sv\properties.xml

Filesize
180B

MD5
acff5cad408f70cfde6d7d98e82f42f4

SHA1
cdccd36d5e49336403e72b5e29f87251abc417da

SHA256
b1a2ef6faf673812709518e03c448e8ddd7f3da0504c9e26c075d1704a4c4057

SHA512
c2bcafa07389060fcbe7dc345fceb0c58b09589096767761729f098ead73607013b8e784f602fbae687ef8bfdd0b5a6833fb9c253e19c2f5a234dcae0b6a1d53

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\tr\properties.xml

Filesize
181B

MD5
3d561daea9e95bf5dea3b1c4859caabf

SHA1
c2c7cb9ef61b6f5fb1d30b41cbc2ac28086ceb96

SHA256
6b79fc383b5518f761672986399438e7c5f5ea88a7509beea48b456e5b4ba287

SHA512
9fb4a896f5423d977703128096939750f09be4ead4f5b39bba8bd59f92b0f803aa5e024e03e64e481792ae878233d90225633eab77e7fe385a2eb3361e2e761b

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\uk\properties.xml

Filesize
193B

MD5
d36e2e6f03dcaefe8a6c7ee084d3d3a0

SHA1
cf893e29e83e49200b69d03e754bd49366fc8cd3

SHA256
96d05ab2b19e19ef3ac8651d0d61cf05fa3a2c8b36712ad83a855800d244dce4

SHA512
e92b9716aa752d18d97292a78ee54c59f9c720cf85a4a07f5ebc137fc1542e918de473761f201ace87fdf55efe1d05bf1391cb91df0298cb873f08efa330aa41

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\zh-CHS\properties.xml

Filesize
185B

MD5
ffc617abbb2838282325b8cecf00e7bd

SHA1
2976b8271ab71c1de06989486e5280cf20b9ff44

SHA256
dbddd1a41b4ac590de941b70e19073078c23d8bed87bdeddca3d9e2f47036483

SHA512
f493f2b31b3ed6699555dc7141f53ab9e0fb6b50bfa8df639319cc39c100289b67d3add0232f48a4e75304e79660ff131464789fa8a9c73a42060ab4964f4a9f

Download Submit
C:\Program Files (x86)\NeoSmart Technologies\EasyBCD\lang\zh-TW\properties.xml

Filesize
185B

MD5
6fa77b1b9788e6082e94bf3a6fa968a2

SHA1
93be8a41de48defafe11ec195817ae43f6979166

SHA256
5a58a498e3c6e34cb068382c93f7fdd4d95ca89af565016be54d648f9bab86d3

SHA512
0a460bdd4b352e1850400989731715c3c7fdef6dcc11d3a324a564c0ed690b99f654e0660178c29e28aeb8e1c4762d275a482329f71e6e4e483ddd9c27be4cf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
c3b919bf41ea705817793c133d249269

SHA1
afefdb247e696fa6943a447e16c1a3b6b49326dc

SHA256
9b128bab3ceea5bd0e56a8bca20568cd5ceda41a85482432ea2cc8a8a63039de

SHA512
14b8d8ecd2f7543fa8ec27ce7849a2cee8553bd36e9543e3d601d2bbbc1582a667b7cf659815196099352702150255c8f651dc2ef286afcdbdbade5260634300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
382654e0e3525e2406039c5a174e0fc9

SHA1
5db611c6a0da9f5e18c18b570335225271c1e8d5

SHA256
00db24ba51864ad3b2f1cf9f9ac2fab400e352f63e37555848cff4099113906c

SHA512
b69150a448bc28e3df273593aeed442ba0bdd5fcd79b4938b55e7f13a4f1d911c8aa68fb4e3f897da5a96c9543853193695c5bcc57a4e0b061719474610d0d0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e1b33160858148a5c52fd430111fc6d7

SHA1
b1fdd1cc287288d6d660a9d4a156853c9c5013fa

SHA256
a2bcf287e43230dcf16c9f4afbe38b76b65f55b0e384653b7a6f5044d992a1fe

SHA512
56bcc666c3e696309054866807de61994468d92acd52dd879d158f75cbbd143ea39706a482f87042ba951ec70f904a0bc2a608bc0af3de1be316e4aa66a5e6fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
baf73250e887d23e8e096ddf43aa6f55

SHA1
31a914335ca9ed0ca889be6359bb7518b5b04424

SHA256
b162faf32a6cb0365f9712e7881e800f45bf2c32b848cd0cfa7d70b4ed27ed3d

SHA512
f0c61b0a2505bd5e2202d40d44b2264cc3cf58bf3b44f3065b797850d444b345c9d6ab3d4a34fc861fe8d147f5afac9fcc76f929ce2b2ddbb3d91151665a3451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e80e94e19a8f21d52a90c1cc3f648597

SHA1
4176e785961f6539533b905995ff650427d76cb4

SHA256
aa17099e2ed67b9f95c61b9b3ce116730b28aa3acb17654780eead0488d457a7

SHA512
844a8a77549caaeb52ed75aa6af9672fbe95e05a9613f82fc2f1a445f8fbf01865555319b0e9b2edde2a66b04ea045156d6f8b6e2caa193ec9e64c376a8a8660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6b45867d8cbc9d2ea7f11dfee20c5a04

SHA1
68aab8521ee924a40b57f182867bc57a8d3e6764

SHA256
a35a10e6a4b4b1a1f9186694f9b8ff8016fec8899caa5edb42ca2c4651682430

SHA512
31632b8b2e139189e48305f296699b24dd2cccd35bdb01f52b5cf1900b22b6e6eefa2399ee3750ba68f4c17e9b9ee0826d2071bb757a70b6eeb0d133d7080793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2f7c918a43d10de79630c701ee575f4

SHA1
45a4914e8d6313a1e4ebdfc875e340bc5cd969b1

SHA256
46961cff7f59c545736a29a00fff839b833f37fb537cdb6c3b2faa5ebf6b40a2

SHA512
f8fdbd1a101c014f63bbe36b047b9556a119589ecde34a921ba4d2edc67621d0cb7701b8f351b26e2d6e6f209d5abd7556c4cb55161baefd944892a6a667524e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
653a7455ffdbc2cd06b0b4affcefbb98

SHA1
d3a51a9e8441cf7656e5c4c56f5b0d1a758fb370

SHA256
38b7b2ba12c0f4ad9e13cafa0c4208b77cc4b94ca83427b86beae46e69a79965

SHA512
f4f28724bdec77a04bddd4d00ab69daa03fb74c4e1589de3f5cf8bbc8297632e572f4bc18c8e4ab91c68e4ec14c0b1dc5832ebc09aa0a54eb6b1f758a869c803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa122b13d04b8073d04c19facd37c36e

SHA1
1d93e416734bac1312cdc1bf0a6b6744af02e11f

SHA256
c3afe1cc8a5778c4a81a231a6a15c361256c62df6a03d8e334afad0d048dbb0b

SHA512
fe1cd33056e0c84dae36f3f83976a4e79b2d3140c992a65a1ea02a24032c2ee72af83454461aa1fde7794fd066e2ff166695b0d45d505bec23d67909c574c432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
09213050dfa2d2f7b801440475b5c665

SHA1
ba16aead100b254efbd2bbbeb17e9dfbfb68f61e

SHA256
1eef6bcb81001ccfb5d1f25d242b5cd9a2e1dfcabc0cbdca0580826e9fd0736d

SHA512
66e8624a8468caa03864f8bd0ab89441b21f7bbfa313695f1411dd76790de5a4cc8000206abf77f5986d46978c623cbd3f7bcb5aaeedda2b28e3f7f8cbd7dd35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
220de76cc2d73acd6eb95e96fa71443c

SHA1
6c1525077330df756c93f1a9494c8855fec2a7a9

SHA256
44bf95c2588e01cf982de041d752bd8e3ec4fddc2e2986a8abc19867f1fc31b5

SHA512
b3d28dae17ac26713d3a2ff2e760b893d0feedcaf1eab12ac96a870e78a26f735c6a87bf939d877c025f6013fa4641e4f73d95915b5ba39d0ff97a0ae5010633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
02c5b07305de06c34a5ea4fefc3acabf

SHA1
30d01f3a59a98dc63e70c678ad2d744085b8128d

SHA256
21c9230fe8ab0d527a81f1514c8891a3f3bf2040f5f2816f1b928d4220608d86

SHA512
040b45751d0e4e437fa73724adef9ba5f368f29923976edf973962d3b00241d95ae24c632a9504bbccba189681af9995ad6a57732b97bd8673e818c82236fa7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f0a8b5cac077476e2801b07452208181

SHA1
254b804f872a2f1cb1ecb855c0362e8692b44a58

SHA256
2ad0b6218b44bd3f0c7530a7423a5f584647eaec4182808643fa0cb9b16cc393

SHA512
6b5ea78af1d4ec97d250197fa25dfae59df0197a35c81a8191524e5842f8e921b77fead15e82db8f2b82491e6a0960ece63c784ba915c1d697a2c20be61e8801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms

Filesize
5KB

MD5
111031706d8e05eb54f2600f050215b6

SHA1
3096a1299db128431d95fe2a919c2784faae0054

SHA256
850b6ff1383d83c4a85e672016f78faba7b992c5d440c02b66917722101c08f5

SHA512
4f0c9f8e4f9dd43db8d4e1a422866623a7da93f6ce0a02c376f3c264689ea31e65ab962dc8460b2633964f894315f3e21dea5821acaeb928fcf41662b5065975

Download Submit
C:\Users\Admin\AppData\Local\NeoSmart_Technologies\EasyBCD.exe_StrongName_ge4xjewlvhidmksvx1etlpptdtrgpnqg\2.4.0.237\user.config

Filesize
1KB

MD5
3296c509c2f9748f30777dc9bedbecaf

SHA1
8678bd26f811774bc17532fc8078f8d9e73f6559

SHA256
5037f76e3931ced5b8dc3623f3ca454f48013ec8f1b7e45b3ec3ca34675f2188

SHA512
eb42e7ff248a226a0ab1aab3d346dc3a3cf35e02593492b2756ce8e0f39461c51f00c1ea98453362ff7bfdb7355e1e3204420698e6e4139a41a7f6d4fb7da31d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE0E7.tmp\InstallOptions.dll

Filesize
14KB

MD5
8d5a5529462a9ba1ac068ee0502578c7

SHA1
875e651e302ce0bfc8893f341cf19171fee25ea5

SHA256
e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790

SHA512
101da2c33f47bd85b8934318e0f0b72f820afc928a2a21e2c7823875e3a0e830f7c67f42b4c2f30596eaa073617790c89700c0d95b7949ec617e52800b61d462

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE0E7.tmp\System.dll

Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE0E7.tmp\ioSpecial.ini

Filesize
673B

MD5
8ccc26cb503f4118055c48396c455e57

SHA1
fe8010c43c0ddae06fbaa4e2fea130adbd8a60c4

SHA256
4577f0ba2ace512481f5adcda48008d670fdf5c73ec01bf5ae2785b4a36165b7

SHA512
7e61fbb2e5b8cab63756380bce01847a270bf8a1915dd96ff5455bd2745bcf6985d896f03926bbcc573927c8b4d922f63b655a38f5dc13f84134af410e89fbb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE0E7.tmp\ioSpecial.ini

Filesize
633B

MD5
e588948f36fb4e6d7c1bf9d46c13dc86

SHA1
833d15bce84fff9a399ad62b7a51b9bfce1e8d98

SHA256
363aac5a3d70282e2e6db5e28f0f2653ccec3f39c881c30e12528c007871e129

SHA512
9337d42cb67366bbbba867fa6cacb605426b47d0a2257bcd903f93895cb6674bc4de9d500e268b03464389d4626e68cd49fa16b86b5536840516e8a07ebb7db8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE0E7.tmp\ioSpecial.ini

Filesize
648B

MD5
629a59e83acbf944cfc4b7f1fed631d8

SHA1
933413c2b3e4b7d8fc636b8361dbe85d193e67e9

SHA256
a32f23445f1ae49294a598ef7537e8d91125c72b554f3fc43bf38a0b3d6f206f

SHA512
1de6beeb0dda62d4b0d151161a45ed28fe4bac1c5def47fbefadd9920ce41bba27c3d549a6854b6fc3093a3329c313a10ee1fcb942be6319baf7b5d5c3215b19

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 198853.crdownload

Filesize
2.2MB

MD5
2e06476ebe1137f543ee7176d34716e7

SHA1
6eaa6aa0e829ce8af54213f6de77e748c4388e23

SHA256
0a94a43af2db7bdbada87b34bf03d3b221110d1ca21bbebec55b08767c1281cc

SHA512
4f038b1bab87a9c552672a69d2122800e5f6809c6230c2cea4f14000d0c8555393621af0e4e85ef9471a6527d9458a6315576aab9de10058b3c320549f9d0c1e

Download Submit
memory/664-888-0x0000020BA22E0000-0x0000020BA22E1000-memory.dmp

Filesize
4KB

Download
memory/664-890-0x0000020BA22E0000-0x0000020BA22E1000-memory.dmp

Filesize
4KB

Download
memory/664-889-0x0000020BA22E0000-0x0000020BA22E1000-memory.dmp

Filesize
4KB

Download
memory/664-886-0x0000020BA22E0000-0x0000020BA22E1000-memory.dmp

Filesize
4KB

Download
memory/664-881-0x0000020BA22E0000-0x0000020BA22E1000-memory.dmp

Filesize
4KB

Download
memory/664-882-0x0000020BA22E0000-0x0000020BA22E1000-memory.dmp

Filesize
4KB

Download
memory/664-883-0x0000020BA22E0000-0x0000020BA22E1000-memory.dmp

Filesize
4KB

Download
memory/664-887-0x0000020BA22E0000-0x0000020BA22E1000-memory.dmp

Filesize
4KB

Download
memory/664-885-0x0000020BA22E0000-0x0000020BA22E1000-memory.dmp

Filesize
4KB

Download
memory/1456-845-0x000000001BAB0000-0x000000001BB24000-memory.dmp

Filesize
464KB

Download
memory/1456-870-0x000000001C940000-0x000000001C9BC000-memory.dmp

Filesize
496KB

Download
memory/4640-780-0x00000000031C0000-0x0000000003234000-memory.dmp

Filesize
464KB

Download
memory/4640-779-0x0000000001600000-0x000000000160C000-memory.dmp

Filesize
48KB

Download
memory/4640-777-0x0000000000D20000-0x0000000000E16000-memory.dmp

Filesize
984KB

Download
memory/4640-788-0x000000001E260000-0x000000001E2A4000-memory.dmp

Filesize
272KB

Download
memory/4868-792-0x00000215889B0000-0x00000215889B1000-memory.dmp

Filesize
4KB

Download
memory/4868-795-0x00000215889B0000-0x00000215889B1000-memory.dmp

Filesize
4KB

Download
memory/4868-794-0x00000215889B0000-0x00000215889B1000-memory.dmp

Filesize
4KB

Download
memory/4868-793-0x00000215889B0000-0x00000215889B1000-memory.dmp

Filesize
4KB

Download
memory/4868-786-0x00000215889B0000-0x00000215889B1000-memory.dmp

Filesize
4KB

Download
memory/4868-787-0x00000215889B0000-0x00000215889B1000-memory.dmp

Filesize
4KB

Download
memory/4868-785-0x00000215889B0000-0x00000215889B1000-memory.dmp

Filesize
4KB

Download
memory/4868-796-0x00000215889B0000-0x00000215889B1000-memory.dmp

Filesize
4KB

Download
memory/4868-797-0x00000215889B0000-0x00000215889B1000-memory.dmp

Filesize
4KB

Download
memory/4868-798-0x00000215889B0000-0x00000215889B1000-memory.dmp

Filesize
4KB

Download