Analysis
-
max time kernel
105s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 23:18
Static task
static1
Behavioral task
behavioral1
Sample
3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral2
Sample
51B4EF5DC9D26B7A26E214CEE90598631E2EAA67.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
E906FA3D51E86A61741B3499145A114E9BFB7C56.exe
Resource
win10v2004-20250314-en
General
-
Target
3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe
-
Size
284KB
-
MD5
209a288c68207d57e0ce6e60ebf60729
-
SHA1
e654d39cd13414b5151e8cf0d8f5b166dddd45cb
-
SHA256
3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
-
SHA512
ce4a7e42738154183fc53702f0841dfd4ad1eb0567b13cc1ff0909f1d330e9cd2fb994375efc6f02e7eddaaae1f465ff93458412143266afdaff1c6bf6477fc3
-
SSDEEP
3072:rYXT8PUsMNL8V4tD2My/JAAbQoM29wlV58lbNnolY7VgsYiVTPtiTu/q:rowUsML8g2j0o9wb0bNoaKsYImui
Malware Config
Signatures
-
Renames multiple (4343) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt geydlny.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe -
Executes dropped EXE 1 IoCs
pid Process 1676 geydlny.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\crypto13 = "C:\\Users\\Admin\\AppData\\Roaming\\geydlny.exe" geydlny.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ja-JP\MSFT_UserResource.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\BitsTransfer.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\fr-FR\ArchiveResources.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ja-JP\TestDtc.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\es-ES\TestDtc.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\en-US\RunAsHelper.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\es-ES\lpeula.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\de-DE\WindowsPackageCab.Strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\fr-FR\MSFT_ServiceResource.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\en-US\MSFT_UserResource.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\de-DE\AssignedAccessMsg.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BranchCache\BranchCache.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\it-IT\RunAsHelper.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\en-US\MSFT_ScriptResourceStrings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\uk-UA\MSFT_ScriptResourceStrings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\ConfigCI.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\en-US\ArchiveResources.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\en-US\lpeula.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\license.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\fr-FR\MSFT_WindowsOptionalFeature.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\license.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Professional\license.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\it-IT\lipeula.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PnpDevice\PnpDevice.Resource.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\VpnClient.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\Volume\Professional\license.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\fr-FR\AssignedAccessMsg.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\es-ES\PSDSCxMachine.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ScheduledTasks\ScheduledTasks.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\de-DE\lpeula.rtf geydlny.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\MPDW-constraints.js geydlny.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\NetSwitchTeam.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\WindowsPackageCab.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\de-DE\MSFT_ServiceResource.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\WindowsFeatureSet\WindowsFeatureSet.psd1 geydlny.exe File opened for modification C:\Windows\System32\LogFiles\WMI\SpoolerLogger.etl.001 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppBackgroundTask\AppBackgroundTask.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\NetEventPacketCapture.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\de-DE\MSFT_UserResource.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\fr-FR\MSFT_UserResource.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\fr-FR\PSDSCxMachine.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\license.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PnpDevice\PnpDevice.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\it-IT\MSFT_WindowsOptionalFeature.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\Volume\Professional\license.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\provisioning.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\ja-JP\MSFT_ServiceResource.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\ja-JP\PSDesiredStateConfiguration.Resource.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\Wdac.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\license.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\fr-FR\MSFT_RoleResourceStrings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\de-DE\MSFT_ScriptResourceStrings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\@AppHelpToast.png geydlny.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\license.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\ja-JP\lipeula.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\en-US\MSFT_GroupResource.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\es-ES\MSFT_ScriptResourceStrings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\fr-FR\lipeula.rtf geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\de-DE\MSFT_ProcessResource.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\it-IT\PSDSCxMachine.strings.psd1 geydlny.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\uk-UA\AssignedAccessMsg.psd1 geydlny.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\HELP_TO_DECRYPT_YOUR_FILES.bmp" geydlny.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxMediumTile.scale-200.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MedTile.scale-125.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\173.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-36.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-400.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-24.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Preview.scale-100_layoutdir-RTL.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteSmallTile.scale-200.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-100_contrast-black.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsLargeTile.scale-200.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubGameBar.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-16_altform-lightunplated.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCacheMini.scale-125.png geydlny.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover.png geydlny.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\ui-strings.js geydlny.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-4x.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteWideTile.scale-400.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-100.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\AppIcon.scale-100.png geydlny.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_es_135x40.svg geydlny.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\s_agreement_filetype.svg geydlny.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\PackageManagementDscUtilities.strings.psd1 geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-16_altform-unplated.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-400_contrast-white.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-125.png geydlny.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\ui-strings.js geydlny.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-48.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\webviewBoot.min.js geydlny.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\bg.pak.DATA geydlny.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\ui-strings.js geydlny.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\ui-strings.js geydlny.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\et.pak.DATA geydlny.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-125_contrast-white.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-256_altform-unplated.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_contrast-white.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\LargeTile.scale-125.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-32_contrast-white.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\LargeTile.scale-100.png geydlny.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ui-strings.js geydlny.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping2564_2095783930\_locales\it\messages.json msedge.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\fa.pak.DATA geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\styles\wefgallerywinrt.css geydlny.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\nub.png geydlny.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ka.pak geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-125.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-1.jpg geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-16_altform-unplated_contrast-white.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-200_contrast-black.png geydlny.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\ui-strings.js geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\StoreLogo.scale-150.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_contrast-black.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-100_contrast-black.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-48_altform-lightunplated.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\SmallTile.scale-200.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png geydlny.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt geydlny.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeMediumTile.scale-400.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\WideTile.scale-200.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteMediumTile.scale-100.png geydlny.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-32.png geydlny.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-80.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.powershell.v3.common_31bf3856ad364e35_10.0.19041.1_none_4d7ba8a62302e970\Microsoft.PowerShell.Security.psd1 geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\js\oobe-light-footer-vm.js geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\common\oobe-toggle-vm.js geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.scale-100_contrast-black.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Wide310x150Logo.contrast-black_scale-150.png geydlny.exe File opened for modification C:\Windows\WinSxS\x86_netfx-sbs_microsoft_jscript_dll_31bf3856ad364e35_10.0.19041.1_none_56a96e107878c752\sbs_microsoft.jscript.dll geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\SmallLogo.png geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Assets\SquareTile44x44.scale-400.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_es-es_8f798b6f3ac6ca90\CL_LocalizationData.psd1 geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.1266_none_e6ebbe2a02425392\r\bootstrapsessiongeneralutilities.js geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.powershell.archive.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5e7dd9332bb785f9\ArchiveResources.psd1 geydlny.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.scale-125.png geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\TridentErrorPageStyles.css geydlny.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-80_contrast-white.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobeupdatesettings-page.js geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\PPIRemovableStorageDevicesSquareTile44x44.scale-100.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square44x44Logo.contrast-white_scale-200.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\i_open.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare310x310.scale-150.png geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\surfaceHubDeviceUser\js\deviceUserPage.js geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\logo.contrast-white_scale-100.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\cssMode.js geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-search_31bf3856ad364e35_10.0.19041.1_none_ab0246b6c25f7d5c\logo.contrast-white_scale-100.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.1_none_03928ee4a9e5894c\Icon_MMXresume.scale-400.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.backgroun..r.management.module_31bf3856ad364e35_10.0.19041.1_none_8f3e2d4e3a3d61b3\BitsTransfer.psd1 geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\Assets\SquareTile44x44.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.153_none_e669b22d011fc6b2\DisplaySystemToastIcon.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobeeula-data.js geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare310x310.scale-200.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.targetsize-48_altform-unplated_contrast-white.png geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\images\colorPicker\sliderButton.png geydlny.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPStoreLogo.scale-400_contrast-white.png geydlny.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\Assets\BadgeLogo.scale-150.png geydlny.exe File opened for modification C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Advanced.Theme-Dark_Scale-300.png geydlny.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-d..rbridging.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2c7e4dafd061ba82.manifest geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_de-de_38dc59c8844ded13\RS_DisableScreensaver.psd1 geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\SmallTile.scale-125.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars41.contrast-white_scale-200.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\columnmove.png geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\21.txt geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_703da42ab3b5bf6d\CL_LocalizationData.psd1 geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\CommonMerged.js geydlny.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft.configci.commands_31bf3856ad364e35_10.0.19041.1_none_6d3d2166b6a9d0b1\ConfigCI.psd1 geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\scoobe-knockout-helpers.js geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\SquareTile310x150.scale-100.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_chartselection_clear_disabled.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\controls.css geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-30_altform-unplated.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleLogo.scale-100.png geydlny.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-30_contrast-white.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_d27673a59501fec0\RS_RestoreIEconnection.psd1 geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-256_contrast-white.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1_none_11b2da2074e7d6e4\PasswordExpiry.contrast-white_scale-100.png geydlny.exe File opened for modification C:\Windows\diagnostics\system\Audio\ja-JP\CL_LocalizationData.psd1 geydlny.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-96_altform-unplated_contrast-white.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars48.scale-200.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\Square44x44Logo.targetsize-32_altform-lightunplated.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-search_31bf3856ad364e35_10.0.19041.746_none_d30a83ff81d13ba6\logo.contrast-black_scale-140.png geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\TridentErrorPageStyles.css geydlny.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-white\AppListIcon.targetsize-64_altform-unplated.png geydlny.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\SquareLogo150x150.scale-400.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square150x150Logo.scale-100.png geydlny.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSplashScreen.scale-125.png geydlny.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language geydlny.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\Desktop\WallpaperStyle = "0" geydlny.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\Desktop\TileWallpaper = "0" geydlny.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{32ACC7EA-0C2B-11F0-A1E4-EE5EE1E3FD33} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876775826264189" msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-814918696-1585701690-3140955116-1000\{CECC1F2C-4B63-4AF5-B246-94C7D0966916} msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe 1676 geydlny.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe 2564 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2564 msedge.exe 6964 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 6964 iexplore.exe 6964 iexplore.exe 5896 IEXPLORE.EXE 5896 IEXPLORE.EXE 5896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1800 wrote to memory of 1676 1800 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe 88 PID 1800 wrote to memory of 1676 1800 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe 88 PID 1800 wrote to memory of 1676 1800 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe 88 PID 1800 wrote to memory of 2460 1800 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe 91 PID 1800 wrote to memory of 2460 1800 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe 91 PID 1800 wrote to memory of 2460 1800 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe 91 PID 1676 wrote to memory of 2564 1676 geydlny.exe 96 PID 1676 wrote to memory of 2564 1676 geydlny.exe 96 PID 2564 wrote to memory of 5104 2564 msedge.exe 97 PID 2564 wrote to memory of 5104 2564 msedge.exe 97 PID 2564 wrote to memory of 5956 2564 msedge.exe 98 PID 2564 wrote to memory of 5956 2564 msedge.exe 98 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 5856 2564 msedge.exe 99 PID 2564 wrote to memory of 3864 2564 msedge.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe"C:\Users\Admin\AppData\Local\Temp\3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Roaming\geydlny.exeC:\Users\Admin\AppData\Roaming\geydlny.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html3⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2ec,0x7fffd9aef208,0x7fffd9aef214,0x7fffd9aef2204⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1832,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:34⤵PID:5956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2180,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:24⤵PID:5856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2128,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:84⤵PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3588,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3544,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4412,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3596,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:84⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=3860,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:84⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=3496,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:84⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5484,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5464,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:84⤵PID:3412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5464,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:84⤵PID:2244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6016,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:84⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=6232,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:84⤵PID:4272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=704,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:84⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=120,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:84⤵PID:5460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5760,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:84⤵PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5184,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:84⤵PID:2156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4328,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:84⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6368,i,2066864166602925869,16700794820723230197,262144 --variations-seed-version --mojo-platform-channel-handle=868 /prefetch:84⤵PID:1420
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\log.html3⤵PID:6120
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3372C1~1.EXE >> NUL2⤵PID:2460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\geydlny.exe1⤵PID:1388
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:5524
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:2888
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -nohome1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6964 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5896
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD5496b05677135db1c74d82f948538c21c
SHA1e736e675ca5195b5fc16e59fb7de582437fb9f9a
SHA256df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7
SHA5128bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c
-
Filesize
134B
MD5049c307f30407da557545d34db8ced16
SHA1f10b86ebfe8d30d0dc36210939ca7fa7a819d494
SHA256c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54
SHA51214f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780
-
Filesize
85B
MD5c3419069a1c30140b77045aba38f12cf
SHA111920f0c1e55cadc7d2893d1eebb268b3459762a
SHA256db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f
SHA512c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json
Filesize3KB
MD5f9fd82b572ef4ce41a3d1075acc52d22
SHA1fdded5eef95391be440cc15f84ded0480c0141e3
SHA2565f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6
SHA51217084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339
-
Filesize
280B
MD560d40d2b37759323c10800b75df359b8
SHA1f5890e7d8fc1976fe036fea293832d2e9968c05c
SHA256c3a2f26d5aef8b5ed1d23b59ed6fce952b48194bed69e108a48f78aec72126e0
SHA5120c339563594cc9f930a64903281589886308d4412ee267e976520a58d86b2c339d7b2320e1b3fd6fbf81f092ff1735f0710c669af2986ea5b63d2c1e0a6df902
-
Filesize
36B
MD5f4866bbb61e593734088ed4f299e39a5
SHA1aa47af92ce76deff6acd64d2acca7f3f66158083
SHA25688ae63322c7dbb8a7f60367c0e35725fed0ba6fc2d52d98d394cb41a5b03f8bf
SHA5123568d5817a9c7df2bdf025116caedbdea25abfc0d94b3990d86461c3c4ef0a22705ae122ba7f066780d092e9638a5947b74e8502d3261326c35196f8f72d5ee8
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
36B
MD50f0615afac3fa1de7bbc5ea6516d6ccf
SHA1244ee9031c42974d49cd67c40d753797f6b96420
SHA2563409cb64843ee73d8deeede1c69f23e87cadd4c1dece2313dabfadc4e89c4b70
SHA512307b0ee4c54550885eaab0a794fb65fb606d002c9f84df4daf7ea2d3905ea09c59f430ef815bb565a2bf63d983470c25a7c77d81b097bfb70e00042076999ff0
-
Filesize
333KB
MD566c4761c6bb6ac54b4e013146ad95aa5
SHA1b018c4b0dd31a77a580eec4e7f74300961cd28a2
SHA256157e4c9edc771e76f47c87724277ae406ec2c52a34503bbac80f4944ab97c6f6
SHA51201cb8c5455bff4d5d58dcfe90f946a4d64e584d1258658239fdf269d9bc66569162ea1efd3f3be110d26a03e53b95b71f5ecf054d5c880d3204e0f4d20bc19ae
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\128.png
Filesize4KB
MD535696aba596d5b8619a558dd05b4ad40
SHA17ecc1dad332847b08c889cb35dda9d4bae85dea8
SHA25675da533888189d13fc340d40637b9fc07a3f732e3fcf33ec300f4c7268790a62
SHA512c32f20865f736b772844aaa44572369e7ae85b9f2f17f87d61694acc54487309a32bc4830ed8d9cee8b593babecf728c1ea33c2b9588649be0e4f1e6ed7ee753
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\af\messages.json
Filesize932B
MD5c97fbfe45907b4bec6fb91e20a67a9a0
SHA1f36f2ec79851a6631626bf5e2c34758755bafd5f
SHA256b1a30a6ace51e943e0b50faf4684e362749eca36118e03f7c3dfaf95174ab0a0
SHA51268aaeab309abbf8ff1f16399b53e57294b52599c71e28fd87d7bebcc2f391775f9f35c54c21f580689ebffd86c05821aff9e15362e79f6e982f28cef805c3d91
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\am\messages.json
Filesize1KB
MD5910d81d56e7583b4b3e0cbd66d264092
SHA16c2e134e38986f9d241cff513c9163001ab7c437
SHA2566201b36d82f77eb2b758b7a81a562a3c79a488771a51536065bb2fb90f23b012
SHA512b55725d0431c0163ad37ae9b52978d16147196ccefb1df685ab12a539b0ba62bf649a89166745952415790e8d510285de44fa27e021666b62c5b3252e1aa71e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\ar\messages.json
Filesize1KB
MD5381cd888b2c3e3d9ed67dd55445802a8
SHA19a42a09919ed9e463085afb837e486113aaeb97d
SHA256600c993a158179abcdba0d21076add01f751c381b305cd99d62228f65e9e8f43
SHA5123643ac5ee1ccebf06e5738f19615bf4c38c659bd60219b34f25b124a72aeae3693d61620261760de6358f3d15fa01ae048afd30888c7217690697889c40ba0b4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\az\messages.json
Filesize1012B
MD52cbf33ccfad46393425311a3b043baf9
SHA138a024c0fd65d3d696fdc6b8aa9aeecc689d2263
SHA256160ef7614e4775fe9167b29c8938fe71e977be737d6726212ff5caa0ce54df0b
SHA512b0e0d95a13e5f85b7a8eaf3d62fa0cd493faa7d14a26160c0053d731449bfef3c00862ff1bae9bd925a9a2e1c4b9dd01520e6460b1ce6f9ab9767f6c941a2c30
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\be\messages.json
Filesize3KB
MD5f6179a108d7c3a8f634f897a8433a45f
SHA141373b523e952136772a948af4a632afbe0cb66e
SHA256066f5da2c47ab47dc8a0f3531a0540dc55c1e6189f7b4c1c7ffb1d12ac880724
SHA5124ee0df1bd4504fd32c140b9d2df49aefaee9dea54ceacb17ff81211262cf6b9f444b3443034e744f52099c615a80e391c8f88e7f0020ca61dba1d9103ca71331
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\bg\messages.json
Filesize1KB
MD507af06a97bbe97fafadd8e65d2ebf749
SHA1b35eac2ce9f4a285a3374b1c4e9d2e0a6d5fdb48
SHA256824e44c0f295e8014f1a1100f8e5a1da3872178a7a45a974d87ba03bb78b23d6
SHA512bd8c3ac4a4e7f37d9dcbd17ae3a996c3cd8634428ff3dd9723c737a526308e66219f9fb64d2255609c7c52f15b11f85d677b112832db37cf524f3f18cdeb142d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\bn\messages.json
Filesize1KB
MD550e46004767f8aa86246775ce46a2eee
SHA1e157d336e9f3abafcb5e2bd1db3b0aa8f6d98eb4
SHA256aa2b38a09dbd0e11ccb17ac4bfac46a95aa5d35f344766e6803749fe237bdbd5
SHA512d2d38b8c71c56ad4cafe05992ed7b5fa9772107554cf06816cbac51bb4ed003810dce13cdfd77642f61c5b3107a9d10b6c377b3e1865cc3e0a2fd87eeb797b49
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\ca\messages.json
Filesize964B
MD5135f602f28e49d17e33c315991f1b813
SHA1216cfd849c47ee7c17b4d7c97ce01540af61e725
SHA256b3620986004945e129c30bd26274355e29f01dc7e97af5c6f945efafc38db3d4
SHA5124cf3ddca4bd78d7c4fa43bbd6d81f6491f4edb5e682cef8f8fa7106a27594f8c144de2325215b5c4002b13abee97e8b004ded2efcf7f6d6792fdf4ea4ebafaa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\cs\messages.json
Filesize948B
MD5c72be150f78f31b92e09977211c5b483
SHA1f82483a7f644b5ae052b8646a288acf7ca86d47f
SHA256b9170b3969bd23713b631ccfc17c0b2e92f69d93c198403a70269cd249080ad5
SHA5125504a3068b23922aaa599daa1cec033479273d3faac1d215227ba4a69e488093c045f7ff88d46452d44166567dec6df9fc369e6bd1e71c34bb42adc6dcd01699
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\cy\messages.json
Filesize836B
MD54e23579a25fca792f087a2571debc4e4
SHA1a0574091088f802a31faa41a1f5f1d03c003e83e
SHA256b84bac08fd7b100d411883b98466914c44a034826c8f01951df3375716ce9a84
SHA5125e44c2525f29495b9283feeba01dd06882df9495ee5ff4c238e7af8c4eebb391ae05e640fb3a13f9615b5cb95e71217793ec1990c5a0ae0493838451d4b71ede
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\da\messages.json
Filesize916B
MD59b865552ad829c69b2c1597a7e28898b
SHA1ab50c4c226c8f46c5da5ce55c32453efebb7dfb3
SHA256ffae76d9e2c476b92ece59abab591253cd2dbbabe700bbae2cac27a30e5ab016
SHA5128e71edab1c3b18b0237d2e0dc2c5dfc63796cd9d1e918dae8ade5a92fa7f254f54fa239369207c79635f5b37a4a88a1a8849ef4ecf2804252eea065d680b3458
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\de\messages.json
Filesize1KB
MD503276e2b4f40dd0089f6b081b02c91b4
SHA1a586bc12832967925582694eff71f9b32620c310
SHA2566272da384d0272493d44d5f86bf884e047ff284f3df6c18879b3151dc8b04811
SHA5128dee76cb0ee1cc01117678ac1df825b3401ea2d1ef0ce9a9d975fb0d0c4aed6d8080aad740523970e18f6a0e820aa61b9be033657194fb0795c7398c37eeeab7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\el\messages.json
Filesize1KB
MD5f5d422f44916175d363de7f081f3bd51
SHA116cabe5dd8ce2d2d12b4fc33cd40f83e39034255
SHA25668b7c44068b60dd11da56d9829041328c69fe9d95811ea0182e3af953ce28377
SHA51252a5aff0b1fcfcfd25d0f8c15a852523ad660f224a0cfeeb37f3e4b0533ba1cff092be9cbfeca040aafa03d2101c61ce21b6835731559df3d372f078da6376a5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en\messages.json
Filesize884B
MD5bd8bc896a97b6f8741964683566a5976
SHA1558ffa2285f8390f7b33d2a43cc0e25097d7750b
SHA256970b151d60e2107dfd83d43408d91034bbd7030f24ef1039f2d159a38d4b7049
SHA5121e1f38e9a19b95196776177d54780d08a71bc49bb3009258f808c67b105f0dbd1c2a31681daef1cf3a2721fd8571944913a940b53bcc43057e41b6d0248a1d13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en_CA\messages.json
Filesize884B
MD5771ab7562645b00fb9ddc9824c5bdef3
SHA1d207392743fafe0979ae0ebf170231c1f96a0154
SHA256b1da4b99e04c538c815e560c110e8cca02461cff9ce45d54c6907d2fdf3b2568
SHA5121967c64b4d8a2b47b27c967588a99e72e105cc53bcfc4779d7db4355c0e11328c09f87dc6fa63b02c4b0353649d6f2d5870a0e8bd3bd477130f450acfb6e193c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en_GB\messages.json
Filesize884B
MD578d6b74a55aebb265eb01098647ee054
SHA11a36615e65b12989db1c12724447888fd38f4836
SHA2567094dbeffb6c93318feec62a79c984639486b056e3a65f2dd5e809baa8ca8052
SHA512b80d271666d8a56c7c40b1e4a13f5919b42e9736850ed9687529402e2d16f8f604ce79a39d655f16535ef0af8f13dde68a107f7d1ec2e3d286b9fcf543c61a85
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\en_US\messages.json
Filesize1KB
MD57b5310c5ceea6c16c4396f1ce221ea26
SHA17328c2b78c2b4bdccd6ac1a8205e64ff52cd780d
SHA256be081908eba63c50a211b9cef1b652a243929d2a99784fd907f1ddb039690a29
SHA5122a56901ccaa088d10661ec006cc8a84db7a148e0250b39f37597e0fee9e35f091c04209e5ddc328657e576f595860642df18d45e9b9eeca11d557dbf6a1270e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\es\messages.json
Filesize996B
MD5f732c8a05ed379e1b32529618e360792
SHA19a603a7cc73bdd01992a6ca86f1fce045a1a79e9
SHA256181e9c6fcc0dd1e325a7c635dbb48176a3f0cc7fc2258a3e6900d78a4882006e
SHA512e3b00c8fa8dc8b6b23825185b93eedcf16808b830429bd4de22f3b03f80b79b1f63ca992e406a298e71b155cfe8452067c6222cbcacab894a7945e0e8b0e44d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\es_419\messages.json
Filesize980B
MD5f027bbba505cb94f30594ef524156fa6
SHA15c0d6e0b5c2a922b7b2f0807039f1c898e51622b
SHA256aad709f1b86d29c174866b7523a56a9f8e50df43dadc70c355aebf4f6e5a6f1f
SHA512f926af90ff9a5a8d45c1934f7e27eced110455891354fed14e9bee22389ed78d09efa1f91ae4d1eaa3ffbeb96ab1cd9176482de254026dc9f7eb15ea0d3b4746
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\et\messages.json
Filesize968B
MD564204786e7a7c1ed9c241f1c59b81007
SHA1586528e87cd670249a44fb9c54b1796e40cdb794
SHA256cc31b877238da6c1d51d9a6155fde565727a1956572f466c387b7e41c4923a29
SHA51244fcf93f3fb10a3db68d74f9453995995ab2d16863ec89779db451a4d90f19743b8f51095eec3ecef5bd0c5c60d1bf3dfb0d64df288dccfbe70c129ae350b2c6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\eu\messages.json
Filesize868B
MD51e6330684fd365329a3e6f3386e5a9b6
SHA1fc364b4b56b5abe5d09d9629ac1134440a3794a1
SHA256659de21ffce844c0085cc4e49da7ba43b0a0559ad1daea1cac9a5c2fb4fc8202
SHA512cb627929110c54358e5d310ffd519f3566bf19ee589d2ad5b2dce62183239f1caec8f930aefced5c564404b24c8608622acc590fc10410ac9f419201417f6e3c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\fa\messages.json
Filesize1KB
MD5ecb6aa187ccb71c491d9a3551dacc015
SHA1f526c57db3089ba42957dfb8e8e61638e7127949
SHA256c06fd6ebcbd67f3b8423242f10695bc77314c7bdfcf9e88e7807f2c087d46d80
SHA51220e1d3042b80afcceafa10687dd7fd9607d29e853bffdfed729164153964762ac0ea147af99469b5ec50a3896d7ecacfcde84c019aefd51302a82ab617039fb9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\fi\messages.json
Filesize932B
MD5985df9dfa1e5c00162ae6218b7c8340c
SHA1446dd8668972bedcdba79a02a5fdd5e2eae217d7
SHA256a9c7d8175ac332a876fa4cb376dbd55812f88807a8f887dd1da2d6164fc8ab56
SHA51216dc4597bd7802c403688571d10f7558567f3d2d33174b0eb42d5b6f33f912b975f505fe567aead8a8deab465898a05a62b48da52b7deb349f60b00b69da7785
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\fil\messages.json
Filesize964B
MD5a2ed59095cbbaf10380b1eaf2f9376b0
SHA11d78e2cf9880cb8b80feb0eb43c06f425b660d71
SHA256627a5a4095d84cd1920e225c5e059b616d0075403e45c48da831bd039823d901
SHA512edea5aeeeeb9d3d3ffc10a03e0198e2d0915d5cf2fd9813776aa13b43c4749b74c409cc0685417895f0f7176ac86d8698428dcfa3a84f483502d52491e270b3f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\fr\messages.json
Filesize977B
MD579924e35c720e70b85cef90fa629203d
SHA1db67974e622fa29f7b856497dc20a16b0e2c61ab
SHA25644a8a4ab378a2b95358096f61e7f58d938cd14a565fc2b449cb0f4a5493241a7
SHA51250dce7a40d42793b89112ed173e7e41346d8c973b93ebfd555623552ef8f3769b07126f49a3c10dc71eb63b7d7f6fae389434915441787bb5efbeaed2d2122d1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\fr_CA\messages.json
Filesize996B
MD5761148cdfe637a6cdb8666426ab4889e
SHA1883e415ad5a360e933f6eed3908f09a3d29ffde6
SHA256b9678377133f0af4019ba3e27da8de4ca1795efcf7a0840bf4e7849f0b195a01
SHA5122c81bfec3039c3a4e652db417151aa04f3c73a0cece0c5fb38a5c08b2131f23c703c887f51fe76e919a36faf02845c2f9e1dff9ee184c106e34ea58100232ce5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\gl\messages.json
Filesize1012B
MD5a2e9851fde1c0c52c89b3f6f50d21f77
SHA184b6e53f014929f1c44433ce1b7cd4a95cc22e15
SHA25675576aecb4c5573ac89205f9abe5f541fb2bd83fcff0c6a56af9b1811ada8877
SHA5125d1ddb0424b4394f0c36052f06907f07b129c0f9145f9ecbcecc5de1a3c103606c1874886259dd0b977d3975876d04ad5807f85460157248e3d348bec2341f9b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\gu\messages.json
Filesize1KB
MD5e5f1b5838bbffbd135f65bcd1cdc9001
SHA107a968ea840b4f397cfe07970b26c2af8134649c
SHA25671ce9eb40be8070fcc9eaacd05d52dc512368fcde03c5a78911959e49426e021
SHA512c34e8c83a2a521707b092ed2a29e6ae1b65e8b378cd7257efb91848cbe9de3e5e7c0a5f441eae0afed8b974c9eb475379dc17acd602299c43ba5853d6c8339e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\hi\messages.json
Filesize1KB
MD57af1db74a8beae6f2b51fa2eb8d56b34
SHA1decb7fd57999a921521b26e6c2a87ab77310916c
SHA2569a8135b318702b7ad755dba30f057b94aba49f0f432c78a183f245cec3504a3c
SHA51234882d2b6e23e23f69ce6cf8bf4039627c0e97e904f1f2fdfe4cd3457efea4c009947d234b70aa8026b7462b742f95f92cb05ca6d965860831672e12010c5025
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\hr\messages.json
Filesize964B
MD57cea98b1252119e684aa03ad40f7e2a2
SHA1b3b158466efed0fe0e6f555c3f502668e1a4d3e0
SHA256974ac2d5033e9b8ce857c6962f890cf2114341aee1c467c3a6a31f438e95ee58
SHA512dfabaa9f5798db2c4cc7c0b8041ef186e6dfca610611e50a94391ed165fcd312e687197baddeef6d7e20dee2a96f3a795e56c33d2ab0fbfa235c1cd36d27bb23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\hu\messages.json
Filesize1KB
MD577618a0be6721e7c2044b8c97f18e34c
SHA1f4b84e830800460b137326e64b8e413c0d0e7c3b
SHA256ae46fc96d634838ea1871fe6539f075f9c84032b037427c3d79e7efa1514970f
SHA51286bcd7826b6dc42c3b43a469df91d6649da511100082e86197ad4261464659387a5c4168697f9810675f9dc71452243d43682cb200b4b0bbd30678e1eba43092
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\hy\messages.json
Filesize2KB
MD5760c791a155eaaf7c7daf6932fd2ca47
SHA1a6573aae68475760759d61917d6e79fdb7105c41
SHA256049a351a6446f1a04cb11d804fed5f0434be64e7d66fab8a96df9f73c92be983
SHA51244beec869b89488f2a60173f32d3b29a928c1b1481a520ef969bc862f562104a3df4e3ef50b288d3cae1d774f61963d2c822230baa8df99cd7887748b8b99498
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\id\messages.json
Filesize884B
MD5d32e08fde9a38477e166d93cd3dbcc41
SHA1361d6fbd0c3a64e8fbb15ab29d436db840d813c4
SHA2560127146af5a8947347041ff4ae190ab8def4add6d1332ebebdd9e7302a6cee52
SHA512caf31946da1e3e698c9f5d87938364fdcbf4e37afe48177ac4ebf4f9b01ce248cf9d71337b3d8503d2ea203b36c6bb7b1a844d3c9fee1167d60b0282278b94ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\is\messages.json
Filesize980B
MD5384abbc1b4c63b5fdd5c581d0ea320cc
SHA1d4621ff4ef0797a1519a5b8fa44dd8908ee0ffcf
SHA256a7de22eac8dc9297a40410957a42a6898a7c86dc39e18f1b21c18b2575cf6c42
SHA5126ce6ea5e40158d1085eabbe02c09051467f2e2b39940b887e314fc67e297e839ec875d53bbf697e8c90eb9ee83ccfe4834ccaa3e39846f8c41023d0cc3aa3e81
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\it\messages.json
Filesize932B
MD5bfb45108dfe88b22a4c21ba89a9311d4
SHA18adbfe5bc4546a34760372e86e7a435779a67b8e
SHA2563b7f062987859df63fbfc76debce38a64b1f06bd7911b0f483ccd975471e1183
SHA5127f110036e07c75044b962c610b4ee68ac273e4777231ad2567a5915f6e4a518b1f5106e8991bf932a216b1ea789a3fc773af8d89089c04c1cda4f9af0ba2fbd8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\iw\messages.json
Filesize2KB
MD57fa445d3e0b5af19cad9eb87a223e67e
SHA168d99bf28f5fe2906bf86c1a6dc2a6d335f5ada6
SHA2563beba204988f1082b779ba53a2b2c2ab45a6e01dbe58265c923a05da64856206
SHA512ae1e8d268edc97c42fc57f281625398704866300a68377dd96ae7bc4ef780aa49f4e407090eb1d5bc4b4cbbf20cf9b351e02eea2dd2e7c593ace738ba9ee9cc3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\ja\messages.json
Filesize1KB
MD5dc16454df114cd680822bee53f7fbcb0
SHA103d3e7731a04ce33465843771183ec1fd1bcca7b
SHA256ee4a474c36024534029eb6c70bf273c4b8c3a1a3c2fce21c2f61849856c76ad7
SHA5127810a54467c64a2f5761a9686dd4c046102aefc1bc9ba0e1e7865f1f947aea1b9a8951cfb0f8c6c96166b2e7a376963933efb461fe80d3f73de3c6112264c9bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\ka\messages.json
Filesize3KB
MD5a8953002c41635a8159860c2ca949b71
SHA1225c7700e1a9d6469e931d6f2c396d7651c8d435
SHA256098e9bedf6e174a719e57a20d7ace41dd00bfae6f8ae068e4b73c418260f720e
SHA51262461cca706f1af6cdd498d9c1ec71c15f97ff42b5d1eb5db7c056319de95589e3aa0f70a797f082463743402c5b6e16b79bb16395363dda2e435a9dd12c3aa4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\kk\messages.json
Filesize3KB
MD5be1725d150eea09200da0830a0692d94
SHA1e0698224df203020070cf52de6d95b1ac9442a2d
SHA256f75bfbe7712ecaafbf7ef13753d0eb6c9782ae057c909f0837a118cac63abaf5
SHA5128492bbe3edced7c8a230bb7470a9f71dff5d5ef01946e8672cd546a6cf01c1e521fae5fe6492929ba6d2995bbfa47cd2af35f58474957cd7de191559e189ed44
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\_locales\km\messages.json
Filesize3KB
MD58d5e9169e35a61778a84bde40259eeab
SHA1c8fee5522e63e8cae181e6009780911fc6951e89
SHA2564a307807ab30aa4b5802c1fc9a45f9eab7291ddf5d067563c8819c720c54d8a2
SHA512f194a7e3a6e840ace1c975a9a0672aabe74b27e6d03c5903ccff0dc75e5af5ffc82fa354ae688eb3038c0b179ae3098fae18652a4c3761e8abe09436bd03589a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json
Filesize884B
MD5a362ec55a03eeb7ff20077b4baf98cb4
SHA156ab926f670584f3fb18b18045cd02065fe41497
SHA2560598da13a53d2ea40e249ded6f7189e39823c16c928dbad4edb0269a9702fc0b
SHA5128c3dd61610637cb04ff8cba24f6c9dadb2f1d7d88ed2cc49b549acd6de6a5fe0cf81b2a4fcba936146854e4adea5d00b894ba8e9010b0f901f29599677df2d72
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\manifest.json
Filesize2KB
MD52347d73ec1fd10d6559fe0817fdeec99
SHA129395b0753b675110ce0701e0786ca857493ef14
SHA256d182f229eed2987f770dca6ec3f795b90fa2e262fccb0dcd268581e29827fd90
SHA51212738dcf76479804941979dc410d39204e589087d541baeb7f7a17dd68a1c3bcc015c9fb7b7fbae333110e3be57d9ba7ea6d0eebd01bbc46b1e0ef21aadbd214
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\offscreendocument_main.js
Filesize121KB
MD5e49cebe66c154de240aea994a2eed7bf
SHA14235b88f7d23a8e60631967b8441e4e43ecc30fb
SHA2563e5405220ce192cdc3f8aa787553733a0dee9673ac99693a8ad304fe2a239708
SHA5125497d85d16ac99f27481082fac4d0a4b18048220d6f9fcdffa78baf9d37b3a6991f2567eda6ed8acf51c365a3922e4ddfadf999846be227f34bcb97b1886c2bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\page_embed_script.js
Filesize372B
MD5b8a692c7eb5fff6add78680efedee74f
SHA1d744dc523fe22956b2f5ab1e0599ae8a277d38bc
SHA256c83f31df6e25e80ad48d1d14b82b0d11e8cd81427499ba83aa6abb7ebfba0778
SHA512bb70a855c7f612172307156de2c402796223ec78dd3ae615bf20943aa484ee70818865cca7e8536e40fdc3103f894b4e23a3420db0b07773ffe536ec918aed67
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\service_worker_bin_prod.js
Filesize130KB
MD513fc8890d973f9aaf5ffc0e2d6952684
SHA1ce4cf88f1247252783ffd2d4135bb8c6bafec140
SHA256502af7913635eb66588dc2f9dfcb8328ca6c17a7d0c415447fadb85a5fe50e10
SHA512e276647d44bcc60de90a42505e2b16be90a517ae5d1530c5b5403e85fafed6cb827081c309dab3e6f9c17077b16239a0ff8efa97d660e28af640b5a692dc7505
-
Filesize
107KB
MD540e2018187b61af5be8caf035fb72882
SHA172a0b7bcb454b6b727bf90da35879b3e9a70621e
SHA256b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
SHA512a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12
-
Filesize
2KB
MD5b1534f2ac1ab4294bb48b92b5da26331
SHA1ea5817817812eac354ccdb5dde78e9dd103b88c4
SHA256f071715a95c21094b821ad34fda2ecf84bb18b173454f0069eaa40b849b22d9c
SHA512684eebc780521218ae944f809d1371cb2433d6fdb9bd8f46b48bd890a579da80aac64885eb65e337e7b6af4ee6191298e9ad1cdc719b0f16e9b01fccd3e9637f
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
16KB
MD5482c300863f744c4739557973a6dc393
SHA152f32da512266d232d89a40d03bbcd43b9194669
SHA256797a199226713dd8c647f2bbc41db381acf6b75d9fc655aaf5a2094491574150
SHA512f39c1ee72c836477875315abf57cd908c6e3d1dc28abc7c0eaf839030c85327411cac699af7b8ba365cef5bd33e39b9dee3c127a535c5b13d4f1de128aa20212
-
Filesize
16KB
MD5a4a8e4902c8ac93b56ed07df38b5a449
SHA103a83256b05d1f59ae499ccc4892a07020043e13
SHA256fa9e822c8d7bdba09614f66a0e77b09d32eee7220b010d77e2b51c729235fcae
SHA51260dccc92ba2046d22383e7aa80ae1d4bdb7b5bae4b96d9269ee6455381a0345b9bd8aa89f228a8182680019fdcfa19ad53f52246c8b694effa21b8ff2312bfe5
-
Filesize
36KB
MD5a7ee13e92c5571e43a035ae7bc7ee5c0
SHA1cdb5ff7aa50e14221a5cc2d2f64116d1fe58e430
SHA25608adf1ba9ce0264de2c0ca975abc4035f57e806204fb17aefc06abdb0065be5f
SHA512ec64a3f8bb3d3a2e649987bead4c71c3e146f189396858023295c28977e7c8cb7bca86d78361589aee7334de27e3af6c366c80e7613519b29f65e419b815da1e
-
Filesize
22KB
MD5b373093fa3ec602ed2ca7ced23f49de6
SHA11387dfd5e3c56de79fc4d5f732415883f72b72e2
SHA2564532bfcba9ecfc4219a293c37ccbaca12df0561937bbd14d9318290489f2505f
SHA512d71bb4bea9d32952d56c012a5017ca8cef6c469aa5321f879912d63ae70668ca5e155e2cb817925864690da3f55089691fa45c3263ee9dc03c50082d2218011f
-
Filesize
19KB
MD556527ab03ea90ad43d662dc6f7edcea5
SHA12df540660479d4d7593958df22e0aa92c9100126
SHA256f437ed4a39e990c2349f87aeb5ceb6480afba642b60eaa3704adcdef12e87757
SHA5128220c8e719656823981f8b07c2ae0e7d449604200fdbc21b1ca7d4ae22263fdfcfd73c1054bd231a35378587e1c590be77da06a8e93d96c40c65b9b9cb1dc581
-
Filesize
12KB
MD592b884d85d6630b4a6a193b7c52c55a5
SHA1fed6d7a2ebaa72e3b6bbafe7f9876d3203db950c
SHA256ac7120da587b40d56546b63392476a76a754ac4fa58b7b3f139d2ff99d312dbb
SHA512c940513a2ad6d6ae647f638d7eea9ce8ea4d696ac82c430e5ec832e2fb2ce707d29c9015b247c19b660a8d53f38f14173190dea595f6e40bcc3fc836a8fa5435
-
Filesize
469B
MD5ff3a75deabc33be1c89fd48ad4ba4f18
SHA101b63b31b3c739daa297fbfe26ebf94758bd56e7
SHA256b07f6ed4fe0a1b12f6c0087f3678e2b4d331134bc3984f5a01e232e1e728e921
SHA5121e548ff079e0822db17b32319f5b6237000f67799183bb60612c10dcaf6e77899b515a18ce8d8c7f51ba164a3e2846f0e0ba6acd9b39a437559a3e6a1608e7c1
-
Filesize
23KB
MD59ddb90ba482ed8b8c5cee6b5c1c3fc37
SHA162dd28c8efa6bad9264d98493b31d7ca64823303
SHA2568c48360948d0f8e51c98160f2ccc07c82861f659a370460746bd27bee693e89c
SHA5125f50605ca5a61c7275b3c38d5f9bc613c8000f870b5faf9254d1d9322f29a8b2cc4239473b4e1f38001f4948a8850a184746960d5c6a99ecdc30c45f6c704ad9
-
Filesize
904B
MD5a35142d6f10865b1d37599fcd907fb7f
SHA1cc80c5c2411d48393e6ad0e1cc8a79e9c956875e
SHA25672381785bfb0d896259b4c40fe086499242b60a48a953ae860fe9a93bed47b5f
SHA512461045acd5bf58ade4c68f2bab5e93fd70c2fc32fe3cd9d037eae69d6567381b056b1fe61e9654f4b55f41fa86fe39a90f26c76017d0be7fb7aa9d8cc7ff1670
-
Filesize
19KB
MD541c1930548d8b99ff1dbb64ba7fecb3d
SHA1d8acfeaf7c74e2b289be37687f886f50c01d4f2f
SHA25616cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502
SHA512a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75
-
Filesize
49KB
MD57ddfaf8e4a182b43cf0c3341a8a04b29
SHA15c94aa125774b9ea6cd24f215bdd934754e6a0e2
SHA25687bcd70c7c8a37fa4b3be578ca75d69019e2e7daa99a7eb9bf70b3bd69534314
SHA5120bc5f660cc503e3edc5be69fd2aa3461b875e940abd6be545ab0dee46da70fe5f053a3cf5be3399d9a8353b57fb49da17ca7dcacb572b64ff302af84454dc0ab
-
Filesize
40KB
MD502172bcd935a834c79339e49871a9dd5
SHA119bd07d25e67ac0dbfa6a6cd06034dd6413c6505
SHA256c37ae112f89a2d89e47be83f795b9f0b91891602939a21f99535562363285e6b
SHA5122a174a71a8387a37eccf05858fe6a4e51a13bb24780565c3bc5ed483919d923a3b1dd8d408fc5102816ea1041ff00a57985f211e1e0826467a713cb244ff426f
-
Filesize
49KB
MD5a51edd3f9cda50ac5c6e0f9b341c5017
SHA1b5bee60ce0f6f92ad78caefadb0bee3c6daeca77
SHA25657f91fe219d3804a4269722aff60e888f0f0261a6f44eadd0d92a5bb592ac350
SHA512bad3968f46a7e4f32ab59215b8f6b7ac8ff3740cdd22b2961f6450fe13c7f384c230095a9df54688fd6c0f34cabfacd2871e1709a1a2d61ff19c05111e597a54
-
Filesize
40KB
MD591fd3420bcb8ea60654a0f62a0a93a79
SHA158b8672720d2d4da91dec15a8a727cdb43e3ea68
SHA256a2dd6be636c32e01109a34cd7fa95b59236c577eb5d103bd618ea46998101e24
SHA512f28ed6eff39a1375b8a1ca4d8632021437799c98622d26d9143c527f70cfc276f9401eec0b1f8d9d2836a00fe4ce7ec69b2c8353b4b7b203f606d4c959b7f052
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
Filesize152KB
MD5dd9bf8448d3ddcfd067967f01e8bf6d7
SHA1d7829475b2bd6a3baa8fabfaf39af57c6439b35e
SHA256fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
SHA51265347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Filesize2KB
MD51c63cee106a389e12b59d82b041fb2ae
SHA16d1768263a2b7dce7976ba638dc5d1a723fed1d9
SHA256d7ffa41a2d292a306efad41576c407fd459efe2efbfb0c1bbada5144ed277209
SHA51298f1ed7db596350e0ea5fe7ee3e6b97e533c1ad2f9c33e8d1a48346215d8b123c4b406147cf49d64d84a36260bb49498695cf5d4c9bf107d1489bdf1e16513ec
-
Filesize
284KB
MD5209a288c68207d57e0ce6e60ebf60729
SHA1e654d39cd13414b5151e8cf0d8f5b166dddd45cb
SHA2563372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
SHA512ce4a7e42738154183fc53702f0841dfd4ad1eb0567b13cc1ff0909f1d330e9cd2fb994375efc6f02e7eddaaae1f465ff93458412143266afdaff1c6bf6477fc3